{ "Event": { "published": true, "date": "2023-04-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-04-05", "timestamp": 1680739382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "7eac567b-1dbf-4f8d-8c2e-adcaf61c1789", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa09ed3-d375-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680673846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680673846, "uuid": "adc05399-ca97-453d-bfd9-58a7fd741c75", "comment": "Malware payload (RedLineStealer)", "value": "b41cf811781bd63b0361c405fc375a15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680673846, "uuid": "5f783451-1313-49ac-911d-6f64aaf748a0", "comment": "Malware payload (RedLineStealer)", "value": "000ad9cb09358b645f4d749e5f0a2e156e6a788e23878e92ededeb0a7a23e8b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680673846, "uuid": "42f50cec-d588-4fb4-8504-14018352b17c", "comment": "Malware payload (RedLineStealer)", "value": "33529ac24fb0389ef9c3c21599625902a9aaf9b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680673846, "uuid": "03ea7c9d-0c1d-4bea-b81a-834bf0aba375", "comment": "Malware payload (RedLineStealer)", "value": "715063a95a4690a38c074b4310f7e5b2c7d89c10275cc9f477b398c66187d1cb62c4ad36a5351c67ac7c56055b2a6f22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680673846, "uuid": "31355c5e-0855-482b-868f-7e8dfafdcf3b", "value": "T13B04D51437FCCD11E1BA5A3F6961A06087BF98026842F25B76C367CD1E32B50F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680673846, "uuid": "ed98dfdc-e2de-4e76-a642-08ccf82f748e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680673846, "uuid": "1285163b-56a7-4892-8a5b-73f2eca82d64", "value": "3072:nxqZWVNaDUSkPSfEWGljsed9FyhpvxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jn:xqZ8SfEWY5yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680673846, "uuid": "c68ab449-be64-4aeb-b623-b5209dc6e32c", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680673846, "uuid": "8c1c0864-ce3d-4e09-bcca-677351e8e42f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680673846, "uuid": "0ea750d9-5831-4a2b-910f-acd9107113cb", "value": "b41cf811781bd63b0361c405fc375a15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53eb075-d3a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680695787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695787, "uuid": "d2fc94d1-4b21-4066-98a0-f323339da01f", "comment": "Malware payload (SnakeKeylogger)", "value": "1c0005ee0329113ead6714ecb0d72c34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695787, "uuid": "31a215d6-db3d-4669-acc0-ab8d82881daf", "comment": "Malware payload (SnakeKeylogger)", "value": "00330ca48a13a195fb80bcaba66fee393bba1821b65bd89cc1349687a99cfa55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695787, "uuid": "4ca2830c-9a41-45be-b157-ed7c22e9ed4b", "comment": "Malware payload (SnakeKeylogger)", "value": "4c9e302a63bfe68d464a814a7acee317d22a6b1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695787, "uuid": "82efc158-44cb-4316-bc2a-97761ffc14bc", "comment": "Malware payload (SnakeKeylogger)", "value": "4815033edcd8dadd90fb7a015fa5712c680515c6e8a467fd711846e027bf80abbebeb9f188806ef75321e5be9b4fe792", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695787, "uuid": "8eae5f65-7547-44db-8237-9260848db6be", "value": "T11D054CD5F150C89AE96B05F1BD2BA53014E3BE9D94A4810C569EBB1B36F3352209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695787, "uuid": "ad13e73d-7a1a-46c1-9ab2-79fb087cf68c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695787, "uuid": "3c036c37-1f5f-4b4e-8984-2f25eb1cdb6f", "value": "12288:arUvlAxUT35lN/NFC3uDZlrciWXDn5Bmc8eD:aw9AxKRVFC3mZBcNXDnfmcVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695787, "uuid": "1767ec67-541e-4ee5-9a78-83ac4b7e6fc0", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695787, "uuid": "439db03b-1612-429b-a9b7-d5a47e55e248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695787, "uuid": "ae7d89cc-7016-4789-b9fe-fe253ce48d7c", "value": "TARANMI\u015e KOPYALAR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0764daf5-d3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (DBatLoader)", "timestamp": 1680719896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719896, "uuid": "bab7e553-2029-45ee-8be7-a679c0c92206", "comment": "Malware payload (DBatLoader)", "value": "3df77cd9b148f741aabafae673c30c15", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719896, "uuid": "afe5c68b-052f-40f4-b1b3-c63ce0cbd386", "comment": "Malware payload (DBatLoader)", "value": "0080c65d479bdb2212ce757c8c874b8d10e2c341a557b40e5e4a1e97b889f1dd", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719896, "uuid": "44f9fd6c-adf5-4b0f-8efd-c28b18c3d18b", "comment": "Malware payload (DBatLoader)", "value": "40799ad5fbf94780eccd795ef07e77303b6638d9", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719896, "uuid": "b750de2e-f081-4b27-9b7a-59d0dc6b38af", "comment": "Malware payload (DBatLoader)", "value": "d03c6ba0a2058f8480f3e7c0610c1db60063064e7a25bb33ad07982000759e410967805282ab9b10f5f9472c73e2931f", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719896, "uuid": "890c2456-cb17-49b4-ab8b-2218e448fc61", "value": "T10135C01AF2E0B537C1EB16388C6B977C9426BD213960A9097BE73E4CDF3515039253AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719896, "uuid": "70c45075-8ee4-4756-b609-47713efbc094", "value": "30abb98664574a11f503e7dcaebd2167", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719896, "uuid": "26355024-633a-45f1-9b64-f2d23373871f", "value": "24576:v6R9yfVUXwTEfF59XADz3OjaZQQJ0nhUGfAp7LM:v6mO0MF59XADzejakuGfA1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719896, "uuid": "e858f6a9-2a90-41bf-a63e-70099db31a85", "value": 1058304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719896, "uuid": "200e9199-75fb-472f-acc7-f92fa710b6a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719896, "uuid": "bbdf4b78-1706-4ff0-91f1-c2f3d52d6cf1", "value": "U prilogu je nova lista narudzbi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37977fe-d34b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680655787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655787, "uuid": "7b8796fc-fb01-463d-b81e-d207cb145b66", "comment": "Malware payload (RedLineStealer)", "value": "7b155bda52ca0ce79e0af08612a8dc86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655787, "uuid": "40ce8bf7-e444-4017-9415-0b148b289ab6", "comment": "Malware payload (RedLineStealer)", "value": "00894354ed5f922ca9665294067ef67f0f818d7df8aa70a0950649f7968f3dfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655787, "uuid": "9ea3829a-ee73-466b-83b9-0566aacf49e2", "comment": "Malware payload (RedLineStealer)", "value": "50ecf7df705cc6d4b37968d6c1e71898937f70d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655787, "uuid": "dd958981-da9d-41cb-9db2-645e40500d35", "comment": "Malware payload (RedLineStealer)", "value": "addb2021ad8f06da942de850ae406f0cdc37ab6517ea549b731d21834ff486539f2267c34058e521bbed6d5670bba187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655787, "uuid": "966cdcb5-3c13-40ce-890f-50eb8e97df31", "value": "T159352342E6ED4523D9792BB04CF342D31832BD919E34D7A32352E20A49B31E5A97937F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655787, "uuid": "f9203f0b-e5f0-4bc1-9a6a-2716c150809b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655787, "uuid": "60ce512d-f1ac-4023-a6ec-6268c342a861", "value": "24576:PyvUkvpt9n0nY9M76SGyld04yKnCwuYE6f:avpjZ0Y9gwA7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680655787, "uuid": "e4dc4bf3-dc58-4ae8-ac17-cdad031714b2", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680655787, "uuid": "bf54f826-f188-4ea2-9624-4e4ec0c7bbb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655787, "uuid": "84ba9161-7901-4e75-82db-b3f3a02f7552", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e84e86d-d37c-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetSupport)", "timestamp": 1680676743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680676743, "uuid": "5402fae5-e101-48c5-8cd9-b86cd7b616f2", "comment": "Malware payload (NetSupport)", "value": "ae4df26eaf3006107fdf4c7c031bcd7e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tumnt.top", "colour": "#DD4702", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680676743, "uuid": "0402b3ed-fc6c-4f26-a411-c3addde1920c", "comment": "Malware payload (NetSupport)", "value": "0205f1e037bacff8e1ff6693fd56027f594f1d7ddb429f94c7557d7b62907c33", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tumnt.top", "colour": "#DD4702", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680676743, "uuid": "a77f55f1-4ce6-45a7-ab8c-a0bea4fc62ba", "comment": "Malware payload (NetSupport)", "value": "8df5f519d1d05804613dd2d35a73c9c9f58fa280", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tumnt.top", "colour": "#DD4702", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680676743, "uuid": "47d15ae2-6872-4f04-9a77-f91f6bde08e3", "comment": "Malware payload (NetSupport)", "value": "f06d5c72a2bd3797335c642c4c7f9fdc2a5c8a47433f4b7590ace8311d12a30feb610222cc6511e8459b7217dd474b0a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tumnt.top", "colour": "#DD4702", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680676743, "uuid": "c0a5394b-218e-4da9-bbae-23c4a565cdce", "value": "T137F3C5A7B3D5233619E303B5660F29DBB61A8434936D9B3064AED02D334B09D867B7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680676743, "uuid": "ece8aad3-be0e-4ac2-b830-67c79422855f", "value": "3072:7ik7rqjJ9lO/td2kP2+HBu0Sy5Tz7WK1knhWw/8eliuoA06szNFoqMC4jniTLbiw:+fnpy5aXouzAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680676743, "uuid": "16d7395d-6d4b-4b41-b315-992b43c939fc", "value": 163377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680676743, "uuid": "77e42b69-2416-4fd9-93eb-489bbd06abf2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680676743, "uuid": "c3bef3c3-86b7-472a-a793-777ee78a2f49", "value": "Notice_4_apr_4364841.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cec5a3-d376-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680674264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674264, "uuid": "595d93a7-7b7d-4165-9e07-d24a44373582", "comment": "Malware payload (GuLoader)", "value": "f35327faafa75ea66d38b1a939ee6b56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674264, "uuid": "132f2706-693b-4f0b-99d0-ad1f88eda430", "comment": "Malware payload (GuLoader)", "value": "02b8b15a4e3ec7013df1d2448dbfc1254826432ac7d99c5946d4fcd319adccca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674264, "uuid": "ac0243ed-6768-47aa-bc49-8bea75faed74", "comment": "Malware payload (GuLoader)", "value": "844cd4dc7b4ca6a501724561b3c1e4fb7679c297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674264, "uuid": "3ff5a5f3-3145-445b-a6b0-d738ce9c1da8", "comment": "Malware payload (GuLoader)", "value": "ca1a066b6b461782e4e2766f8621b244bd618464871706e67ac701a3dc2c585bfe70ff153bf8cfac7443bc876649eaa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674264, "uuid": "a238a932-cd07-4870-8ec0-908e94ee8216", "value": "T1559404982B61F0A4D6A4EA715B518EF067E0BD036DECB06727D87B171DF6DA3C4286C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674264, "uuid": "80b699ff-c790-4078-b720-ce9d020a0f7c", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674264, "uuid": "23facb4d-40d0-4083-9f37-3caedc5b3956", "value": "6144:D1kalHlV/ahTcW46JVu+iV+mcH+2UfaQq/fCmxhhd3ZsuwSFhdJQv:D1FD0cyxis7Cy5/3Pd3Zsujb8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680674264, "uuid": "2b822364-4f11-4e71-ac27-666deb7db143", "value": 446440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680674264, "uuid": "95920799-ff72-4e9e-811c-92638a692dc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674264, "uuid": "1f01ac1d-0268-483a-a7a4-d5e0e292c081", "value": "DI PIPE AND FITTINGS RFQ 79988700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c6768a-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680718229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718229, "uuid": "4c215e04-c3e0-4357-a223-a9484c81d879", "comment": "Malware payload (RemcosRAT)", "value": "a731d469e7eb9cbc05dd16e222946202", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718229, "uuid": "0e985000-bddf-40ae-85e1-cf8444f76efa", "comment": "Malware payload (RemcosRAT)", "value": "02dc4c2aca6b32a790ff9fddb92b22ed74bab685160bd6374931a2e9edd63f0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718229, "uuid": "e8c0ae0a-0b2e-4d6a-bc2e-944a9f4e95f6", "comment": "Malware payload (RemcosRAT)", "value": "388301cc576826a8d720e977d71faccff6f4f4fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718229, "uuid": "8198b619-36d3-45e4-b6c1-595d16a80dff", "comment": "Malware payload (RemcosRAT)", "value": "9d8f520c1de466631c112117565d6d652c33fcd71065f01a0ea1564407ab6777453b51fa3c86a2233dfd2431b7641f94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718229, "uuid": "ddc32409-f339-4195-924e-80ca87d453b6", "value": "T14794D0337A449487F87846322EDDF27297E2FC365C5A58DA32527B4EFA703C54A12239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718229, "uuid": "17c5ae8f-e8f1-4437-9468-e84340249815", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718229, "uuid": "47d8526c-2a57-407d-befe-0eb329eafc55", "value": "6144:Ap+ggFGIQyoI9q+HFzBnAzZDuY3yBl5IKdrrcgjm+il56pUHhx4TN+:w46VI9XFpAz4OyrCXVJHh8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718229, "uuid": "618b21bd-2270-49c6-936f-6b2380247d0b", "value": 419720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718229, "uuid": "1ada9374-ebcf-4fab-812c-8b281342193a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718229, "uuid": "662a3509-c341-4fc7-be6e-94b47c024dd8", "value": "Hyperoxygenate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a25f229-d3c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1680707042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707042, "uuid": "c1c46495-8699-41a0-aabe-8601dd218968", "comment": "Malware payload (AZORult)", "value": "0da730fe948ac7f7e696ec547521da93", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707042, "uuid": "bd5adf01-3de9-40a8-9cc3-a19678ce2dbd", "comment": "Malware payload (AZORult)", "value": "043c0f35c48bfc42f8e8aa3684ff7277e9655a0a57d8fc959462bae10652a670", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707042, "uuid": "5bbfeebc-3cd0-4d07-95ca-cb515c258c86", "comment": "Malware payload (AZORult)", "value": "b4df4f154195438c5c7bdcc3d72a71b816cfbd7c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707042, "uuid": "28942c2c-4d74-4032-a812-8fab6d1ce1e9", "comment": "Malware payload (AZORult)", "value": "390cfd39065cf69b7627467e369c68e818908c1224fbe154f6e9aae0d8109731f78c951cdd14f5feeebc51e57cc58b21", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707042, "uuid": "fe982744-301a-4cf5-8e98-2c577c87a2ce", "value": "T19E541284B781C0ABF8A307305D3B8F1A5BABAF1574D5520B1B607B8A7D7B1819D0E753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707042, "uuid": "76d36ea4-85ac-489b-b357-228e75d040cb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707042, "uuid": "ab4df452-c2bd-4cdd-8c97-5973c67e4791", "value": "6144:gYa6oBcDavcqOnPmLBD1K0KAQlUjMRyIkwlqSgcoYk0gd:gYhDRqu+LHK7AeUjJivBpk0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680707042, "uuid": "bc8a72c5-c808-40ff-bb89-14d2f87ab0e4", "value": 294198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680707042, "uuid": "a35b2c96-6908-4950-800f-755db1c9795a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707042, "uuid": "b29f92c4-e038-42db-9d4b-50f3d19c9e6d", "value": "043c0f35c48bfc42f8e8aa3684ff7277e9655a0a57d8fc959462bae10652a670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81457c0b-d37e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680677580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677580, "uuid": "a3b450e7-a6b6-4f6d-938d-eea71142a4fd", "comment": "Malware payload (Formbook)", "value": "1c3406fe37a8bab1a36896623363a078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677580, "uuid": "23ba1cca-e897-493b-b59a-8dde8d1e9c47", "comment": "Malware payload (Formbook)", "value": "04c3eb853a54a7a81fc0eb11dcaf12b481bf2e8fc303aaaa39d26fb30eafd325", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677580, "uuid": "1ff732d7-09bc-4caf-9e34-69b3eb77e346", "comment": "Malware payload (Formbook)", "value": "ab3d9178e7defe71abc287b1961f80814f2b42d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677580, "uuid": "756a8b06-d8d1-4b39-a2d7-4c335cf4f58c", "comment": "Malware payload (Formbook)", "value": "23964aa1590b5ae8dbc6902e9e145e9fb30481c87e37b3191dafced6902bae7f2285615821ef46539b88961f8a122518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680677580, "uuid": "6013a3e3-dced-49ea-b500-1d95dc74d31c", "value": "T16164121813E0CCDFE833ABB30E795727FBD6BA0918389A1F4760394E7966742991E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680677580, "uuid": "af7642e4-11d7-41e0-9ed2-4c4878a40ec4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680677580, "uuid": "54f4c97d-fec0-4666-ac97-7a89bd110899", "value": "6144:/Ya6SfYchpUfPGpK3mtdejG9db/zjRNwfxTIunW0BPH3Eb9O/W:/YcfZSfupKulbLjRNnh0BfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680677580, "uuid": "efb1f1b3-df9a-46ed-9d30-d59efe3505bb", "value": 308730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680677580, "uuid": "0b1c9a83-8d02-4c29-96b7-eecb90714a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680677580, "uuid": "8d2838c6-3c94-4977-9847-f8b6ad439b89", "value": "Reference Notice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87cdd0f-d3c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680707711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707711, "uuid": "91ba2d01-1f68-4141-9500-ccabdd79ecf9", "comment": "Malware payload (RemcosRAT)", "value": "d2642b47198f8a10c4dbfa02545d2d49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707711, "uuid": "7957d8dc-4bc1-4792-8e89-9c5bc6ba144f", "comment": "Malware payload (RemcosRAT)", "value": "05285eb0b45ead00948244e6aa80fae084907341a3ec9eb5458b514413da0b91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707711, "uuid": "3aa87916-e4c9-4092-aaf7-3eaf5bd2eed1", "comment": "Malware payload (RemcosRAT)", "value": "960c3706dee2524b11b94c3836bc910749bfee45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707711, "uuid": "b6cc4c8f-615b-4c9b-b892-ed61206f2cfe", "comment": "Malware payload (RemcosRAT)", "value": "bb9df7836c5b087fedaeb5efc484fda24800232fbb6ec75ed04486bceff8bb94c0a1ec333bd1f200e0d2a60060becc62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707711, "uuid": "5f784f13-017b-46ed-b384-1b8aa51ee32a", "value": "T10A352316B6E2CF25C19C6BBDA9A71510037363AB1533F7492EC815D66F23BD90A01F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707711, "uuid": "3c3dd410-52eb-4bf6-875d-b7efbd115297", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707711, "uuid": "fc080ddd-1687-43d2-a1ae-096defc978a1", "value": "24576:ULU5+JhmD1Ado5tvUnVGG0UvGClc5uHPf:S45KdEvUVGGRl3HP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680707711, "uuid": "11d2ea53-b567-4949-9ec2-947df356dee2", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680707711, "uuid": "aa3514d7-7c56-4e57-afe2-b9e53907f06a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707711, "uuid": "ca97fdff-c07f-4058-afb5-222b39193bee", "value": "05285eb0b45ead00948244e6aa80fae084907341a3ec9eb5458b514413da0b91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f82ddd4-d34b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680655619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655619, "uuid": "1b572617-15d2-44ce-b080-7c05a5b6ac43", "comment": "Malware payload (Amadey)", "value": "54af57ad62f9e36d77f27294c8c9a4f1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655619, "uuid": "1e63d63b-23d4-48bf-960d-0b1ff8324ebe", "comment": "Malware payload (Amadey)", "value": "057824afd5354def91c5fff007639f7e34188acfcc580daf3f4e32b00b42167e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655619, "uuid": "3580acc1-1dda-437b-a048-4a8ab04817e4", "comment": "Malware payload (Amadey)", "value": "bb73e8bb941fcbbc93cf34983bf74871b560a362", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655619, "uuid": "6ccf7ea3-210d-41af-a96f-c285f041b316", "comment": "Malware payload (Amadey)", "value": "291fdc43abde48c519080d7a2623496a83b9a604522713e14d6104c090ff995c572336454bcbcbbc1006b7b035fa7833", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655619, "uuid": "e1473bc3-139b-48a6-b85b-1b8cdca7a6af", "value": "T176352323C7EEA032D6F54F3148F502831B3A3AB66A7C435A7396A41919F22D6E571337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655619, "uuid": "d009fc36-8510-442b-868d-3cce1cd759cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655619, "uuid": "f2dd59ea-82af-4d55-a419-a777a96b0d9d", "value": "12288:XMrCy90qAhJn5IzxrqYsuBbeewcGibYaoN1JQvxQHpKuP31XVaKGP38vtv/XrUof:NyDAhJn2zxnb8ebYao3THpr1d1rUh6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680655619, "uuid": "32cea12c-2e5e-4abb-8178-541acf25e5be", "value": 1065984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680655619, "uuid": "bc194f9e-245b-4bc5-8c93-35b504e6dbef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655619, "uuid": "b7460e44-bd59-40ab-8f68-d3a101abaecf", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b355f4-d3a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680695868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695868, "uuid": "ea77bd83-f681-485c-b4ac-e781928a5fda", "comment": "Malware payload (SnakeKeylogger)", "value": "8eea1d9b3d36e101f372d615c00ff30c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695868, "uuid": "3a523c57-ce06-4cdf-b3ae-9b0a380033cf", "comment": "Malware payload (SnakeKeylogger)", "value": "05814abad81a4628904e7990185a87d6e6c55069a129f2e8cd7c2b238ce07620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695868, "uuid": "3d9cc4ed-0ebb-465f-8603-713c855fc868", "comment": "Malware payload (SnakeKeylogger)", "value": "9ce92a81e27924d09261e729b2141b80c63ed4fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695868, "uuid": "d1151d47-eaf4-466b-8f80-19c6ee0c6574", "comment": "Malware payload (SnakeKeylogger)", "value": "3c1a5514a33e8a4a18b8308180108ef65bd70c2965a8456edafec40bb39f86119cc503d935548a2198245dbc29725a23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695868, "uuid": "3a6fd141-2874-4da3-8b69-a539e32bc165", "value": "T112252A9AED50C4F5F96E06B1A8677F302C922EAD46E4400C657A769636F33422C5FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695868, "uuid": "0e9f5072-6898-4a36-b3a9-3f755a3d3cdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695868, "uuid": "e2164f04-98b1-498c-9bb0-152c14b9a476", "value": "24576:iwFZzN1ctlNLDP4YPqwvZJCDEPU5XW9UAro:ZWV7PPvPKEPU5XW9hr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695868, "uuid": "0796ae59-fbc4-45bf-9b45-00ad08da2690", "value": 999424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695868, "uuid": "0b02a59b-f632-404d-9c17-4fcbdaeb1bf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695868, "uuid": "82e467b8-fe09-4e75-b7ef-2835987e8271", "value": "Halkbank_Ekstre_20230404_075819_154055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c59e3c-d3bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1680704131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680704131, "uuid": "8f60b6fb-4ed0-436d-ac0c-38af190da866", "comment": "Malware payload (AuroraStealer)", "value": "afa3bcdc787dda27bf210d3ed07ebe67", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680704131, "uuid": "b0bfa33f-61ac-4f2a-baf2-c6e8a5aced31", "comment": "Malware payload (AuroraStealer)", "value": "06b9839676b68a9b472098410257b871463c88f967201ee7a338b34f47813450", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680704131, "uuid": "6ebf9180-1b45-47be-8b78-2c19624e1e04", "comment": "Malware payload (AuroraStealer)", "value": "703a0772e4eb59c9603427335c3358f67bef1866", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680704131, "uuid": "017ce95f-e589-4bdf-90f3-6a6cb7b16061", "comment": "Malware payload (AuroraStealer)", "value": "d459ac4fa522f19e7d243b5ab9fbb5730e9be7b235a4a69ce721b38429a3b2862a273151169d438ed68b91bdc89292aa", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680704131, "uuid": "4d367525-3e72-45c3-b6e0-c8403720b9dc", "value": "T1E6A64E3E1CBE123791A4D6AACFC58827F444E1B731222E36A4D397998357D8369C317E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680704131, "uuid": "e9c30c6e-6d2e-4599-912a-bad8d372666d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680704131, "uuid": "e2ffc2bf-54d2-473e-aee4-28b3a7b4a68b", "value": "24576:ydcpX974YxuVTTXFD0aARS79WSLHDMiZO9tHbo:ydqt747ljYILg9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680704131, "uuid": "92847032-65ba-4fa1-b3ed-58d4afa31c48", "value": 10329672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680704131, "uuid": "d3a4db21-1779-42db-ad77-0d862f459cce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680704131, "uuid": "a59655da-cdb4-4b43-84d2-843feadaa262", "value": "afa3bcdc787dda27bf210d3ed07ebe67.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9566e10-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680699605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699605, "uuid": "dd7f980e-8d8c-45d6-8561-059193b2eb51", "comment": "Malware payload", "value": "9bd00db6f14f5b0f27be4642a4178b73", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699605, "uuid": "43ba0361-af7c-495c-a12b-5fed05effd24", "comment": "Malware payload", "value": "06bf26eb518e2e57165e4ea925f370cf42cd7da2ef29bf080c9142a69c947bec", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699605, "uuid": "9697096d-a917-4a1d-93f9-7e4e3c95c677", "comment": "Malware payload", "value": "37af7b51ae959b2a117390d8b9abbf65225d08b1", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699605, "uuid": "b0acbe93-954e-41c6-a7a0-1927dc115dc1", "comment": "Malware payload", "value": "a413dcddea142fb0f831b213d77c8972e0cb0ec2ac7c0599b573c9933f228957f6f6a9c13624154f7b25d3a1f8e6e326", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699605, "uuid": "7de1a7f1-b24f-42d8-b6f5-20737d268567", "value": "T1EC617D1457DA0308F3F3AB3A69BE52954E3B3956AD32C74D0059414E52F1A40DCA2F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699605, "uuid": "0c3fb6b5-909a-40f0-8b3b-8d166bcda549", "value": "48:89HahU9Dmel0iglZ+YlpQfYj1sAT1rTRRSJxodgImcC:89H5B0+g6YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699605, "uuid": "676fed3c-6d50-4586-8e1b-aa24d83c98d7", "value": 3458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699605, "uuid": "6640cb38-e105-4eb5-8362-65d8f9815173", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699605, "uuid": "683be84c-c71d-43db-9616-8b40c05bc8f4", "value": "Screenshot_202_404_190038.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab703d7b-d3a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680692683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692683, "uuid": "db0f88cd-a93c-486e-a3ac-d5201c1d9920", "comment": "Malware payload (GuLoader)", "value": "25e1aceea3b1619352a3f359a9f15705", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692683, "uuid": "d4fe4f4f-3fae-4a71-be71-5b1661e4c67a", "comment": "Malware payload (GuLoader)", "value": "070caacfbe454c409ff11ac0ecb98632a091da232683315ffbc1069fd1be8800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692683, "uuid": "4ca9bf41-3572-4407-9f1e-a5df52b3eebe", "comment": "Malware payload (GuLoader)", "value": "5a1e60ac5c1cb1969e22aa8bcdc9f6ed1f430fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692683, "uuid": "f8ddeebc-fd77-4bec-8d39-8273f218b8a3", "comment": "Malware payload (GuLoader)", "value": "3500b3815e7a6a7065635ee342968c603c3569c2c399a572508993ee08cddc5ca65b24d13d61601fe592aa86868aa391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692683, "uuid": "aa022d49-5fb5-4d6b-9db9-f26a6a033708", "value": "T12AC4E1C3A1B097E2DC6C803A55028823479EBF2AB5F4DA123BB73258B4F1195C57B767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692683, "uuid": "1b90d095-5ef2-4749-ac29-96457b830a8a", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692683, "uuid": "b202f304-28f6-4758-987c-2cf4ce66f907", "value": "12288:jTMY1ltUnHhjGp6o5S3Vm7eQ8hLYK8WEA:jThtejPo5y0yNB8Wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680692683, "uuid": "0170c120-8a8a-4e42-926d-793187993144", "value": 569576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680692683, "uuid": "debce3b6-5426-421a-b7a4-fd0baa64ff61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692683, "uuid": "deed3fda-c961-420f-ac8c-3dd57b95d8bf", "value": "070caacfbe454c409ff11ac0ecb98632a091da232683315ffbc1069fd1be8800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d36d121-d3a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680696042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696042, "uuid": "95cffcad-7f9c-49b6-ad4c-0e0220c0d2aa", "comment": "Malware payload (Formbook)", "value": "2dbf73fe2d8a30a0484967a197058972", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696042, "uuid": "d8b962a8-c496-4af0-a6ea-f97b5d569519", "comment": "Malware payload (Formbook)", "value": "07fd09956f054bb7bf7246e96cd8abfc78f4786a5d7f2b5b54a95e477ef0530a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696042, "uuid": "4598a932-daa3-4ba6-930e-523b3bb65545", "comment": "Malware payload (Formbook)", "value": "bb26638cc4a3e1697bc300e1196ce89a5ea9e532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696042, "uuid": "f2e6d786-8866-4b44-b467-8e81f6fc58e3", "comment": "Malware payload (Formbook)", "value": "71ac7a9f558bfd4e6a8a0d69abf8a38c29fb79b343ee7855c6533c0381a12a8fe7189c29fd0909028bae44977d25e376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696042, "uuid": "47eb3882-d7c7-4560-89c4-2940840b8121", "value": "T14204128BAF603130F53DF27F077F956029C13E3D098148CBE18614619AE79B5B9AEB25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696042, "uuid": "ced61ae5-0180-466e-9b02-c5fbdfc546d8", "value": "3072:WfjT9Q3dRfUIIrjGk72hj5isfF3MHL27LRSHwLPrJhr2lygqGGPxepRKx9:WLR2fUIIPGriKF8r27LRSHwZhr2I3GG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696042, "uuid": "f504d6d1-ba1b-4ee2-9a00-457ccfe14ac8", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696042, "uuid": "9101c121-84bc-4819-9e14-1c104adb2ad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696042, "uuid": "eee6df44-2ed3-422f-aef3-4c9ee9e971a3", "value": "07fd09956f054bb7bf7246e96cd8abfc78f4786a5d7f2b5b54a95e477ef0530a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40a5709-d3c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680707381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707381, "uuid": "6f4ebe00-9cd1-4f7d-ab5f-d2051b043e8f", "comment": "Malware payload (AgentTesla)", "value": "a276e6fccf121f5eda040af0f41e95d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707381, "uuid": "811eb9d8-921f-42db-bc22-1acf724a780c", "comment": "Malware payload (AgentTesla)", "value": "09af1116fcc5d0e0e19ae3f0c98f0360957f1ebaf5abfb13c478b002a5ce316a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707381, "uuid": "f2560f9f-f920-4834-926a-fbadb84ba85c", "comment": "Malware payload (AgentTesla)", "value": "b9016dc02ca5e509372bf40e1cd9dc938a599052", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707381, "uuid": "9f1e46f0-f540-47c5-a4e8-73b82aede200", "comment": "Malware payload (AgentTesla)", "value": "70522113f88a823cca1bd13f8c89e087a0867bc12dee0a3669fbb60eb4f7ea460bc5f2ac7ce5985e443805e9f91d77d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707381, "uuid": "f61e9832-4abb-47ff-9544-959e3f4a5681", "value": "T1EA34CF4A791A74AFC81BCA76CD992C189B70A3A7A717C507B00B13A98A0D7D7CF111E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707381, "uuid": "0bf85ddc-fde0-4df9-bf72-ba84b6f64dc2", "value": "6144:sW7rw/SqwXycsBSs1+VK8LRpb3zWMJoZCOVn4:0/ShXycsgs14nFWMuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680707381, "uuid": "76445d97-cca2-415f-9a53-9ef753dce532", "value": 237640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680707381, "uuid": "8210f0b7-d804-4342-84b4-3b753a4268c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707381, "uuid": "cac94d53-1b95-4ebb-bc10-e02b341dc24e", "value": "09af1116fcc5d0e0e19ae3f0c98f0360957f1ebaf5abfb13c478b002a5ce316a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3c4e70-d3c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680706937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706937, "uuid": "68dadd9e-9370-46cd-9804-1123fb846026", "comment": "Malware payload (Formbook)", "value": "b7544b96e02d581258b4fa1951200f40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706937, "uuid": "40205900-86eb-432a-a401-ff385687fd4a", "comment": "Malware payload (Formbook)", "value": "0a1573dddbc69e98f2a99b1447ee2188cba36391f2abb734f701a106f31f507c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706937, "uuid": "c96ad4a1-982f-4b37-b8bf-b0e9e37d7d1d", "comment": "Malware payload (Formbook)", "value": "8955e889ef956b54cf124260ade7e776d16a0bb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706937, "uuid": "8d3d7110-b16c-45e9-9e60-6d17e685b8f3", "comment": "Malware payload (Formbook)", "value": "057929368f3e5cbc27c9bdca9152d027b6994abe5d422512635a6328b382906e1996ae50a49d8ed92bd3e43ae667abe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706937, "uuid": "3f36f08e-26fc-479e-818f-537663af8f8b", "value": "T197E43A7929A84E61F435DF748AA0C023A191AFD7BF21FB181FD632584E739C274DA05E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706937, "uuid": "e0b4f222-2111-49bb-b6ba-80dcc3a6cf3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706937, "uuid": "5613aeec-50a9-4a24-b23c-cc619cc2aef9", "value": "12288:6/RmSzNFHKYmWl43LaFGpaREcmQvKj6Kuwi/n84ulZXDX:6nLYWUaFGpaREc/3RrnT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680706937, "uuid": "7849f132-98f2-4639-9caa-8a3230e89497", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680706937, "uuid": "204a1f01-c8d3-478b-af55-da158fb42baa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706937, "uuid": "0d69b494-3be7-4d28-bbc0-026e711c53d6", "value": "0a1573dddbc69e98f2a99b1447ee2188cba36391f2abb734f701a106f31f507c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec223c41-d3a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680695798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695798, "uuid": "90d07f6a-9228-4c25-b80b-2c2db877dad0", "comment": "Malware payload (SnakeKeylogger)", "value": "f1c4926e030a458b3a3ce942819737ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695798, "uuid": "6f7ddb90-560c-428c-b4f0-3568f87c1b29", "comment": "Malware payload (SnakeKeylogger)", "value": "0a3efd4da63b8892d55c9b5018961f354b98bb2f2c5232ac682bb7cb0c03c04b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695798, "uuid": "8fe67b6e-f060-427b-859f-5bc4388d8279", "comment": "Malware payload (SnakeKeylogger)", "value": "750ef74a807eb1ce0e75eaaa39ea195a2e0c122e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695798, "uuid": "cc0e8a9d-baf0-4561-a001-365554995c41", "comment": "Malware payload (SnakeKeylogger)", "value": "af04767012e55493737afa806504ee9436c0b609868d422cb7d2a600651a17d589288a799d53dbea9546a7a15e6b40e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695798, "uuid": "c3b71b3c-b8ad-4712-bc50-a16c94afe3f6", "value": "T1FCD4F1186ADDA146C01A82BD41D8D6F023B5CCD8D361CBA34EDDBED7B3CE3962526097", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695798, "uuid": "66948a27-3564-4219-9ffa-a597cf0f16e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695798, "uuid": "cf1d2403-ba47-4739-bf04-f7275153ab66", "value": "12288:xuLuRhkrIkTMtizKfJfPAYnNoX9lVqZcLTimOMt+ge:sy8IkItPf2mcLTimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695798, "uuid": "6c104637-1073-4952-bcfd-50700a7274a3", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695798, "uuid": "2e115d96-a15c-4000-8e0d-9863a70a0550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695798, "uuid": "7dbda54c-8677-4ca6-9165-a073290dc554", "value": "4DR9IzCecZky2Yh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d26e87-d3e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1680719571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719571, "uuid": "0843e50b-75ad-4305-a102-3a47d7bbb31f", "comment": "Malware payload (zgRAT)", "value": "ba7e2aac0c7ded6647e8cd65111a9abf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719571, "uuid": "9f6be8ec-4655-4704-8d06-6f9d78dfe099", "comment": "Malware payload (zgRAT)", "value": "0a47b9730c684c8246e72ad83f547719a3dce5a4dcc1429eb2131a517fd744e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719571, "uuid": "7b0469ca-99b5-419d-a438-656340bb0993", "comment": "Malware payload (zgRAT)", "value": "b2489cc592a59d46a311564408b93c9f3b1c54d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719571, "uuid": "4d3ef8b7-66af-40e0-b127-dd54d13313ae", "comment": "Malware payload (zgRAT)", "value": "fc4d9efd0c478954775e42aeaea4972087d6370bbe718edbd39ba0100d9a20448224d4cecbdcc3ff5d253324c183be7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719571, "uuid": "b0f2e7f1-5cc5-4652-982f-543f1b5121fa", "value": "T14D54E01BB7D78A51C3145AF5E2D7901413B2E741BAB3C3473E4903994E43BEB9D88B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719571, "uuid": "fee15d68-76dd-483b-ace1-dce61456d869", "value": "6144:cbr6GunSGcYnNcbNwdNwABQhAnv27yqYmTP/bf9I:Q6GunSoNSNGNwhN7+mL/hI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719571, "uuid": "5d7e5699-0c2a-402c-b3b2-ab314197e281", "value": 289512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719571, "uuid": "1abe6939-a4ef-4842-b3a7-d7fd6af92e8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719571, "uuid": "b119aa43-977e-4d4d-87a8-c88d80caf796", "value": "Dekont-k,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2a4730-d3a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1680695374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695374, "uuid": "6bbb219e-71d1-4030-b74c-70e44af598c5", "comment": "Malware payload (CryptBot)", "value": "1e86e670cc13a073626d32f5d889a612", "object_relation": "md5", "Tag": [ { "name": "1e86e670cc13a073626d32f5d889a612", "colour": "#019739", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695374, "uuid": "8a0ebbf2-561e-4c0e-8ec3-ee733d1bb0f0", "comment": "Malware payload (CryptBot)", "value": "0b87bee586878a7befc241eacb1e7a5e128fbd131ab6d1c4ec50fa96435ede96", "object_relation": "sha256", "Tag": [ { "name": "1e86e670cc13a073626d32f5d889a612", "colour": "#019739", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695374, "uuid": "1d6d46b4-a352-44ab-8bc9-4602ac745cfe", "comment": "Malware payload (CryptBot)", "value": "1f03a3361928de868c03083ce83351f0e8181381", "object_relation": "sha1", "Tag": [ { "name": "1e86e670cc13a073626d32f5d889a612", "colour": "#019739", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695374, "uuid": "61b05cb7-85d5-45a6-8628-ea8f195e08fc", "comment": "Malware payload (CryptBot)", "value": "b898c14fe0c58717dcd738f977725b1247a85bf7276a0b3c8a1fe952f57b419a47a21abd79a152429fe66eaeaec2f24d", "object_relation": "sha3-384", "Tag": [ { "name": "1e86e670cc13a073626d32f5d889a612", "colour": "#019739", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695374, "uuid": "5608b670-18f2-4dcb-9b34-8c746e8cd6c0", "value": "T13B069E3CC3394F17DC49A278D8454C7F258C8AC903559692BF8F7825E7BC0A92EAD7A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695374, "uuid": "f17efee7-b691-46b1-a7ab-de92079534c2", "value": "3dd425be495656a2dac22f72f136f555", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695374, "uuid": "2fe9c369-57fc-414e-8376-f602269d280a", "value": "49152:eV0Uh7kCmdgImd5MwcZyN5Q0VY8BCm5eKClDKsmCPIN7f0sFI2cM+xRRMm:5U6CyRtYCIppJJdOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695374, "uuid": "42b400ba-6211-49b7-951b-a17b520c2974", "value": 3699712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695374, "uuid": "aeb07573-67ed-46b0-81c5-26885ee93f27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695374, "uuid": "b02d7031-0e68-416c-9ce0-0c6025b2f564", "value": "1e86e670cc13a073626d32f5d889a612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c5b289-d35f-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680664399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664399, "uuid": "775c612a-691b-40f8-90fd-8ae4259373af", "comment": "Malware payload (TeamBot)", "value": "5be402a7c580e653057aebe60d9c7d96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664399, "uuid": "bb3eb085-035a-4ec8-a249-06a44010401b", "comment": "Malware payload (TeamBot)", "value": "0cc7060ce4d11da31e6de65632d1e78d2f6c9022393f1fa49b0bf845108ca3b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664399, "uuid": "1536cd31-e9d4-4380-886c-8dc91d62a021", "comment": "Malware payload (TeamBot)", "value": "6c2af3395d855746cad60f17934a9b89adc07cd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664399, "uuid": "db7a60b5-20fa-407b-84ef-2d300b7713a0", "comment": "Malware payload (TeamBot)", "value": "de817e61dbd80136ebb63aebb3a98eb2cef876277818f97cf8210acd4626332d21b636309c89407d62d9abc165e15eb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664399, "uuid": "bc2825fa-5860-4db2-aba0-eca7d56aa900", "value": "T14D448D1163F06430E51B0A328E2AC7FD2A6EB861BD657E5E17B9493F1D30BA1D23271D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664399, "uuid": "a9495ac2-aeea-4b9f-928b-3fdc7f7dfd53", "value": "6060635c456bb9828d825ba0d905b9ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664399, "uuid": "6010e42a-4238-427a-aa54-81537d769d0b", "value": "6144:/9DPTwWOHxUamXDB89+WT6xqk2LTloocaW:/9DPTwWORRmXSIWk9xR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680664399, "uuid": "83b21e57-15af-4763-a1d8-f9344b53ba27", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680664399, "uuid": "6da8a066-1bd2-4934-995c-a9bab9f0f0fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664399, "uuid": "e510e6f3-3b7f-4cd2-a397-a8be2f4248e1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17bd99d-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680700424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700424, "uuid": "dfe68b6c-5c3d-4a40-8c67-e2128489e1e6", "comment": "Malware payload (AgentTesla)", "value": "2854a204fa53b12c9e02fcbc4620248f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700424, "uuid": "41bd0a7a-fb7a-4bd3-91ee-28b2b98c1f7d", "comment": "Malware payload (AgentTesla)", "value": "0d2d3cc50572a90b68558d070375be0474a2294f5cc1d4ac0249b19f21d12d8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700424, "uuid": "98263137-3c43-4e0e-8c1f-b3c61d984d4c", "comment": "Malware payload (AgentTesla)", "value": "1027b992077a2b8e5d8eb91711f5f17b163c6b4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700424, "uuid": "ee5d5466-7ae4-4647-9722-2dd6ea101531", "comment": "Malware payload (AgentTesla)", "value": "0fba97ed2903fb57c1be0a3db5681140b1b268d12002ae10733fa93de9fb337caf29ccfc2711a51e6a3927dd684016eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700424, "uuid": "621add0e-eb57-4ec2-8669-842931d9a986", "value": "T19BE4125522E84B38C6EF0B3AD89A324A47F5FD7A2593DB6C5DC164ED0EE3B44C940293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700424, "uuid": "7f561260-feaf-466f-a3a2-b125d30daeb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700424, "uuid": "1d7f861c-8f9d-46f4-bef7-182377df178c", "value": "12288:9JtrlgnUuZZioQctbABsLa5knwWMZtowAetH87LcJrOSZPVDv:9JtrlSeoE4ayUDtHOLcJrFPV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700424, "uuid": "17bf8caf-6072-4e74-85ce-834a17a6266f", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700424, "uuid": "2489f6ae-f87c-4909-85b4-dc331c70fe5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700424, "uuid": "e2844919-b89e-4aeb-a2ee-bb3cbce86ec4", "value": "2854a204fa53b12c9e02fcbc4620248f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad84818f-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680699559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699559, "uuid": "e914517c-4bfb-43d4-9614-096cec732ba3", "comment": "Malware payload (AgentTesla)", "value": "9c35611bdb841f545cda1023d089bded", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699559, "uuid": "35ed0141-a1dc-470f-af1f-576b876e3499", "comment": "Malware payload (AgentTesla)", "value": "0d3e49d997a7f0261e9ba685ef0e91e5b51aa44c2c44e93d6c53621b9cea7a63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699559, "uuid": "cfb6a263-f846-490b-8787-3633026bb357", "comment": "Malware payload (AgentTesla)", "value": "e88da3bf11954db75ddc7015c5979a8e2315d9f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699559, "uuid": "da8ba232-e183-4cb9-bec9-141e728cc28b", "comment": "Malware payload (AgentTesla)", "value": "3ecb2380d10c1b411815fb1d459415abad43ff16362330fa5e35a983f7bf806056c909373fe39964180653a813fa70fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699559, "uuid": "6bd0f4a6-8b05-4a1e-acd0-08385c453d3a", "value": "T12AC412855F6DD716D9AC4776C853266003B1FBAA8193F7051CD641FA0EE338A4EC1AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699559, "uuid": "a054486a-d3ee-48a8-bef6-c715b234900c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699559, "uuid": "062617ee-ce46-4f18-ac87-ecdddfc4f6f1", "value": "12288:+rlhWjF2605+0OjBV28p+JtW2WBMd+OFBNgdzJW6r:+RhWjFM5+0g28p+JtW29kQZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699559, "uuid": "2b9b3b75-deb0-43ee-b7c2-24ec29e44bb9", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699559, "uuid": "0025ec29-61f4-46da-9ff0-44f6dfdedc6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699559, "uuid": "9709b187-65ce-42b5-ab81-38c9e4905065", "value": "DHL_AWB_5539839616.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099d0fe0-d34b-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1680655475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655475, "uuid": "23bd9cb3-6dab-4ad4-929c-98081235b378", "comment": "Malware payload (CoinMiner)", "value": "bcdd716ba4cda07226d3620d1019007a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655475, "uuid": "282e2ab5-05be-4e18-954f-dac44c162139", "comment": "Malware payload (CoinMiner)", "value": "0dafd010cf0d9571aecd733a2bfc2c6be7ba8a06e689e0d93df5fdd3d9d8bf0d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655475, "uuid": "eef53dfa-6bb2-4dc2-875e-cee965706507", "comment": "Malware payload (CoinMiner)", "value": "c62e7627632a64310575f65478957abd72f138c2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655475, "uuid": "05489fdf-7b7c-4c18-9790-7602f7f9a864", "comment": "Malware payload (CoinMiner)", "value": "15587568a6b0cc65de08dbc1969295c8ff78355763cf77535ea255d6a7d4eb9b44ce83c0d3351afc5c725fc98c21c192", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655475, "uuid": "f178e9e1-4ee0-4949-ab5c-0ad731b051cb", "value": "T10A34BF13E040C834E89AE1FD84E0CB44D62FB429A7D4A5CF139D15E79549FB2AF7C26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655475, "uuid": "328e145e-2216-4b29-b0da-a067d026b070", "value": "f206bceae653170f260a5a8caa10e809", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655475, "uuid": "2c5f07d5-d8f7-411f-8c67-02527c9fe152", "value": "6144:C2hzBjPbn1uwkwh0v0+Z7581qgRu4gqYTkAetx:CtTwh0v15581qgRu4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680655475, "uuid": "70a7c508-f72d-4fd9-b0c1-85683da087a2", "value": 244896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680655475, "uuid": "69bc0a26-01da-4fa3-9564-eb94d1fbe0c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655475, "uuid": "f972a95a-ba51-4e53-b388-7e39a8ef4fd7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe505dd-d35e-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680663941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680663941, "uuid": "1b418087-05d7-440f-828e-c85bfc5978ce", "comment": "Malware payload (TeamBot)", "value": "55f71bdd43a084fbd18d4d333b9fb6dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680663941, "uuid": "45fa1461-b8d0-4fb5-be05-1ec57d9cc968", "comment": "Malware payload (TeamBot)", "value": "0dde54786dfb33eb21bceba95d017977c7647a553ef91b1fa1dd7742198b6206", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680663941, "uuid": "dfbcd6da-e597-494d-9cfc-e61b19088b75", "comment": "Malware payload (TeamBot)", "value": "91b9b3995154f94797e050c309e162cef626a724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680663941, "uuid": "1102b35b-ed0a-4e66-922d-6bc52add04b2", "comment": "Malware payload (TeamBot)", "value": "9982c8948c4c38e1cf301503f59aea734669f6648a637e9eff6c9b8bf6a75ebbdb972ade00992270e5dcccc453669d4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680663941, "uuid": "81c79ef2-823d-4dbf-bbdc-6ec6577fb4b1", "value": "T102449E1163E06430E51B4F318E2EC7FDAA7EB8619E667A5E17B5493F1A303A1D27270C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680663941, "uuid": "df5558f4-ebe8-408d-9461-82c9120655f2", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680663941, "uuid": "d3b74bc2-49b2-4b3b-ae5a-8b0816dea85d", "value": "3072:NXx1EFxBBYhUvucuBgA00rGDWxE0nB59kGAV6Z2pjYhbGwmb+4Yr6EN5hL0Zjqai:FGRYBKB0r+cpC/VF24fEXa+aW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680663941, "uuid": "ce774313-4af4-4d7e-b9a3-5a0ae6a767bb", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680663941, "uuid": "655aea53-b1d6-4e38-810e-72d553e61c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680663941, "uuid": "c2541e5a-3f77-4830-bfa2-32b2409c59c9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ecc950-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1680718254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718254, "uuid": "36c11bfc-0e29-439f-b2e8-1f2ef5b940e5", "comment": "Malware payload (AveMariaRAT)", "value": "40c1c7cc552d4ac05aefcee9cc37b0ce", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718254, "uuid": "1dbb5edc-b44f-4261-b25d-76a3ce2fc37f", "comment": "Malware payload (AveMariaRAT)", "value": "0e3e551f81d8d908b962ee77ab0ba388b98997b59559a760473defbc33bdfa13", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718254, "uuid": "b2fba0a2-f20b-4348-ba82-9f374c0c2f44", "comment": "Malware payload (AveMariaRAT)", "value": "d16b3e93c6772c8e487763401481e975d684fc98", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718254, "uuid": "bcd5ac7f-bea1-4482-8df0-cb6ac7a5fbad", "comment": "Malware payload (AveMariaRAT)", "value": "33228f2fd884c985ec0326086de5848d9a16459f33e20493331eaa62345a68bd3ecf7d6d865e19e44f44946b3edb97a9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718254, "uuid": "3066c2d9-a743-40e9-8bbb-82a9784edb87", "value": "T17235333F99B649CD68B4D03724E6F613A7135A7E36D3E08F28CF75269D8E9085704A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718254, "uuid": "b12b8300-0963-418f-ba28-3cdd009858b6", "value": "24576:PwtMqjAv7glzFZxQWtXP+lwyYNQj6XaaK+vf:YMAAvIdZGlwh9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718254, "uuid": "1307fb8f-a8dc-4cca-a58f-d7fe6d089127", "value": 1071106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718254, "uuid": "da32bc89-5591-436d-b3cd-9dfd0609acdb", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718254, "uuid": "4b44acef-c651-4506-b213-793144bb84ec", "value": "QUOTATION_ APRL 310377FIBA00541.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffebdc3-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680718219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718219, "uuid": "d500505c-c676-45ca-9fcb-bd83fd822a18", "comment": "Malware payload (Formbook)", "value": "9e5128a6782e76b37a2b464b7d975a4f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718219, "uuid": "b914d77b-c106-4458-9cb1-3ec932215a72", "comment": "Malware payload (Formbook)", "value": "103cf52c3ebfb35ab71a2da83fffa69811eac23679f3ce22b06d6fc23660d7c7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718219, "uuid": "42b215f0-e112-4c0d-b3f0-4e637c604f99", "comment": "Malware payload (Formbook)", "value": "e1cd14ab661c9a7c50b9489b5aaf22c56c307a6f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718219, "uuid": "9554ca98-dc9b-41e5-9061-0ecd283fd59e", "comment": "Malware payload (Formbook)", "value": "49e1f953ae1808e8a369cb74aa0b5ac8590e90a93e6b71159812974a52491413940504693317ad9cbacdad502b1039d4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718219, "uuid": "1d32472c-ec10-41c5-a516-afbaf8447412", "value": "T1D3D42304F0423CBD9B69B5575BFF5AFD277EE2965AC714EA0B833013A01923FA5D2848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718219, "uuid": "5b31e3e6-aac5-4f25-9c45-073abe6ab910", "value": "12288:9R81IeVud6hMYe7jOw2WkyV4+87zxSe8SSmzUAAOROLq24Ny3fNa1ym7JchMeR6x:9R81IWud6SYI0W/a7tJhfzUAAOROG24d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718219, "uuid": "b3629270-ec6c-452f-9452-786083942673", "value": 628672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718219, "uuid": "cd57f3b6-67c2-46e9-8952-52b0805eb60f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718219, "uuid": "aa9399f2-00e6-4837-a0a4-27878cdae5bf", "value": "Confirm!!!.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0909e1-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (jRAT)", "timestamp": 1680699635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699635, "uuid": "b3832770-6b91-4562-a208-6f76dcdc7077", "comment": "Malware payload (jRAT)", "value": "5c3254a9afb6a94e5e60daaceb6ccc52", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699635, "uuid": "3388a8d1-b992-4488-8617-63a2935ea2d7", "comment": "Malware payload (jRAT)", "value": "1048702f26f403530b9716d624d291656c2bee0ec329b30e36097c6189bb8e9a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699635, "uuid": "484f2d35-e138-4378-8d33-2717e79d1287", "comment": "Malware payload (jRAT)", "value": "d886a15f050d8f0c504295adbc6f03299cd860db", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699635, "uuid": "0a15699f-968d-4e3b-967c-cb4aa1f252d7", "comment": "Malware payload (jRAT)", "value": "ffd3d0e87202b3db1406a84bfec6d134908ab2bff1d629eadea994be49d4afc69264244d410440de70fb9309baa1d976", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699635, "uuid": "2c059006-45df-4780-a236-3c38e204e93a", "value": "T115F4021BBD94D4ADE323813032E2C41AE90485CD9896F6775E50AAD848F4CB50B8BFFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699635, "uuid": "3111381a-4fda-4448-a0c7-45fb77bbb2b1", "value": "12288:QRvrLJvZLl+YBVeUYz4rVSmp/BKdPFLjzjrkGflGYSTrI90ed5K/ZtWWynJwy24o:4LJvZHBVelc9dBwFvDkG9GhE90ejKBtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699635, "uuid": "642fa31f-8ccb-4386-af84-f7e4c8a39a28", "value": 760276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699635, "uuid": "09ff7ac6-2857-4295-a189-9f5676afd6ad", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699635, "uuid": "71592747-62e2-464c-8b75-296baff73d45", "value": "Order 11599 ProSciT Co.PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7d0cf0-d393-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680686595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680686595, "uuid": "3dfd0726-2930-4ae7-be05-7a26696c2afb", "comment": "Malware payload", "value": "a97fdea31d788a3083dfc95af47743be", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680686595, "uuid": "7bddc336-454e-4b72-b06d-4772da20b2dc", "comment": "Malware payload", "value": "1097efff866dcefbc5e3604fb647245ae5ff7aec55337240a4bc0f9a217ee667", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680686595, "uuid": "9e4d4e86-19a0-499c-b194-fc9dcf816e5e", "comment": "Malware payload", "value": "4707025f432fc014c76e38e1326be62bcb7fba13", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680686595, "uuid": "7cbdf3f4-acb7-47b9-8209-aae36a101c84", "comment": "Malware payload", "value": "97cd25d876487e614365a50321c19ecb535a2bcd35fafc1b8ebf10519a20333608e2bb96748d302104575019fbce8158", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680686595, "uuid": "55b0a656-9ea7-49c3-a727-c4c5ecd39a3a", "value": "T1618623D8CDACD369E05687343D15ABA715BFB2CD12FE5A80F2E5646CEB99C4050EC382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680686595, "uuid": "d8a7e75e-99b7-4f1e-9ce6-78ac4bbe5695", "value": "196608:0qt5ImE9tC3azZ5eJoLowsp/wqt5ImEjVUY0m1/Bqt5ImERRo2pMwp:0W5DE9tC3qZ5eE6wW5DEjVUYV5W5DERL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680686595, "uuid": "f1cb059a-b926-47ed-9f6f-197f48ddf890", "value": 7887472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680686595, "uuid": "c8b329a6-5a45-40c6-b68a-14f94d2586c8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680686595, "uuid": "f9becfe7-0ea9-4141-ada4-db60d6c39779", "value": "Invoice-#GD59840.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8d81aa-d351-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680658429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658429, "uuid": "23c14060-a65e-4e4c-bab2-f9037c153e19", "comment": "Malware payload (Amadey)", "value": "16afba75fd7e7478c57897aead972fbd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658429, "uuid": "97413237-95cc-414b-8cce-71942604472c", "comment": "Malware payload (Amadey)", "value": "10b88e147cbb5dd5b38170807f12101a18cbcae07bd4186701a7c062257f18fd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658429, "uuid": "9011d677-3557-43f7-82dc-625080200faf", "comment": "Malware payload (Amadey)", "value": "03a4d3b11eb4f3376b5d1f8df01d263255b3ab04", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658429, "uuid": "768ff542-62ba-4c5f-ac42-3c8b6763520b", "comment": "Malware payload (Amadey)", "value": "926ece70358f6023febbc3f42a831a8aea7b9d504bd23655aabbacd882c21a345cd19e22a816a6bfdd2c777bf9401300", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658429, "uuid": "e0ec44ac-f7fe-4ecd-aa29-b262aab68562", "value": "T1E6352362F7FD4437E9B62F7028F607930A26BD604DB953AE3385D92948B34C4B97035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658429, "uuid": "07cc70f6-fac5-4fe4-885e-a6df79e63022", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658429, "uuid": "3a5e37c8-4878-467d-8707-f3db47a5f494", "value": "24576:YyDTczcwx127QcaVP7LTB0JWHby9kJ2JUUdN:fnQVdcwj/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680658429, "uuid": "57a8e11e-f3a2-4cab-97e2-e767366473ae", "value": 1063936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680658429, "uuid": "4e600b00-e9cc-429b-80d8-44ede93f1acc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658429, "uuid": "5e60b1d6-ef92-4c2d-9394-6b86fa7ba083", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729dcb48-d3e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680721364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721364, "uuid": "acf77247-8fa9-4243-b17b-884348965fbd", "comment": "Malware payload (RemcosRAT)", "value": "291a8d6fe1adf2fca024566c8503d764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721364, "uuid": "bf4af68d-9ccb-49c3-b554-a8842dfe7baf", "comment": "Malware payload (RemcosRAT)", "value": "11327f3b5123a0f6325b9370d4321bddc00ef1619f6da209503ae1370b24121e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721364, "uuid": "af861aef-8662-47d9-b3ab-5f7f2089b758", "comment": "Malware payload (RemcosRAT)", "value": "9ca786b5151b12a83c87e53e66eddf2ef795cef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721364, "uuid": "eec0e2b2-8da6-4137-9c9c-8ac763125dc2", "comment": "Malware payload (RemcosRAT)", "value": "91eb51377eb6730f13ead365198486b0478dda6da6508823c3f838a7dd3772500f524d296c3ae6238a8bb992057fa161", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721364, "uuid": "4f84a45d-4e61-4810-a8eb-8f3c9937cb5f", "value": "T12915224B2B329F2DC82417BED433694483B997A2A961E3A6ADC47CD91E37F41C950DC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721364, "uuid": "ac99eee7-33cb-4074-8679-34b5f211d856", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721364, "uuid": "edae1281-a5f6-4bff-9b0a-281c4d1c3eb5", "value": "24576:lIUXw/ofMskDYVNszZVN480r+LiPkUuYtnkr0SHckG:l1Agc0m50iLOkUuv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680721364, "uuid": "9ca1f432-00ee-44dc-bc92-a4506f2f8c1a", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680721364, "uuid": "01b1755a-4bf0-4665-a7e0-be6543b9de11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721364, "uuid": "96839eaa-07ba-4206-9759-9cd66226e088", "value": "hesaphareketi-01.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629efed6-d3b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680699863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699863, "uuid": "871a5e2c-43c6-4f14-983d-33a8bad40dc1", "comment": "Malware payload (AgentTesla)", "value": "e0cbf5d1654558fbd430448c1ee2a2db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699863, "uuid": "211536a5-907a-4489-b1d2-4ed06d1e61cd", "comment": "Malware payload (AgentTesla)", "value": "117121503e42ebd3a8b529475b62963cc9e0018b18c157f193d4643abade7c47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699863, "uuid": "47adfc93-6685-4722-a752-f835dcd1498c", "comment": "Malware payload (AgentTesla)", "value": "fecdd06d5137421bd31707c850cd239ee802bbfb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699863, "uuid": "d156eecf-5e96-494a-9c99-84e79ce47400", "comment": "Malware payload (AgentTesla)", "value": "b781622d7b867e8cac2e66a3d8d8515ab0f13a8dfa456dd772ddea138a801d9d6255c1c3a3e7bdd7c6c7d3e39884786f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699863, "uuid": "42151524-5c5a-452a-8b65-d2ff954b89c2", "value": "T18555493439FA501AB173EFA98BE475EADA6FB7733B0764191091038A4723A41DEC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699863, "uuid": "1a5aa3a5-6126-475f-95b4-f09ddea3efca", "value": "12288:RqgWsD7by3LJ7C3IP1NBfHYKCxBMU2eD2CTQoi/RLExIy5P74SKbR+Fzk+GQHERC:RqgKVGryyB1GOjQaYid3pz45HCdYAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699863, "uuid": "60c77019-77fa-4416-ba04-96fbb0b49656", "value": 1333760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699863, "uuid": "6da9ad2e-eb4b-434f-bc2f-8d252dc89a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699863, "uuid": "3155d7d0-21ba-4577-8a5e-508752fe2061", "value": "NEY-7895 NEY-7895-A S\u0130PARIS FORMU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd14eb4f-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680700498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700498, "uuid": "9827b618-ebd6-482d-9dbe-50ee03b8a7d6", "comment": "Malware payload (AgentTesla)", "value": "5278312438677dd5ada609a211ac43e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700498, "uuid": "02fa885d-d32e-42cc-a4bd-9a17695f3af1", "comment": "Malware payload (AgentTesla)", "value": "117d6cc2cc059670b2917d74387f4f2d57c520b2f4198d2ed193f1490ca11cd8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700498, "uuid": "76476f4e-59a2-45b0-9ecf-3be2c665f566", "comment": "Malware payload (AgentTesla)", "value": "915cf1971c7370ce6ab3a775df9ff913693ed6e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700498, "uuid": "3a4f6973-dbf8-4e04-ac94-fb3f9a44dfc5", "comment": "Malware payload (AgentTesla)", "value": "7eb5868db8b54614cc2a1aeed097a75d47532d4f58298dd314241bc99696d5ba1b298040845c08759a39120f0b3d1c40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700498, "uuid": "8406e6b5-69aa-40cf-8f63-b9b3bf7c60e7", "value": "T14AE4120C26ADD221C9FF4F7DC572144883B62C2D9A36E76F0DD0246A6F72781DA167A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700498, "uuid": "9a5dde16-bf0e-430f-bef2-7c27b3d66a5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700498, "uuid": "81e364ea-a610-413b-b34b-071edfc55a5f", "value": "12288:/4oy3XCxGK+QQJB3b5ayw67dojH7K2L9dptxmNG2HWdFYWgty/xWfWc8:/7y3XkGK+B31a1Udu+SdUHqFYWsv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700498, "uuid": "19009fe2-1abd-4ac2-94d1-df8b1671476e", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700498, "uuid": "9cd03d40-8c15-40e3-b127-7b98e714cb40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700498, "uuid": "65483827-fd53-486a-8bb4-22f1895bbe86", "value": "5278312438677dd5ada609a211ac43e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0287e9bf-d3b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1680699701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699701, "uuid": "3ec5f671-9538-4ca1-9e01-1f061ba7da66", "comment": "Malware payload (WSHRAT)", "value": "4506609052cdf6605bc1cb75ae98f72f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699701, "uuid": "bbda5763-558b-44c3-a964-5b2462c4deee", "comment": "Malware payload (WSHRAT)", "value": "11c9fa300062cd13dc92c22aab03d0540a0b7e5011a02262772fbfe11ddd7527", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699701, "uuid": "793f0d16-68fa-4468-8e1d-2a3c2843fb12", "comment": "Malware payload (WSHRAT)", "value": "a246b8a971321da3f0342bab294b25c5fc7ba22a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699701, "uuid": "52a1fb4c-30d3-45a1-8535-c034359f5fe0", "comment": "Malware payload (WSHRAT)", "value": "5a27682d86453dc41426455364a2fcc7351efb5dd7bcfad5e2a40c3825130b77ca8b3f76f305aee717198cb7518aa12c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699701, "uuid": "11ba5a58-44b0-404e-889a-704940514e63", "value": "T14C152DC525B87A06D7A3E764C721E122EC74E9232CDB21D27DC43E4ABE76C405DBDA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699701, "uuid": "d6d48ad9-60e7-4f93-8b98-c230566f2b02", "value": "3072:MQRtE/RfXjgAo09DDryiBm4l9QIyIYWjmBM6vnY9l28zwfOJlK3gB:MQM/RfXjJ3Bv9Q9WhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699701, "uuid": "a3cd7504-f43d-4ad4-9325-270f236074fc", "value": 917456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699701, "uuid": "f1782d2d-b19b-4f13-8386-bfc716a0fa25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699701, "uuid": "60267573-e16e-4986-aa26-ca66fc009596", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004696f6-d360-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680664479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664479, "uuid": "f889f83b-cc46-4321-810f-37cde8d73542", "comment": "Malware payload (Rhadamanthys)", "value": "69d0e24333a1d4c834717169f17e4846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664479, "uuid": "b2d91368-5510-4661-b8c4-39da43127721", "comment": "Malware payload (Rhadamanthys)", "value": "138c86d9c22182dc809f2747d012d792ed391a84081e513c7c93d8786801d5f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664479, "uuid": "e730d06d-f0f9-4f4e-a36b-80d9d3c5ce02", "comment": "Malware payload (Rhadamanthys)", "value": "e3ccc30a2d23a380d7be3835bf3fc4afb5917342", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664479, "uuid": "a9262f8b-3ee9-40c7-9ec6-efd38010b711", "comment": "Malware payload (Rhadamanthys)", "value": "52f984bfa186d82f8915b02eabbfe0be121e28066e0eaf47cf03603637b98f62bc0815928db08413294d306387b6d6c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664479, "uuid": "43f67329-9b01-4dc5-aab3-4bb87336d735", "value": "T18874C00163E0A420E52B47318E2AC7FE2E6EB4615D657E5E2BB9493F1E743E1D23270D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664479, "uuid": "2706ac44-3d92-4779-aa68-e556dd8e53ae", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664479, "uuid": "7a539863-aa7e-4bea-b0dc-471d07997463", "value": "6144:ub1Nu4rWybAtx2iCGLnmpHochet4CBWgBvaW:ub1Nu4yybAbCGLCHNe+Csu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680664479, "uuid": "1ad27008-d602-40d3-bbe1-64fefe083bea", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680664479, "uuid": "2402985f-51d5-49db-bab8-a42d625d4922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664479, "uuid": "2aa7d7f1-b58f-4081-ace8-d1d5be2e2868", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b118cf-d3c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680708323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708323, "uuid": "d9ec2094-b9f2-480f-b670-902c10ca37da", "comment": "Malware payload (RedLineStealer)", "value": "b657e9a48b2d70f0378f7a1cd6a2e7cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708323, "uuid": "db036d13-7def-48e7-a1c4-461411a180a1", "comment": "Malware payload (RedLineStealer)", "value": "15454a57bb35dbd31ed20363886b59d2e674e737badbd63c439d0633aca534af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708323, "uuid": "77045a45-c581-4366-9369-2eb812ae9618", "comment": "Malware payload (RedLineStealer)", "value": "ec14628466d4660630ea5bfe8e4fa6aa7778de3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708323, "uuid": "f121dfc9-1861-458e-96e3-f3b5e525cf5d", "comment": "Malware payload (RedLineStealer)", "value": "879323fc396a0423df21290c6daab0794ec7e67a6623f80116230aba3e5f4d7a0d16cbe2e53d315a66f1559158240945", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680708323, "uuid": "0aba88d0-a06d-4650-9e52-4bbed53b2501", "value": "T166E41247A5EC4073E9F62B7428F602830B35FC916D78836F778AA4560CB36A9953136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680708323, "uuid": "edd35308-0da2-42e8-b0d9-c70abc1606d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680708323, "uuid": "c5606dfd-0fc2-432a-b007-6bab2fcc65bd", "value": "12288:nMrYy909zukmpwHds0HL1mQOS4m2EAJTIusDJ6f4Zig7Qfs6y:Xyovsu+ouTIH6N1f/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680708323, "uuid": "bfe0a850-eb89-45d2-b85a-004af2d0888b", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680708323, "uuid": "7bb107da-9f0a-4e45-bbcb-296f5488c70f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680708323, "uuid": "54ab2e97-9d7a-4545-a9b1-5b9d4a46200f", "value": "b657e9a48b2d70f0378f7a1cd6a2e7cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756ac666-d34a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680655226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655226, "uuid": "b46d39f7-8b4d-4345-b87b-b06c4a1f284a", "comment": "Malware payload (RemcosRAT)", "value": "bfd9a208c4e94c0b5b46c35ff6121eb5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655226, "uuid": "ce91a382-4320-4085-a8ee-b165e8c5c2b4", "comment": "Malware payload (RemcosRAT)", "value": "155ca2a0805d91f0677c262aca5016c88459874cab0ec51c1953499479989f7e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655226, "uuid": "2d4c9dbd-cf79-4411-aca9-b840a1e3c299", "comment": "Malware payload (RemcosRAT)", "value": "05a33eb328e1c34b545c1fe0b11152bb1dcca37e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655226, "uuid": "b15d688d-349f-41c4-898f-84094b1f7844", "comment": "Malware payload (RemcosRAT)", "value": "90b840c5e66b6b5e7c3a6e2e65c04d4dff452e8c708669dda8d6e656f0f39e442b9c7c812911efe0226867d6d147dadd", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655226, "uuid": "48157796-c1f0-43bf-9902-1a272f58f9cf", "value": "T125E0D817412F07B6C567BC4874E34A9FA5270C59725D0FA421F15C1E21426A6B3EDE15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655226, "uuid": "cca8a664-bd6b-4a58-9fa5-dfe80be15209", "value": "6:hyJHCy1xFdeGgdEWRy8DOckqi23fReGgdEWRy44Ak2clHozLh8CmNIy4hdy5RTOL:UJig4ukDOVqZouAC6vGXNIy4ny5tOVqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680655226, "uuid": "3139daea-ed4f-4deb-b810-d31e5aa315ee", "value": 370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680655226, "uuid": "4c40ea13-1302-48ce-a281-adc3fcbdf554", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655226, "uuid": "2d1742ae-3687-4992-8a4c-7cfdb30064ba", "value": "recover.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e83a12-d376-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680674310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674310, "uuid": "6c7e5117-d378-4bf5-962e-ca02cc6b54e5", "comment": "Malware payload", "value": "1edf61e6e80cbd4ca48cd6b3c138192e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674310, "uuid": "64a3cdb2-b501-4e73-af1b-e43b86ba1656", "comment": "Malware payload", "value": "15ae7972399e45f01e8bdebf6a50021cf9c10a1e7d310a26fc6eb4001f8b2dd2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674310, "uuid": "c83d910a-4905-45e3-acbd-c815e40a35d0", "comment": "Malware payload", "value": "69be77bc6cff0bfb2f0aad3bfce775d9885e93a1", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674310, "uuid": "f6c9a27b-666c-4eda-858a-28bd18be42b9", "comment": "Malware payload", "value": "dbe9d5c82ee9564c0fe1c852d1121741dc8c6485e2df6c6757a081f838bbcebaf187a9f9a93e54f71adeca1b391995e7", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674310, "uuid": "453274db-56a3-4cbc-8475-50ce1e34c0f2", "value": "T1BB62B0AE64E38677C30DA730A04C2B97175C3B5120072BF337B0ED9A1178A9F2A5F954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674310, "uuid": "411e43f9-0627-4f95-b81a-58600bbb515b", "value": "384:IXQ1tdHsy7uv7v0QzAiivZZdMjfn/l4qXB5Wugxto12eg+x0D:AQTWy7uv7v0QzAT9Mjf/aruo9fD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680674310, "uuid": "23700be2-a56b-4d61-a844-8ff51735e073", "value": 15759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680674310, "uuid": "9a9a29d1-1423-4432-8cba-da53a8a560aa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674310, "uuid": "6bcd1ca9-35d8-4aa8-b00b-c1de61ecb46e", "value": "New Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc659e5-d391-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680685839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680685839, "uuid": "25a65d62-518f-470b-80df-22a27c108fd6", "comment": "Malware payload (AgentTesla)", "value": "d04550cf5c9e88ff3de8ad3f4c01a87f", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680685839, "uuid": "c3847f0c-a435-41cc-b44d-d041c182e6ac", "comment": "Malware payload (AgentTesla)", "value": "171ece443c391368e41103c300ee377786a56265679f71b2ad245b101a604f84", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680685839, "uuid": "cdcabdb6-d42f-4df7-a027-d2fc60169a34", "comment": "Malware payload (AgentTesla)", "value": "9f5f3f683dc2684b3cbac90102c9a67375a48986", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680685839, "uuid": "3cf7e153-cb0c-4834-beb7-cb1dae1f9f4e", "comment": "Malware payload (AgentTesla)", "value": "b93c4f96c576d38f1286cd739c0735fe325fec4ab47f537b3f6f1ec63f804ee018f1a085668faccb0e195ce4033a0bf8", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680685839, "uuid": "621afb7d-ca21-4c0a-8940-e5dc6e9314b9", "value": "T13ED423E1A062D40BCC275E572AA74D56C9D8232E4EC205EC790F4475DF76B8A02BF3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680685839, "uuid": "46ff1892-3a38-4aed-9b62-7dde308a400b", "value": "12288:c1o4xTlkWgy835NZ7IYrYulalPjBCKe9Wh1sJUgjJYqEr8p3zBMVrmJO4rxN4P:AoWTJgx5N4uAj0WnsJxJVmsz6Vrt4ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680685839, "uuid": "49988c3e-8b1f-4c10-a872-f1f38bbd6f5d", "value": 638316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680685839, "uuid": "e7737c83-699f-4c20-9fd1-caf89e9f0222", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680685839, "uuid": "aaea2820-e907-4672-bb80-aa4fa57c4330", "value": "Catalogue-05042023.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d585f110-d3ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1680698337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698337, "uuid": "32df2f0d-314f-41dc-ad4f-e8273549fad3", "comment": "Malware payload (Quakbot)", "value": "e94c5f36ec0cccccb231e1cd04f2a646", "object_relation": "md5", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698337, "uuid": "7ccb33df-0a85-47e9-9295-6f455277aa67", "comment": "Malware payload (Quakbot)", "value": "17a5f734547bbc4a7c170f2e7f3812cf916ce7ac8dc948bf87afd3a29fb2148a", "object_relation": "sha256", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698337, "uuid": "eff78468-c0b1-431a-9e01-559afd961ba2", "comment": "Malware payload (Quakbot)", "value": "d21053609dd9439198a5bbfe6284349f02acf954", "object_relation": "sha1", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698337, "uuid": "7c312c65-c1dc-46c5-b630-d89579eaf4d6", "comment": "Malware payload (Quakbot)", "value": "9ba57020146d60e86a4769bd2db13839006bddf2cfe73fda4720ca9d1272af8387f0c8deed217c272c65500ccb2f28ba", "object_relation": "sha3-384", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680698337, "uuid": "4ea01bbb-f760-436d-9bb3-f333e5e2b5f2", "value": "T1FF24A4908BB6306517B76A27D62A5A50CE2C0E2E96458147F47E3380FFEE44DC6F49F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680698337, "uuid": "c46b4d59-a6c4-43ea-9a39-573f6db4a97b", "value": "3072:Mb6wMEcRevUzjLZ5eC+Gos6eZHZLe2s3dHjcOIIaeywwJ9DgbYjUubh69Zg4xKi0:i6diUnLP+Gos6eTC2s3yNjUu169ZgkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680698337, "uuid": "4a00c983-62c5-481b-9d11-7e42fd8de7fc", "value": 226077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680698337, "uuid": "a4e19d50-c76f-454a-a65c-d12f376a1c7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680698337, "uuid": "eb1e5414-ae0f-4e43-9c1f-2800f4c5659a", "value": "AprilDetails(Zs5085).wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a8b9a7-d39e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680691358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691358, "uuid": "361307ef-9236-40da-8310-9aa4e8fcb0fc", "comment": "Malware payload", "value": "37db445b1de71956bad4bf7d5142db3f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691358, "uuid": "7071f1cf-18cf-4185-969e-89aa2f3fefcc", "comment": "Malware payload", "value": "1afee64787f72a5625842ed3abfd39e914b34bdc0c08998204dab89f2c404df4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691358, "uuid": "0d541ea4-c468-4a0e-b0d7-9166d1903d88", "comment": "Malware payload", "value": "0e712061738c8034238b5a577a0afdfb1f2a9186", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691358, "uuid": "eb18633a-34c0-436c-a648-8fc2b00b90b2", "comment": "Malware payload", "value": "f126b31f24513fededdfcc5659501963a9fef3272a1f6808ca6c9d6c6e5422e7439d5265da79679f2a3995b2e1de0506", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691358, "uuid": "799007ea-f2e2-454d-92ad-ea5808cbca62", "value": "T148F42381476B3886DC2EA676152BDCC8DB18F95CA5E389752C7D2071DBFFC394AC1228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691358, "uuid": "23a2b1a8-eb49-4212-89ae-7365e6ed8e6d", "value": "12288:c30J7eHiVyGO5s6bu1GYeYvGLue8SxRP8G0Tx6Gea0uHFZEkUtv4ubKK6x+/nmY:cg7lVy55jbMe8umWa9FqkDx+/nB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680691358, "uuid": "ad468b01-ccc4-4450-852a-740a251152dc", "value": 764821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680691358, "uuid": "d1b4d864-9707-49c1-8b9b-0279c10ebe24", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691358, "uuid": "434b4bac-996c-408e-b882-61a10e9ef9de", "value": "INV, PL & SHIPPING MARK.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f374d73e-d3a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680695381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695381, "uuid": "c558e47a-f5e3-4273-8e42-d78a3ba7b945", "comment": "Malware payload (RedLineStealer)", "value": "3ecac76ececdca212a778724712a6019", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695381, "uuid": "6cc17c79-b4d8-44bc-8404-c26770e2927c", "comment": "Malware payload (RedLineStealer)", "value": "1d9f58cbc7ecd1142b9362d5ff35d54db374631ac9cfebff531c1e0dc88ff2c5", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695381, "uuid": "8b33400c-6398-4b35-88fb-590558504f65", "comment": "Malware payload (RedLineStealer)", "value": "538768fc640c75e13c48157855769aeaed183637", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695381, "uuid": "cbaf0311-b729-4d70-883b-77cef5faacf1", "comment": "Malware payload (RedLineStealer)", "value": "52468ff72ccf119c48e241c5b5faca7a26b8a3c70d33f0cb6ba3799aafabf6fe3444b4cdd08aa6223533f77abd14d042", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695381, "uuid": "ebd6b59f-3885-492b-ae58-ac010a56416c", "value": "T1C755F115B5D1C472D5721A310674EFE2957DFD300F68AD9FA3881ABA4E30AC0CA39D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695381, "uuid": "6d55521c-d6a7-418d-8281-4144f8255004", "value": "bdf4bbd8322c7503664a0d5386b047f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695381, "uuid": "bc5ac7cc-fda7-4de6-83af-20eb647f29b6", "value": "6144:USxhkoahBcHw5Th9ETGzXFbLj2tnH0uTm1i/1+sW7:UohWBVThK0bH2FU54EsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695381, "uuid": "aad6214f-5af8-4428-9a2d-f25dcdedb719", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695381, "uuid": "2b79145b-1924-4be0-99cb-582dfe67906a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695381, "uuid": "b6c781ba-246c-43af-a44a-6119f1b59405", "value": "3ecac76ececdca212a778724712a6019.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de9dfb7-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680718216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718216, "uuid": "5924390f-dfd4-4f32-8d2e-4314f043cfd0", "comment": "Malware payload (RecordBreaker)", "value": "b8e50c50e6c44ee5f7153b1b4bb9cda5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718216, "uuid": "7b08d8ab-72de-4469-ac11-403752e19987", "comment": "Malware payload (RecordBreaker)", "value": "1ded564af3fcfae6bb44f6e744b31d7b42266178505044fb4111ef01212d54cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718216, "uuid": "0b788811-5d19-4649-8358-3b6283aeb40b", "comment": "Malware payload (RecordBreaker)", "value": "ba059daca5a414f9c6b0f978c9aea8f2ec631a84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718216, "uuid": "46eab39d-cc0d-4abe-8715-a67273f59f41", "comment": "Malware payload (RecordBreaker)", "value": "f533678d4f021f0219eacab571968898d2233582a45d49ed80dbe82be3c23562cd94fc7af5f5608ddaf599e038e1e4f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718216, "uuid": "c565885f-cc3d-44bb-9320-2ec027dcc774", "value": "T1DF05AE33F2F60833E073197E5D2B5B9D982ABD1028B8ED053AE4E84D9F362917D25257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718216, "uuid": "832bfbff-9655-46c0-a163-3583d7b06107", "value": "7a1f03aec8b2c813fb23d7a97335ae88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718216, "uuid": "4aab7eee-fea6-40ff-9b0d-cc1733d03833", "value": "12288:AkqyglaEq3vgPIzZpurCqayn2zetLP+L2/WXwCuiklvLFB7u/GFI3dSq0j:AkCAYIzZpurCqaZ8/EwC/kFJgdS/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718216, "uuid": "dfc4068d-5cd2-47f1-9f5b-4ab89bb4694b", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718216, "uuid": "72c2cee5-19c2-4fa2-a518-2d78c986b9e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718216, "uuid": "7885102c-5e0c-4d34-b919-3eb6f66937cc", "value": "Bkskvlcgkuvhyq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19747379-d3cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680710907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710907, "uuid": "755c8ba7-0b57-4e89-abc1-3b8126c9d63a", "comment": "Malware payload (AgentTesla)", "value": "53cdf5648f92f237fbb130d9d1462157", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710907, "uuid": "2ecc7762-93d0-4552-9324-c74c15251130", "comment": "Malware payload (AgentTesla)", "value": "1f4069a1b7913f9a9c2d6f350946cfd6a1a0b6d61d47c7fa1e5b1d2d5849d5ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710907, "uuid": "ef7c2751-1cee-4aa1-a8da-e997049a822d", "comment": "Malware payload (AgentTesla)", "value": "e181ab988fab76374b436f83a4430f7cc692c548", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710907, "uuid": "4326eab0-7896-47a8-976b-7c5125d74b5e", "comment": "Malware payload (AgentTesla)", "value": "869f9858346bc7c0b4e706f001e29ab94ca46e6c3e705b3529379f893ced114229e46a4b98e2acae8f261b39795276b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710907, "uuid": "bdc83e00-b8ce-40bf-bea9-c286658be734", "value": "T198F318699286CD16D32D4079C8E1513406B2A1435A17E76F0DF3B8FA3EC6BC3762EC66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710907, "uuid": "a9b7daea-6fda-40e6-a3f2-25b47704e3db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710907, "uuid": "28ea1166-1711-4a5a-b278-c8f4cf85ec59", "value": "3072:QqR59tvTKitGfCQKuklLgxDNcae8oE880LAU5ItJHCJgyGK:HFt3tGfC/lLSRcae8ktWzF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680710907, "uuid": "2bf244af-e7e7-4350-8ea3-3e6c51ae63df", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680710907, "uuid": "dc3b5d0a-da0a-499e-9f60-86ed5418e91b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710907, "uuid": "e01b387c-1423-4f6b-a4e7-19b2d5b1054e", "value": "1f4069a1b7913f9a9c2d6f350946cfd6a1a0b6d61d47c7fa1e5b1d2d5849d5ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91836fa-d39e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680691525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691525, "uuid": "28083d62-0d7c-46eb-bfc2-bf6a5ff8a591", "comment": "Malware payload (RedLineStealer)", "value": "1e911f80ac69f621f718484462186b30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691525, "uuid": "ef5e70c1-24e7-4467-ba49-24e90e084718", "comment": "Malware payload (RedLineStealer)", "value": "1faaf13ffdadf8097e918d6238cd25502ef37d38644f94f23c70eee1989f6955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691525, "uuid": "17ac3abd-d07c-4ffb-bcd8-fbd7ee577d58", "comment": "Malware payload (RedLineStealer)", "value": "6fb674715f1ed4ade64291e4f87d6e1d4cafba78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691525, "uuid": "d9b9d6f7-4ac4-4980-ab76-708c81abc79e", "comment": "Malware payload (RedLineStealer)", "value": "9ffb7531b2ca41956720ab2a80e100dd1161bf61797c185d12a92e87506e69119face028a97a1333885125b27124d7f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691525, "uuid": "a1653fb5-547c-4d91-9546-4ba3b1d53cb6", "value": "T108E41202BBD44962E8F6377058F213930A357CF19A78437E2799ED1A1D72790A1B172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691525, "uuid": "2f2cbfe9-22aa-47d7-975e-dac7d4a3ac31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691525, "uuid": "7f48486d-fe56-4d34-89d0-33ba839b7251", "value": "12288:/MrSy901XfNjwCgGB0VsAVadtHOr7Icrc46wB4EiyGkh/o0cL/RUas/GRypL:JyqXlcGB0VsAQIrFTrG9k2zRUaYGRypL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680691525, "uuid": "abcf3370-06ce-4320-915f-50286e5c5e1a", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680691525, "uuid": "49d99897-49e2-4525-a364-fab44b339efc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691525, "uuid": "ef59e5d9-54e9-4051-975a-baa86ea0ac25", "value": "1e911f80ac69f621f718484462186b30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee180836-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1680699667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699667, "uuid": "a9a979b0-8b1a-41cb-8bf5-47f4e0f88073", "comment": "Malware payload (Vjw0rm)", "value": "85663bbd29a06edea91de6774ca5117c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699667, "uuid": "2880c5ef-9d87-4637-9777-988a9f04b390", "comment": "Malware payload (Vjw0rm)", "value": "1ffb78855be3d2c0df928f71894dc103ce5b53c7d2b075ac8cf0d32db8fae804", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699667, "uuid": "73570e82-0727-43aa-adaf-61b16a25dd85", "comment": "Malware payload (Vjw0rm)", "value": "cc1f6a8c3f161c10cda14643664d7aac352bb627", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699667, "uuid": "5a3bd2c3-a04b-4a6b-83ae-be4415ea9571", "comment": "Malware payload (Vjw0rm)", "value": "e8fe6f9acb1845d8a7d51ff8af63f99a045ee6e9b1ef53746912328bd8a50e2e594e816cd9ea2fa48f68810e5adb2402", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699667, "uuid": "12d5afa0-f4b0-41c9-b9b3-7e2026b95150", "value": "T1501508C425F87A16D7A3D764C321D122ED70E9232C5712D2BDC47B4AEEB6C406EBDA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699667, "uuid": "012447c3-7705-4be6-9c6a-429270fda87b", "value": "6144:MQizg4bSZm049LVdwyYnYxWvjveQkLCVjjSTx7Flah5fr87s4sS4ZIYwiucI8FZZ:XpVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699667, "uuid": "5e57cd8d-3649-40ca-a65b-28b8b21f9655", "value": 919954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699667, "uuid": "4256b4ff-4435-4c0c-a315-a889bd741379", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699667, "uuid": "3af4ae82-f233-4220-aeaa-b548fa90074b", "value": "Quotation QU365316.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0355c196-d3aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1680696267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696267, "uuid": "598c633f-b907-496d-be18-a6d6439833cf", "comment": "Malware payload (GCleaner)", "value": "cbc42d76c05b9e89b481b7bcbaf259d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696267, "uuid": "111b63eb-cabc-4c51-a52a-4aaa7f28c121", "comment": "Malware payload (GCleaner)", "value": "209fdb1e0d3624b400c9c6d348c05a92062c8cb771d240f1d490a7b1a631b80d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696267, "uuid": "a6dcbde9-a0b0-4442-9e58-4a595468b70d", "comment": "Malware payload (GCleaner)", "value": "8d1990ca06305c8a4bd206ffd2b1ca75e11b68f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696267, "uuid": "4bb78a7c-f066-4887-b4ce-421936e24d85", "comment": "Malware payload (GCleaner)", "value": "4ef98741e51d2379fd48629d1e79681ff65147770a39c9d94accfa4541e618631987c477afdb49b831894e92ab29a297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696267, "uuid": "6d233498-c991-4010-a2ba-76b870955824", "value": "T18D54D0013950C872E85661308871D7A6267FBC735B609BC77BB43B6F6D322C27A35786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696267, "uuid": "dd29a4c3-dd4d-4a4f-a0f5-a37ca466543d", "value": "4e8985592f7d1f2b5d9b1d9584b1f35e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696267, "uuid": "2b989a88-0949-4769-a617-687023f139b1", "value": "6144:3c7qjHl2c2Dq4CEKf2wxHe9ExV9uTeNxT:3YqRjVx+EYEgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696267, "uuid": "2fa7592c-9486-461d-a1b2-4ea8f883378e", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696267, "uuid": "ef3a9551-46b5-423c-b448-d159b2362589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696267, "uuid": "04e33578-413f-4b38-b2f9-e40a89614150", "value": "cbc42d76c05b9e89b481b7bcbaf259d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae28ad8-d3a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680695340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695340, "uuid": "9386aca3-d346-450b-a564-5c59e4ae9d00", "comment": "Malware payload (AsyncRAT)", "value": "3c3cd1dedd4140d004f4f00e97c44b3a", "object_relation": "md5", "Tag": [ { "name": "3c3cd1dedd4140d004f4f00e97c44b3a", "colour": "#3C2B22", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695340, "uuid": "6589e795-dc8a-4d5a-8826-00f51930e4af", "comment": "Malware payload (AsyncRAT)", "value": "2278c863c143541189042f3858a819b2c1fa7fc01151d72abb76fec1f329705c", "object_relation": "sha256", "Tag": [ { "name": "3c3cd1dedd4140d004f4f00e97c44b3a", "colour": "#3C2B22", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695340, "uuid": "9eee5f8e-2b5a-4712-8e68-f9f9725f1253", "comment": "Malware payload (AsyncRAT)", "value": "ec5f0ab90aec2c4e917f7815924b3b54459569d7", "object_relation": "sha1", "Tag": [ { "name": "3c3cd1dedd4140d004f4f00e97c44b3a", "colour": "#3C2B22", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695340, "uuid": "c5f54820-cfd2-4e58-8456-5231fbf2b9d4", "comment": "Malware payload (AsyncRAT)", "value": "d4df3694488253147b4631351ee7458310c7bf585ef6a8a516136eb916c52b3e606d5ca20619d53915f3fe147c3d6cee", "object_relation": "sha3-384", "Tag": [ { "name": "3c3cd1dedd4140d004f4f00e97c44b3a", "colour": "#3C2B22", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695340, "uuid": "cb2238db-9506-45df-8db6-d865e8bd5f9f", "value": "T1C0535B002798C965E2AD4AF8ACF2550106B1D6772102DB5E7CC814DBAB9FFC686533EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695340, "uuid": "0c4018f0-249a-4691-a8b1-113ab02cb5b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695340, "uuid": "b9772efb-43a9-4d18-97b7-f752f00b6b8a", "value": "1536:AhIBLTM3Ufc0cMdmeeiIVrGbbXw8TGGDpqKmY7:AhIBLTM3Ufc6d/eXGbbXHgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695340, "uuid": "155263ae-f922-41e1-8e6c-9324208be7c4", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695340, "uuid": "ab9e4395-c673-4ecf-bfda-1d3e48e77d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695340, "uuid": "4a21c2c5-a34b-49f1-8bdc-9956011420e9", "value": "3c3cd1dedd4140d004f4f00e97c44b3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0b2d2d-d402-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680734267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734267, "uuid": "94368aad-3422-48d6-b9ae-cd33997f2ba2", "comment": "Malware payload", "value": "2d73d2708953e818be259c52e51035a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Misha", "colour": "#75FD00", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734267, "uuid": "1b74c991-37ab-49da-a603-45877b0fbe53", "comment": "Malware payload", "value": "2279303fb3c0cee7dca89b3821ec24d8e42a12b47d81ad5f478e86e97f9c96a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Misha", "colour": "#75FD00", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734267, "uuid": "630297a0-559f-444c-91c0-83fb57ee7e70", "comment": "Malware payload", "value": "d9b2beefd6125ea3d1279d3cd9a2c581bc45394c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Misha", "colour": "#75FD00", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734267, "uuid": "8e2ac860-0f0c-4958-9710-a305d4d4574b", "comment": "Malware payload", "value": "1b0ead1625fe23c573dfb485a31c08e5647f8e9c32857417eb48dba2a0c2b9561d306521e062f79c50f7df51fb063723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Misha", "colour": "#75FD00", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680734267, "uuid": "698c6b08-9868-4116-9940-a823c83b316c", "value": "T1742423687A2F523873C01501D25C0CB636FA0FACE8F1892B6194B8797DFBE52535B272", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680734267, "uuid": "43c8dfcd-05da-49b5-a58b-eb967dbd8377", "value": "3072:Naj9mzmDZSw3t5Y1r0q52iCKgHOa3ZVDKucNk3vROpvZbq3AVxU3yYl:uMm5t5ol2ju+/WuqspSq3AVG3yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680734267, "uuid": "c4e08561-6340-48b7-b73a-ba8cdeb26117", "value": 230272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680734267, "uuid": "49890b07-40a5-4208-a3f2-71441e511f23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680734267, "uuid": "d1d1fbcc-4f83-4510-8159-36a0fc245e32", "value": "misha_exez.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead6fe04-d3df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1680719418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719418, "uuid": "80a69fd7-f144-4c0a-b967-35e4375971b0", "comment": "Malware payload (Socelars)", "value": "5e255bb79fde1312e2a9f8c2e2b422e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719418, "uuid": "612bdbeb-f4e9-4e11-8606-871f5ee8f6f7", "comment": "Malware payload (Socelars)", "value": "23575dfcdf7e8a6f41e355914d0fdaa385fc4a377f71cd80330e90f76f9ae271", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719418, "uuid": "33c3ed49-029a-4ca6-bd5d-8fc33b46cea8", "comment": "Malware payload (Socelars)", "value": "d091b38830fabf7d32fb93c8bde202f4ca391574", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719418, "uuid": "6a6b2b2c-998e-4516-9846-058982da442a", "comment": "Malware payload (Socelars)", "value": "9479469694c5508a346e718453161c4ed727b74ba8b98eb1555f03e362237af4004f9beab6db808ce1a306b509ddbefc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719418, "uuid": "652c8618-aa5a-4591-87eb-0a3e54c24c9c", "value": "T15C658D21F7C26032E8E310B745FF66BE8D3C6A114708A4D7D3C81D999B615E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719418, "uuid": "93908b7d-9035-4f99-9dde-0031dccec068", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719418, "uuid": "187622e8-e485-469e-ab9e-df06248d1825", "value": "24576:hVYkTpy0OVnKhXJ04BJFKA3wRKB7a9WscrmCqeQrE/c5h3tqW:PpJOl8xFMRy/SeQgU55wW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719418, "uuid": "dd137641-5acd-4ab5-8095-9c97edd72089", "value": 1508864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719418, "uuid": "b09c0f3f-de69-4d2f-844a-8116805e1a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719418, "uuid": "b59efc3e-6bf6-4d1b-bf0c-2b78d1cb9439", "value": "5e255bb79fde1312e2a9f8c2e2b422e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a57ac5-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680700411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700411, "uuid": "67b503a4-3daa-4511-86f8-d0f745f4b7e2", "comment": "Malware payload (AgentTesla)", "value": "7e180a49b54f7e837e5901bf2d10fc93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700411, "uuid": "05298c0e-d34e-4ec9-ba15-0a9f1efe25a0", "comment": "Malware payload (AgentTesla)", "value": "23c5dd5c73abb1746a8ea04fc1a2ae9e54114f6554f46fa04548b4bab4599ee8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700411, "uuid": "d59ac65a-92ff-4e21-a4b8-2332701ab672", "comment": "Malware payload (AgentTesla)", "value": "95746f520e728fe8ae4a1a8e7015cf5f21cb7459", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700411, "uuid": "f8d2030f-9ae3-48aa-ad83-f1c2b2f88ff3", "comment": "Malware payload (AgentTesla)", "value": "5ad4ab1cc952606263e13685e973b5f5d074ce40bb6de304695a8b757d49e3c52b5ca974331ad9a36b9875fc5c175922", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700411, "uuid": "4f0ffea0-348d-4e35-8291-db5038082296", "value": "T13AE4121A33F89731D15E5F7AD8BA200487FAF86B6862FB5C4CC1A4E99C73B40C944297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700411, "uuid": "7f542288-1fb6-4702-bc2f-008dd4aeca52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700411, "uuid": "2c1e2619-7acb-43a3-9662-e8d85edbe3f4", "value": "12288:Suaa0osTbDbTLZbotWzZbifkhGv+N0rDB+zycb/d:Suaa0rhbtZbin+qN+28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700411, "uuid": "497aba01-8e41-44b4-8ee6-75dbff6f92f2", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700411, "uuid": "9fcd92cf-2159-4a85-97e2-5d34cc499fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700411, "uuid": "4d330d74-f44f-4e8d-931e-f206743fde86", "value": "7e180a49b54f7e837e5901bf2d10fc93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc12786-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1680700415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700415, "uuid": "6ef02811-d770-4815-abd2-ae8ec8ec78e1", "comment": "Malware payload (EternityStealer)", "value": "a68ccf819e65e63c220113ba45c1a13b", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700415, "uuid": "765819a7-bc1a-4683-a5c6-06e6fec5549d", "comment": "Malware payload (EternityStealer)", "value": "23f09d9012c25fbba5f04b0648379e4c8a42ce2a2c30beffe4532b712907e1ef", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700415, "uuid": "b19262d0-3c71-4ff1-ba80-b9261ac87d74", "comment": "Malware payload (EternityStealer)", "value": "8a410c54db44221acbb341815d49109594b50300", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700415, "uuid": "dadcf680-f800-43c8-a4a1-adab35ba62e5", "comment": "Malware payload (EternityStealer)", "value": "f6ae9a1fcbddd27d017dadace2fd1331fe95a06ee7820c97126248d37031f037abd3a6525fb5f674b05463baffd863d7", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700415, "uuid": "70bb7386-ea2f-40cf-9c4e-2986fcc31315", "value": "T181C50190849ABFE9F0381CBBC7A0B70153E8F72B2207D79D6E8D055DE858DD56B29213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700415, "uuid": "6a4d29a1-8046-4e64-b8ee-a5fbfa52a8c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700415, "uuid": "0e8fb44c-a53f-40fd-917d-394c9ed25ef8", "value": "24576:HfUxAfB9iuK++moKnfNIGQaK83uHU/uYfo11qis3s4b+6GIAANEN2tXL6Y3TEhi2:DLiuD+moCQZhHUWYfo11q33dRGyRt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700415, "uuid": "9c4fa26e-1b3a-41aa-adc7-3e42356105f7", "value": 2532352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700415, "uuid": "480d2663-04aa-4650-b88c-6ed57f99d0d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700415, "uuid": "d2742d85-56ad-4732-a7e3-93ce2a0bdda7", "value": "a68ccf819e65e63c220113ba45c1a13b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97bdd7d-d404-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680735227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680735227, "uuid": "a0818ffd-65b8-4cb0-98b1-65452e06e1e9", "comment": "Malware payload", "value": "5d686d1aa4048911d04e368c30a43c0d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680735227, "uuid": "330cef1e-f087-4074-97f6-fa76b43ee93e", "comment": "Malware payload", "value": "24171c6024628fe1d18a50883ebc19dd86c42eb45aca2b402bd91dc5802c29e9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680735227, "uuid": "d829abf2-a501-46b7-8428-7b7db69e0c8c", "comment": "Malware payload", "value": "b7240ee3eba17d7575dfe2b9721c55ec2484ac38", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680735227, "uuid": "0f1bc0aa-4d92-4be1-95fb-b30a19b06742", "comment": "Malware payload", "value": "6bab99b62f58ff16084b6115d6ee65027956b19da32e372b17c35f73e926768805097f7230730221f40dacfaec62dac3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680735227, "uuid": "c7588be9-d421-49ab-ac0b-3d44ea283b2b", "value": "T18AA533156A020BDF8F443CAD4D575F6A07B18EE9CB49A4806EF233A6E1156F35C43E8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680735227, "uuid": "4fe45a6e-3e3d-48b3-95bf-731692b226d3", "value": "49152:DiLTPeVjFOwHxP1PC/jbtO0oMguZgTY4rRKXNZ4lmt/aY8h5:DiHgxxo/ftoMg+gcKKXNZ4lmt/aY8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680735227, "uuid": "517cdfa8-0b17-48e8-9c8c-7023157b407f", "value": 2189551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680735227, "uuid": "0d87b2c4-c7b4-469e-93fd-374cbde16c6c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680735227, "uuid": "78e5e559-f383-425d-b84f-16d6c27d2118", "value": "5d686d1aa4048911d04e368c30a43c0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e7542a-d3fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680732074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680732074, "uuid": "f8809d1e-bba0-474c-b351-069de10b8022", "comment": "Malware payload (Formbook)", "value": "02f94963cbdf5f8e06feccc671bafaf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680732074, "uuid": "97d81621-3fc7-471b-8d34-7ee125dcf9af", "comment": "Malware payload (Formbook)", "value": "24d9f6cbd6f8154a9ebd08f39c92e07e6b8170e112d9956f5f6711b8bb4ac5d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680732074, "uuid": "017cb403-84db-4486-a276-ab29763dcd97", "comment": "Malware payload (Formbook)", "value": "d9471d2da5ea69f5f53b2b04931b6598093158fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680732074, "uuid": "6d336c37-ae77-4ddc-926d-88e527ddc834", "comment": "Malware payload (Formbook)", "value": "900697bbfc8d59da78952420447948095f62a5325a87b6a6e2315939039c48cbfe835377576bbc4adebedcbe8c4967f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680732074, "uuid": "3aed562a-7e0b-4642-b3aa-5264a57f0bc1", "value": "T1EF74120567E1E037CE6247334F3E6A1B6F87A40738A46B4FCF206E883974491F95A766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680732074, "uuid": "1aa55d0e-88c8-4a81-a105-86a186ff94a5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680732074, "uuid": "213ae770-c439-49c5-9dc5-2127977e8a82", "value": "6144:vYa632mW8E7CK7SBe2vMwF+uO3/JmIx22zYfdvS0aS8QHpiQBPAj:vYt2mLhK7SBekh+ulAJWAZSNogm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680732074, "uuid": "c630fd1f-42be-4a7b-9173-93cf342605c6", "value": 362378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680732074, "uuid": "f641fb30-1ac4-43bf-810d-3bca9e872511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680732074, "uuid": "e47f60ba-5e95-4889-add4-ab0fcd3575df", "value": "30% payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87dc54d2-d3aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680696489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696489, "uuid": "a32ba358-8a43-48a6-b517-a6004c352d9a", "comment": "Malware payload (Loki)", "value": "dc126ebfb92cd16f830d6d5e81bb00ca", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696489, "uuid": "772de584-a9ef-4cc6-be98-1709e8fece17", "comment": "Malware payload (Loki)", "value": "258b72a11f84a7b2d35493e0a7560bd8bcb9865c67b8fc8d2c2d81bd19d2bcd6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696489, "uuid": "f4badc32-05cf-4243-9df0-d2a9c65afb5b", "comment": "Malware payload (Loki)", "value": "f4445336d6053b57dd8f2792bc020b3371ba757f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696489, "uuid": "935fbebf-098d-48e0-b2e1-c73fa38662b3", "comment": "Malware payload (Loki)", "value": "2cc228702c84226b69ec69a734b5461476b448dd7f9876612e52692f3644c806ea6ee16bd6a70c4be794fc3fb80de9f7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696489, "uuid": "4441423a-d6e8-443e-9eb5-bb3df1679c29", "value": "T144D2825AE78B03B44B411172671E0BC9A77DB13E735455B278AC833433A9C2A46B6AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696489, "uuid": "01beb627-a88c-42ee-adbb-65a41e932623", "value": "768:VFx0XaIsnPRIa4fwJMw5XYpejhGd3gaPv+Nu:Vf0Xvx3EMw5IpejhKdn+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696489, "uuid": "176f2f73-3467-42f6-954b-d15021af6040", "value": 30701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696489, "uuid": "bc3fd660-b413-4916-9fab-5e1405213f0a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696489, "uuid": "b44da014-6d2b-4538-9b34-d840d7403448", "value": "SCAN_RFQ_HAYS_TRADING.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9514c8c-d3d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680712947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680712947, "uuid": "4735b92f-8b06-47c4-baf4-455c2faede71", "comment": "Malware payload (AgentTesla)", "value": "cde43f77555b94accd503ffc5206537b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680712947, "uuid": "7e387500-7664-4458-888e-b54de3ae7c35", "comment": "Malware payload (AgentTesla)", "value": "25a3ad1f4afc1c6fd0ea376223b15bab55cbb0bc26f090a1c3f186165f37b6cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680712947, "uuid": "4203844f-5f2d-4302-b807-0a9b15c61d0d", "comment": "Malware payload (AgentTesla)", "value": "400d090f8180624676de991284434e9657d4db81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680712947, "uuid": "b362b0de-cba7-4af2-a75e-f32eb7f2e627", "comment": "Malware payload (AgentTesla)", "value": "be47065705c4ff0681e02a65b0ce36d579af062447528c019a5b8ef2d37a9b555193fa279959f15a83496fd0ed04cd05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680712947, "uuid": "dd1ddf06-3e35-4da1-a570-7fbe74471a05", "value": "T141D5333F8B29D7EB739B86915C7C36E509C0733638B63892F9B197CD84446210A8E9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680712947, "uuid": "87af5e21-5994-4cb8-9859-2cb2825c4499", "value": "49152:b5pWHNE6NmO01OxyAdFnPcge95uAXv1tQQ7b5cdzalueZaoPnrui7OHXzqg5Fg3e:b5pWHtQOxntEge9YAXt5v5mveZJPna+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680712947, "uuid": "0a4e3d72-a8ee-4ceb-b868-9c9189111cf9", "value": 2821507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680712947, "uuid": "a2afc644-6ffe-4521-9b29-6b65005ab430", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680712947, "uuid": "63577348-8f7b-4692-98a2-32c0a28ac17a", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5befd99a-d39f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680691691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691691, "uuid": "b5d2ced4-8e9a-4f3e-89d7-accd4e474fd3", "comment": "Malware payload (RedLineStealer)", "value": "4a0e50b4084cac58f092337ae6cf3b61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691691, "uuid": "c3cf9901-cd2c-48cd-9c4c-cc09647f5983", "comment": "Malware payload (RedLineStealer)", "value": "262aecf6979654d27813d7da0e48465084c93d11399bc6b7f148990dcde363f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691691, "uuid": "281bf72b-30a3-49a9-9671-cdae25a1deb7", "comment": "Malware payload (RedLineStealer)", "value": "9f122495abc7834fc923fdecceb375739339402a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691691, "uuid": "3715bedf-8f72-45ef-bb94-737e111a1a8b", "comment": "Malware payload (RedLineStealer)", "value": "6e4e217c33b22649beaad7dcc094cf116d9570faa92166daaa6a79d5b19853b3a4df19073861aa9620cdd08bcf027aeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691691, "uuid": "a3842b08-e57a-4546-8f22-53ca22a272da", "value": "T11304B51437BCCD11E1BA2A3F6961A05147BF98026852F25B7AC367CD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691691, "uuid": "c80a361e-aaf0-4664-8358-9e6cebb2639e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691691, "uuid": "a4f30f2d-3db5-420f-8969-64105df41f43", "value": "3072:yxqZW11a2kX8fqvPIeJBeGg9ShLrxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOJ:gqZkqvPZJ8Sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680691691, "uuid": "62fb70fd-1b04-4ffd-9ccd-87d2449133ea", "value": 179313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680691691, "uuid": "2ebf1f7d-713d-46da-a344-5925e5243198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691691, "uuid": "83fa7def-98ae-41ed-9836-3d30262c2354", "value": "262aecf6979654d27813d7da0e48465084c93d11399bc6b7f148990dcde363f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08122746-d3b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680699711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699711, "uuid": "98ccd0bd-590f-440c-9e4d-ddd2194249ce", "comment": "Malware payload (AgentTesla)", "value": "3cd7418133b06d5224718fdb32331f13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699711, "uuid": "8a86403c-4a35-4b8b-ad22-e4ee64c49525", "comment": "Malware payload (AgentTesla)", "value": "269bf844be762e4706405bb9acee8a3f39c9706d4ebcbae1016d521db3e564d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699711, "uuid": "1f0f841c-d1ca-482c-99e5-a315cd32ef65", "comment": "Malware payload (AgentTesla)", "value": "da96caf9c9900f4b108da80a8cb2431fd189d381", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699711, "uuid": "7d8a1b23-f6bc-46e6-bc4f-cd718990d4f5", "comment": "Malware payload (AgentTesla)", "value": "88d0d0701053ee6f5b98a3b7d19c1281347fad1dddf1e724a5d6e378f021840bb132f662f72823031fd27592fa99093c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699711, "uuid": "86a23487-c822-48ed-a73c-d39f083b547c", "value": "T13574704075E98005A2F16D238F77FA5E0B37EBEAC4385E9A68CC695937DED404C92BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699711, "uuid": "bf9e47b6-2fe2-43b6-acfc-b612dabcb93b", "value": "1536:j89r/aDcWJwG0mtvR/Eg54idVKUdLG0MW5C88TcCbB:KtfxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699711, "uuid": "e542969c-04b3-4203-8eb5-8b27b733ba06", "value": 347050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699711, "uuid": "9ee6bab5-52cc-4edf-bda0-b60d92dda6d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699711, "uuid": "1be562ad-d6de-474f-992e-e29115be1339", "value": "Enquiry-0574.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75927695-d3fa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680730818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680730818, "uuid": "1f847a73-fbdf-4dbe-ae91-3ff38d062722", "comment": "Malware payload", "value": "70f0fd7e3855e81b0a4d0b242485a624", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Getshell", "colour": "#EA640A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680730818, "uuid": "6b8432d4-ebe2-4506-8f4e-73a3c949250f", "comment": "Malware payload", "value": "26ccf2824534d812c14a59783db85916a03da86ec65e86fc4b356657405080c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Getshell", "colour": "#EA640A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680730818, "uuid": "3f3fde36-e6a7-4a6b-9893-d9ef6a3e4a70", "comment": "Malware payload", "value": "6db624bd4b0adabd33c5a76f58b2940d3da2594c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Getshell", "colour": "#EA640A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680730818, "uuid": "60597da8-367f-4810-bd9b-948eed3476f3", "comment": "Malware payload", "value": "171361c124617a499413da52526c9de4ffe8b311f6b34c5a2db96ba2d87b0cd9456782143a185be9a8fa2422c5993952", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Getshell", "colour": "#EA640A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680730818, "uuid": "2a1d060d-6a78-4294-8958-b66200c4e99a", "value": "T100D080330B5A80DEE7D4423F9974597CF77B9575474862310810DC011C1A6446F62C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680730818, "uuid": "b629d9f9-5e86-4009-9997-050fc0cc4894", "value": "6:BnX//In8/r1GBxH2TZ8FQ3RQdygg5XJYD:BvwncrUHeZ532D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680730818, "uuid": "7e88edba-cffd-4733-b89b-307eb56192ec", "value": 250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680730818, "uuid": "521eb058-06e4-48f8-9d9a-ccedb5ec4e0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680730818, "uuid": "5d5c8e28-e5aa-4d5e-93be-12f864544a7d", "value": "shell.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9cc94f-d3bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680703634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703634, "uuid": "afc7ad28-47f8-4e7c-af88-cca27c6931c6", "comment": "Malware payload (Guildma)", "value": "a1bc8019d483b59e3ba05c791793dca0", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703634, "uuid": "5226ea56-8488-48dd-a95b-cc0272c65a4b", "comment": "Malware payload (Guildma)", "value": "277044083d1db3a076170c2dbaca8b074491a6410c7483a62fd40c5d3d8292f2", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703634, "uuid": "2e143092-4b52-478c-bb98-adce152e926f", "comment": "Malware payload (Guildma)", "value": "b094b19fb691b63bd93b2826b0ee4dfef135f561", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703634, "uuid": "cea2fcbe-364b-4aef-b606-114b4c5456e3", "comment": "Malware payload (Guildma)", "value": "265b9c01f72c66df658e8af3309b068374fe38341d98cda9f54301e433bb3aa084e585151e648359d2b278208ff3a7a9", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703634, "uuid": "435aed19-97c0-4af2-8fdc-cd7075f10a38", "value": "T196E2C00AD24EB1150984EC423EDF0185E375FD89217DC7B5F8828E6CBEB60BEF159668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703634, "uuid": "fda208de-12b6-4901-9996-7df6e56ec331", "value": "768:wL/fnKDacWoSKFlUukg0NrAcvVyhpHnv4rTcy5U82GRMSVdh:q//KDTBSKFlJkg0lVvVgZv4rTcy5U82w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680703634, "uuid": "2da4881b-c8bc-43c5-8b7e-ef779e11788d", "value": 33711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680703634, "uuid": "f92dc40b-eb2d-47f3-a0db-1855b4664804", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703634, "uuid": "58f92d1d-6bc9-4f6d-93f5-8771b039294a", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def25f77-d3e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680719828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719828, "uuid": "813a63f4-7e34-49b7-8235-b042b3fc8a66", "comment": "Malware payload (RedLineStealer)", "value": "bf0712b1081e7be9039bab2ce8be965d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719828, "uuid": "0a4305b0-37b5-4f18-9c3e-14b34f0529a7", "comment": "Malware payload (RedLineStealer)", "value": "28de694832dbda47cf2ad68f60d198ecf4d1abaf513c43ba5699518e5b493ade", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719828, "uuid": "d563587a-c225-4a84-97d8-cf574fcfbaac", "comment": "Malware payload (RedLineStealer)", "value": "cbc4d721a6b465d25a4a256092572a3ff1b20166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719828, "uuid": "3c083e64-91ca-4821-b2b2-cced5f642d66", "comment": "Malware payload (RedLineStealer)", "value": "cdf5a5a2c6a05bf16fd2e2025db68dd58d8a6631998899e7550463fe60f0d92c69c0588d69c678840f0d478040251808", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719828, "uuid": "24e9893a-3efb-47a3-ac7b-6a3d92d18701", "value": "T1CC051202A7D99073ECB51BB054FB17830939FDA28D24477F2282A42F4D7369299B2777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719828, "uuid": "77db2345-807b-4542-b734-3b35d3146031", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719828, "uuid": "8dbf4a55-68f4-4738-801f-471e3ece682a", "value": "24576:my+N4qH8lC6AtFbclDn/VX0xdkaV7P3P7:1RqV6AfczGd3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719828, "uuid": "56060c65-d0db-430f-b32e-90e27029f66d", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719828, "uuid": "fb543e4f-9118-4e5c-b4fb-909415938377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719828, "uuid": "12d5ad4a-d898-4939-b830-8511fbf9c243", "value": "bf0712b1081e7be9039bab2ce8be965d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41fe44b5-d360-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680664589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664589, "uuid": "db0eed55-2296-4567-b8e3-91b6ee103881", "comment": "Malware payload (Smoke Loader)", "value": "6d4983ad5a6158e5ebd5366286d4f3a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664589, "uuid": "6dd44bdd-2fc8-4076-afa8-c660169517fa", "comment": "Malware payload (Smoke Loader)", "value": "2925436a2f764bcc11374f66b86a3b93495c7a8949136b45d7fb99dc6c57db1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664589, "uuid": "74561a79-6f2d-4c3a-a2ec-9c9fb9eb109d", "comment": "Malware payload (Smoke Loader)", "value": "a75ebee6eef09ab526856a8d40ff731d99a27059", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664589, "uuid": "04a40770-424b-4f9e-8ff5-534a8622e302", "comment": "Malware payload (Smoke Loader)", "value": "b6d1d23d17b63d92f8d995d55066e0c0771bdcd47d39eee207b4482df03bfef65d3043626f64e0d2620a82df7becc2d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664589, "uuid": "81ffae5b-ac73-428e-8180-d45a6fb23178", "value": "T1E0449D1163E0A431F51B0B328E2AC7FDAA6EB8619D657A6E17B5493F1D313A1D33270C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664589, "uuid": "1f3670a3-97c8-4d71-abef-bde90b63dbbf", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664589, "uuid": "d8b5291d-c725-47cc-be86-7fdad85147f1", "value": "3072:IXgcJ9x5NGhbv6QWiyuaG3f3yHg0O3xlNwxAyLXNP+Y/Joz1VGlB9KUqaJSNn:wT9G8SRaGvCHg3byLXd/iDkgFaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680664589, "uuid": "481282d9-ed55-4cfd-9b21-b0129f14b09b", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680664589, "uuid": "86b1a670-9214-4241-9d44-9a6b94db7404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664589, "uuid": "57da9db2-9e10-44c2-a90e-4f117c655502", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a48fe1f-d3c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680709351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709351, "uuid": "5764dd5e-2634-4899-b02c-70d8eaa00fe8", "comment": "Malware payload (AgentTesla)", "value": "5179a1d8b7f77c7bd788b7722548dda6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709351, "uuid": "8309ca3a-f905-4f16-bccb-8ce57951538b", "comment": "Malware payload (AgentTesla)", "value": "2a2b828815044fa34aa7a8440459734a4e83f372712ed1411f0c1b3b0a2e5526", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709351, "uuid": "d81d472a-44af-4103-a22b-844d8cbc500a", "comment": "Malware payload (AgentTesla)", "value": "d374f2f5acfc4e42ef29e66e85fb4de68bca6bef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709351, "uuid": "30fc8a25-8ad1-474a-819c-5584bf431c39", "comment": "Malware payload (AgentTesla)", "value": "e9ec3b13ff1e0648dcd7a0227237b79a6a34e40dba66ac6790ae4885cb0eb306a4d6e3c725bc8715ded47a1ad912e997", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709351, "uuid": "6eb179a1-3892-4809-ae46-0741f80fad2f", "value": "T12C15126CFF40D523C32C65BE5872709493B79AA98396D3EE1DDE64D42CE338C9844AC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709351, "uuid": "bbbf9d6c-761a-42df-9da2-61cf0df28a74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709351, "uuid": "8365b4b8-a2fa-40b4-9d21-7db58c46503c", "value": "24576:u41PCtwfmxZFi6YtczbNykf4zmutp7nVl+Bc:u4hKymxi6ZXumwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680709351, "uuid": "2356b810-d016-4afb-ac8b-cc89b1ecf5b8", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680709351, "uuid": "cbd3a3ee-c6ca-41cb-8def-f6f05b81bf32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709351, "uuid": "b33d644d-dcb1-48bd-bf13-f56d7c3e736b", "value": "2a2b828815044fa34aa7a8440459734a4e83f372712ed1411f0c1b3b0a2e5526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49a710a-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680700456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700456, "uuid": "505f7a12-c122-45d8-8560-41d1e6b85dd6", "comment": "Malware payload", "value": "7773ffee8fdad233f1e375d29fbcf2b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700456, "uuid": "ba41411a-4836-4d71-8a60-75e185c6810f", "comment": "Malware payload", "value": "2aa35b363c35704fcf2b482009ce8c2687fbe39654039d65259c72dc126a84e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700456, "uuid": "7ea3c4f2-1fae-4c6f-ba34-52d363d5972e", "comment": "Malware payload", "value": "0251ce964edb8092fb0ceb01db4725ed01d48ef3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700456, "uuid": "9d8bc2de-6078-4539-b70b-27d83fb5b4f5", "comment": "Malware payload", "value": "93a542aeef10062f4a38b2e416b1c6199afec286f4e7adcb28f36922459696c5fc89d7bbb7e9dca7bbc355c7f8d50f0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700456, "uuid": "50df40df-198b-4acf-886f-a0d3f84a5001", "value": "T1BF95D0797AAB9612D1BDDE32C9F69410A3F184077222E92F3EDE03C50613B9E18C759D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700456, "uuid": "0fa4e8b2-d3b5-4a07-89f0-1e4382bc8920", "value": "24576:75J9jNthgymR6xMhWjpeB4+SVooXWAb8jdtX0PrDtVnHcMNrEOCxXC1lM:VhgymR6xMhEp6SKDdtX0PdV8MF9uy1lM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700456, "uuid": "f0a4b098-f250-477f-8ca4-fc1566449dda", "value": 2049132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700456, "uuid": "9ad80015-8dca-47b5-a13c-b0f9b378aee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700456, "uuid": "e76a5933-fe06-43df-a153-556fb807d3cf", "value": "7773ffee8fdad233f1e375d29fbcf2b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a520317-d3d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680713512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713512, "uuid": "7aa68a34-530d-4243-81a8-6f3bf7d2bbde", "comment": "Malware payload (AgentTesla)", "value": "16b480969042f81dcae141e089c89295", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713512, "uuid": "4cfa6d86-6385-446a-850f-a10ae3097e85", "comment": "Malware payload (AgentTesla)", "value": "2cf58d93042d39ff7fcb25d8de43622097418df55cd15760f61a4aff684d29ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713512, "uuid": "c4d651f6-9aaf-4d42-8050-ac67da8ac650", "comment": "Malware payload (AgentTesla)", "value": "e0ac62af94536f5b1e512ed3f728159bca8d477b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713512, "uuid": "a4b70ae9-9a3f-4322-95ad-10ff81a43f06", "comment": "Malware payload (AgentTesla)", "value": "5731e0e521fc853d707eaadd238e246351e96f7a261f9aabdb8b1927161c27b400a7dac1eca93aa958bb85845b902139", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680713512, "uuid": "e91ec4a4-06c7-40aa-9348-17be721eff5c", "value": "T14CC5338E2AA7EAFCE01BC2328762E6186548FD527070A3135F3E9C448D75D1DB5F724A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680713512, "uuid": "01c67724-9ffa-4867-8e1d-e23b2cdbd9c6", "value": "49152:Viz380dibtFCoj1xzdn4enFEkeP+pIlyr+4r7umwL0idQEqW76RM/N9tc:kobeoj1B9BnFqBoQy/WO+/Nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680713512, "uuid": "36c8ac75-6279-4c99-821b-8d1caab25c04", "value": 2623331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680713512, "uuid": "e38446ab-74d6-4e4a-9c32-a46aa29efed8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680713512, "uuid": "e1890d5e-c0dc-4f7e-bc90-da70e94c28b9", "value": "Payment Advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bcd424-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680718207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718207, "uuid": "4ffb4976-96ca-477b-b04d-54b0e42561f8", "comment": "Malware payload (Formbook)", "value": "c38a88231a374b296d0b19fc39ac9223", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718207, "uuid": "fe5aa351-d513-416f-a1a9-d08584d43d08", "comment": "Malware payload (Formbook)", "value": "2d199eabc6eb73021e9a2778f038ae12e79f9d247daeb03fed293baeeede26a5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718207, "uuid": "428a96b0-fa7b-40f3-a47b-4bab2410ac6f", "comment": "Malware payload (Formbook)", "value": "86c1b67b8bd56c3854f87001aaa40b130b87be77", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718207, "uuid": "55a70fb0-4282-4fe3-818f-748c75bcb38b", "comment": "Malware payload (Formbook)", "value": "0d4ac9b095b9203b3432ad79a3ba60c610ec55bc884dee49d45daf052a6356569e3504f106b1b7209fdda2ba93bb919f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718207, "uuid": "0983d9a2-1f58-42cc-a414-48d0682bd55c", "value": "T12DE4332E082C0D2E12A79F57DA902C078FF47656C28A131F5662F997A3F79F582D09F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718207, "uuid": "574a3804-14f7-416b-ae78-2b33c97a371e", "value": "12288:f2MAR54NtnW46nT/fHGBd8HqFDG9O5rOaR8kbgzHmABkP79mTijs9D/l3YZrYCqw:f2Mu4NtnWtnHMjbNLR8kNUqqiKR3GrYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718207, "uuid": "2616e74e-ecd0-4fa2-9dad-b215b6a7f80b", "value": 670933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718207, "uuid": "73bbc5dd-3160-45c9-ab5d-e41aef3bff0f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718207, "uuid": "c8223822-ab3e-4fb8-ac63-f5490bca888b", "value": "387263527630093.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52555df-d350-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680657991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680657991, "uuid": "dffc1841-cf76-4a62-9141-79956ec67961", "comment": "Malware payload (Smoke Loader)", "value": "b75d84de4614d5fcb84a8bb31d669b55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680657991, "uuid": "7f112dfa-d7e2-45a2-8819-8b16721f6062", "comment": "Malware payload (Smoke Loader)", "value": "2d1bbf9701cd4b8c06272453fdae23c03a12f6245a6ff1ed04fce8d82ff15d82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680657991, "uuid": "4acf4a80-3bec-4905-83ae-08f6d2a51f57", "comment": "Malware payload (Smoke Loader)", "value": "36b8254db0f20195a8fea70b765b5e4f5ce1fa95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680657991, "uuid": "1b9498b1-8be1-4a08-9c9a-927a83ffffc7", "comment": "Malware payload (Smoke Loader)", "value": "dbd23b0703577a7b325efd0c2eba4dcc6b66dfdbe0adc1e126a54fab4e3e30965a90f3bd49a56405ff83ac27bef288a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680657991, "uuid": "4938a64c-0b2c-4d66-9094-d639fff40f6d", "value": "T1C844BF0123E8A821E51B07328E2AC7FD2A6EB8617D617F5E17B5493F5E343A1D27271C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680657991, "uuid": "a6696e5a-484d-4c4d-b3e7-f6f7fb7308f0", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680657991, "uuid": "502b9363-7ee0-4315-93fb-473190b64d55", "value": "3072:lXgcJ9x5tGhbvawWFYyOamX/3IQ0egJwPzCqebmjmdICdTNx9VueJlqaJSNn:xTdGcSxamvYNJBqhjmd1dxTVueJsaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680657991, "uuid": "23652537-e373-43db-8b97-6fc33c3dee79", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680657991, "uuid": "565bae2e-65de-4719-8cd7-0b955c5b98ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680657991, "uuid": "05396a8c-5e9d-4407-94ac-7b4c1995a414", "value": "b75d84de4614d5fcb84a8bb31d669b55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce8ba90-d3aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680696632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696632, "uuid": "5cae41ad-2efa-424c-8404-85102bba4032", "comment": "Malware payload (AgentTesla)", "value": "0abf81ba2ded4e091c5d329416171c7c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696632, "uuid": "d11bc17d-ecec-4ece-adc9-10e6c71ff606", "comment": "Malware payload (AgentTesla)", "value": "2ddedbfd89d5ae3cb31d0e3108ed33fff300d99511fb60869506bc1e3ed1d483", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696632, "uuid": "1b321500-c6f5-49a9-8759-5a0a2e0a0181", "comment": "Malware payload (AgentTesla)", "value": "eaf8f6c70a4332ef9b4518f3861f6dadb5415f1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696632, "uuid": "b13e424e-4caa-40c0-ae37-0c7c86a5c197", "comment": "Malware payload (AgentTesla)", "value": "120c0ec0fed899548f701bc4e56d4b2728f01838a22d4e9eed8e504b0ae0d617aa19324d2bad6851eb399f1792823aa4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696632, "uuid": "5ff0f2cd-8308-461b-a475-74336898f778", "value": "T178E412512B7CD923D7AA397F6023B20C34BAAE256B55C45677673AFD4E7C3422A07203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696632, "uuid": "fdddf5db-a952-4da5-bcb9-6d9405e2d5df", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696632, "uuid": "e41f4f81-3c9f-4c65-a98e-8b4e9abfff2d", "value": "12288:YMw4EAPcLqTwyVBgelmGLOszTLUYbrT3yZrn0aHDyq9DSXALFWMcaLU:YMwtAPcLq86Hc8OlYj3yBDyq0Gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696632, "uuid": "ed7db3e7-3f2d-4882-80b3-d823afda2c9d", "value": 707288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696632, "uuid": "50c2a2dd-af5f-4e9b-bab0-57da4e1da5ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696632, "uuid": "f7b6958a-eec1-4e37-8e6c-c6c50ffd6c21", "value": "2ddedbfd89d5ae3cb31d0e3108ed33fff300d99511fb60869506bc1e3ed1d483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea4a43b-d3e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680719586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719586, "uuid": "e67f23db-283f-423f-8cb1-1be3281f45e5", "comment": "Malware payload (Formbook)", "value": "7288a60d48b958dd0d65c10721f2ae0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719586, "uuid": "fe9234ea-3a70-4ba4-a0da-edac8b604a13", "comment": "Malware payload (Formbook)", "value": "2f19bd5bfb2adbefdfe7237239415513183d3503e433ad08223197fc9af0dc8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719586, "uuid": "37324005-5daa-4256-ae38-202f954842af", "comment": "Malware payload (Formbook)", "value": "107628d4bf7e90c3d4319a900dbacdbc31c71ab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719586, "uuid": "a59fcdcc-d2d1-429d-99f0-7e1831df3f7e", "comment": "Malware payload (Formbook)", "value": "bd193d181f6baa7373a9d72ca7d911e38fc912cfbef78654c4c8e14eda325a82f15a507fbdf3e914630bdf9a443f3c34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719586, "uuid": "2f6633f1-c40d-4241-8f4c-e1ff49134e6a", "value": "T1ABD4F10ABD11520BC8659A374C735BD31EB76D3D89E45A2113FEBA1F88723CA759C283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719586, "uuid": "8f169401-75e1-4deb-8851-66bd7c9ad952", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719586, "uuid": "08f25950-8eb1-4010-96f7-edd39d524849", "value": "12288:1h+G1b1b2rIhUl/ziC/G2I1OfRChEa+CeKdX:1h+G1b1CrIi/zBG3hEjsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719586, "uuid": "d1fbbaf3-caa6-4ab8-982a-f17ec56d0694", "value": 608472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719586, "uuid": "e40b29f3-8c94-45f1-9c86-ec75a413e957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719586, "uuid": "6cdd8d45-d02d-4ea9-a55b-f4bc2a0a8694", "value": "Swift mesaj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea70a00-d3e7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680722539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680722539, "uuid": "2164f0cf-d694-4e45-bff1-b6429aae3c7b", "comment": "Malware payload", "value": "f06e8d4dddcf74ac2f2d285e1130ef26", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-LLL999KKK66SETUP", "colour": "#082BCC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680722539, "uuid": "c9ff8f4f-f90f-4754-83cb-2cae9fa23082", "comment": "Malware payload", "value": "2f6a57af15db06244c652eab3c6411d483a8bc334e77a02fdac764a640f4165e", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-LLL999KKK66SETUP", "colour": "#082BCC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680722539, "uuid": "52f31889-a597-4bef-ba48-8882353c1de3", "comment": "Malware payload", "value": "5af6b4d5da8778750876f5d53e5c65bd13f472e7", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-LLL999KKK66SETUP", "colour": "#082BCC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680722539, "uuid": "97fc3a9b-bb59-408e-bbd4-2e1f8e6c833f", "comment": "Malware payload", "value": "d96f6fdfb72edd651f52f6f23e9c16ce960fae3e3221176408f4de1b2ef788bca7e6215a7bdf209ee3a71203066fb577", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-LLL999KKK66SETUP", "colour": "#082BCC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680722539, "uuid": "e7732d90-7109-48b3-93c0-ac5b30fb297b", "value": "T1BF17338545FD97B081DE389C90C38462B67C0AFE3CA5A7293039517527E86BBD0FBB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680722539, "uuid": "8a58b47a-dc94-4935-8c3b-f0b281e5c02b", "value": "393216:y/o7JvlwZjOhagLluJJSXOekYztta/AAw3pq5DFCx/unemy17mvErZIo:/9wlOUg+ittau455Cx/uneT17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680722539, "uuid": "329b1d5b-bddf-49fe-8789-7a1ec6d518e7", "value": 18932654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680722539, "uuid": "225c6101-dab5-4dfb-88d4-ffad472646fe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680722539, "uuid": "e69ebee5-ac13-4b2e-ad94-9f9e1b9b9859", "value": "setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969ec89e-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680699520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699520, "uuid": "0868943c-4199-43d8-b35c-a9914e5a4e0c", "comment": "Malware payload (Loki)", "value": "9045d0b46b820ae46a56caea6c975791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699520, "uuid": "271430c1-31c7-4dfb-a30b-580b51ede697", "comment": "Malware payload (Loki)", "value": "307b462b554900aa1b0802f4e89752cde49cb4045bc83ac8708578d37ebdadb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699520, "uuid": "1603cbc4-ed6b-449a-ba86-5b2a5521b227", "comment": "Malware payload (Loki)", "value": "d3d256b5ad2497542dbad422e009e47ce939571f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699520, "uuid": "dadb3eda-c925-40c8-8ade-07d0544e8198", "comment": "Malware payload (Loki)", "value": "82e32a0f6a2214fad97b78a32bfcb151c31a0d909b5f7c5259f2721de08175576c45b83b2805006369818ee8901ef8cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699520, "uuid": "3808e7b1-4310-41c7-b5aa-e9fd69362747", "value": "T1E824CE103AA0C4B3D51B42308867D6F46A7ABCB2DF9595CB33A42F7F2D722D16A76311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699520, "uuid": "d2c80cc1-de7e-485e-8312-032e6ea1bb73", "value": "106eb5dbb7fdc2adeef530fb10849030", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699520, "uuid": "54e4a198-ab4b-4f94-95f8-dd9de67ee4df", "value": "3072:+o+RE8kRPEFQzvmpOXFBCdQ33nQYvaP1Q+T6QDy8as5vWpaT:6R6s+CdQH5aWCzD7maT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699520, "uuid": "6591958e-5349-4db2-9cfc-bb307825b69e", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699520, "uuid": "e4a6b3aa-b7b4-4d67-824a-fb2753813faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699520, "uuid": "3e07d593-8731-4dfb-bdf7-b00d54695ec5", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d74d51-d3ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680703275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703275, "uuid": "5f32c5ae-54cf-42c7-bb1f-19a03e411bce", "comment": "Malware payload (SnakeKeylogger)", "value": "608542e9c4e0d2519a053e9f9c94de9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703275, "uuid": "9f8594c0-50bf-4d69-9ca7-cc0b817f2fd0", "comment": "Malware payload (SnakeKeylogger)", "value": "30c6872609105424d9657adf4618017c99e7ff75cbce213248ebf148ee76243b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703275, "uuid": "0548d68e-d78f-4f77-bc9f-862e8f24723a", "comment": "Malware payload (SnakeKeylogger)", "value": "bec0d08fe9ff9a3e0b0efc2dc3239a3c2cbdee5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703275, "uuid": "74208cf5-0b0f-471d-b516-d5060d448ae2", "comment": "Malware payload (SnakeKeylogger)", "value": "e9e835509be2f499ec4c7b17a2bef852727db8ced7a7d927a0abe57202b35e59fb2fc99356be24924d0adc3639b36363", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703275, "uuid": "9f747457-6190-4e2d-a1c1-a0e3b41b840a", "value": "T1A8C45A343AFA501AB1B3EFA69BE475DADA6FB7733707641D1050038A0B23A41DED1639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703275, "uuid": "73850829-3a6e-4a3f-83b1-79a5bebd5374", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703275, "uuid": "083e0057-af72-424f-8d24-3daecf477dd2", "value": "12288:xwBbsBLZZad0KupnVoHGSfoHjNUxakqYno0voV8ghTv8pQq:PexaSqTVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680703275, "uuid": "8d4dc236-4688-49d0-a23e-157944a911ea", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680703275, "uuid": "81cd04eb-b6da-42e6-9ac5-62d9b547167d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703275, "uuid": "cbee6a14-51bd-4428-b4a2-52f64db3c415", "value": "P. O 34534..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b8f8bd-d3f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680727243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680727243, "uuid": "3e13ad66-49d9-4af3-b0e4-0de0a226a355", "comment": "Malware payload (AgentTesla)", "value": "c0e755217bfef79472d3c775471027c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680727243, "uuid": "3a363ed8-a675-44b9-a967-9d16b2f3acf4", "comment": "Malware payload (AgentTesla)", "value": "30dbfe2365c1dee272c939ab45eea147b34e24bdf09bd1a8df4d5419a115f0fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680727243, "uuid": "47303e94-ca4a-448d-8323-d12fffac67a3", "comment": "Malware payload (AgentTesla)", "value": "e1324b3b69a2e4296e368a60696610b6fc242216", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680727243, "uuid": "4bbbf1b2-c356-414f-9863-c9c463081b92", "comment": "Malware payload (AgentTesla)", "value": "ce4a9a1252a0637ed2b9838038de76483065717d227fc1789ef3488b4cd12f32ed348997594c790451a125252248813f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680727243, "uuid": "d968d785-3547-4742-8d51-44b65d3aa74d", "value": "T18175BFF305C3FEE653A71E54DC422504CD84F9BB23ACA09879CC55AAEBA08549F99CF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680727243, "uuid": "14df4f57-588e-4c33-af9b-6f84c7bef3ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680727243, "uuid": "5a4fc71f-3130-403b-b8fd-96796c3bc223", "value": "24576:ouPkgf1D/UuoWKAWdpx/vU6IFvilXwUOLo0IsKAf/CeiuLYY:oiNM3WGdvNUnK2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680727243, "uuid": "e7b755ee-57b9-4f33-8ea1-318031f45b1a", "value": 1583104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680727243, "uuid": "aa1db729-5804-4eba-bef0-58eb82378151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680727243, "uuid": "103abaf0-63ea-4c47-ac55-8338a30f5589", "value": "\u652f\u6255\u3044----PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815a7f27-d3a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680695190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695190, "uuid": "56c38c3f-c8a2-46c6-98b2-4ed1efc7d514", "comment": "Malware payload (Rhadamanthys)", "value": "8a16c0160c1e7fe4fa0c4900612edfc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695190, "uuid": "a05f7b02-5f62-4815-ad8c-598fb1769c73", "comment": "Malware payload (Rhadamanthys)", "value": "3225650ffccf1211dbd31a230ccee400a05429d4aa4df4a6bb98429bb103e6cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695190, "uuid": "6a7c5028-c0c1-4087-81d6-c9ad8bed0c61", "comment": "Malware payload (Rhadamanthys)", "value": "085f4e9fe58d4ebdd272a3583113b8cc996be3c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695190, "uuid": "9655b9e9-954f-4017-9d34-15e1c0adbeea", "comment": "Malware payload (Rhadamanthys)", "value": "8a09e0ee82ed1bc7ab8a9973e427ce20212c78e91f47af5115fee6717dcb92eca6f1ea1d6f303a515b5e6bac1d00b49f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695190, "uuid": "b435f44e-4b06-42f2-aa2c-0d72f9abf32b", "value": "T19454DF507A91D4B2D85295345926C6F8663EBCB2CFA086D733583F7F2C316C2AB7A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695190, "uuid": "0fffdc14-7977-410e-beb6-431271adb1e8", "value": "7e3b1e18e4b8642ee42be6e8ca53a819", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695190, "uuid": "1927b6bd-0210-4fdf-acd6-820e37bbc0e3", "value": "6144:DXAL0l3sxX/huJEFQdqQf54ZMDeHYMVAT:Dy0lShuJSwbMVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695190, "uuid": "e983bf97-6ad9-40e6-a243-b515c8e47842", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695190, "uuid": "dfb29d53-4aeb-40a8-8b4c-ab90f3e922c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695190, "uuid": "8b090007-3070-4019-9cdf-9f73a541ce20", "value": "8a16c0160c1e7fe4fa0c4900612edfc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c970cd-d3a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680692031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692031, "uuid": "462c9da1-4610-4f8f-be94-9a1f7e7213d3", "comment": "Malware payload (Formbook)", "value": "0e1f5747fcaea9d0abb1a27220d3762e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692031, "uuid": "f47cb963-efa2-4eac-91af-02fdd8f80337", "comment": "Malware payload (Formbook)", "value": "328b145d2b60fc30da523470c8fa4fb93d3046852a103e42f7735e1f9cda353d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692031, "uuid": "34205fa8-563e-4328-a632-7c0ebc66eb8b", "comment": "Malware payload (Formbook)", "value": "a10fabdfa37241fc8087d2ca44542f128c29b3dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692031, "uuid": "caaceef2-d246-43aa-8bf5-cb6853b5317d", "comment": "Malware payload (Formbook)", "value": "1348b9cdde68662de4a6f79456d43fc821b666bc60c84b8849056315bc2db574533fb4512c6948d1b1efed451a56f2dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692031, "uuid": "5170ae54-e116-49e2-ad2f-96b3d97b2c50", "value": "T1F6049E36E701C031E3B211B5B26C1BBB843E1D353364A0A6E7E21AE56FA05E5F56931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692031, "uuid": "b7726b18-defa-4fab-bfe9-5470d3547aca", "value": "3072:lt247PD9MhNDTtkuJLz1pWMpOIlg71kn4V8xSuktX880UkkVpqRx6x1FYoCTQyO5:lEUD9MhNDBnP1dp6Bk4C5ktM806VgqCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680692031, "uuid": "9c9e6822-52c6-418d-a773-9183088e2501", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680692031, "uuid": "1fb87134-9c92-438d-ab22-0f1acf82548a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692031, "uuid": "2990520f-80a8-4341-a151-7df5f70859da", "value": "328b145d2b60fc30da523470c8fa4fb93d3046852a103e42f7735e1f9cda353d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7de946-d37b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1680676232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680676232, "uuid": "568ddc3a-01d2-4987-bac1-b2180059dbb1", "comment": "Malware payload (AveMariaRAT)", "value": "b74618879b5e2ea0e13c8d0e992678bc", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680676232, "uuid": "782a19dc-14e1-4f48-8cae-5da59ce24ecf", "comment": "Malware payload (AveMariaRAT)", "value": "329eb61b873a6a841137f7636308eeea8b0be51615660fb8ec8ada0ffdeaec52", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680676232, "uuid": "8984d7ab-a2c7-4f9d-b6e2-7ce5a0e9a74f", "comment": "Malware payload (AveMariaRAT)", "value": "fc5d28f298c64362ffb3694ab86230a9d445b0a8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680676232, "uuid": "6990844f-0907-467b-9170-37355a5933cf", "comment": "Malware payload (AveMariaRAT)", "value": "d9127675720e45f64a0a01064e75de449e4425d035bdb02108c68d2460d40087429b953819c3512bbc3a8eb822e2476f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680676232, "uuid": "81146846-1f69-43d2-963f-6166ef3f475a", "value": "T183F43B3919EC95D7D479CE758EB04C24B5ADAC172631CD2EF99A30C906B3B02E64327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680676232, "uuid": "859b1779-2f11-47d4-8420-cefeeada4f23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680676232, "uuid": "b8bb9726-b838-4eb1-878c-3a3aac770b3b", "value": "6144:xKPFSPmwoU4u97LyvqwVzphpJS4hgXoa76Cn5TVM0DKDjYTHo9wdbJ4hkGF:xKPFSPmD8LyywVzpFzhlUTGbgTHcwTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680676232, "uuid": "074e4b92-e9ff-42b3-a5ad-23babe1cebb1", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680676232, "uuid": "34eaba44-e87e-4355-ad7f-3accb8829ad6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680676232, "uuid": "46815e41-f8a9-413c-89f1-87b48a20ddc6", "value": "b74618879b5e2ea0e13c8d0e992678bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a345c181-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680699542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699542, "uuid": "93aacba9-80ee-4519-919c-7c554162aefb", "comment": "Malware payload (AgentTesla)", "value": "a7b7e8d9a563ce7fd925ed4df2bcef5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699542, "uuid": "9c77b351-9fcf-470b-85f7-b9a16ba51a02", "comment": "Malware payload (AgentTesla)", "value": "33870669d313d533d4ac9cf7ab9c50a04cfe6a10f53dba7adb379d00e8f223b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699542, "uuid": "2c560ae0-0220-47a8-a755-b3b632afbd9f", "comment": "Malware payload (AgentTesla)", "value": "bd194ab6be52775df1611d99b655ae3a8cb90b23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699542, "uuid": "e740a903-279d-4c18-98a3-1fa839c546b0", "comment": "Malware payload (AgentTesla)", "value": "d8fd989713562f05cbdbc10b6029d95a671f48c158d43b1029128fe2de9c12e3b72f7a12ef9862b8d03f537c39b718bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699542, "uuid": "efa103e5-07a8-4eec-a6be-73e8865a7dc9", "value": "T1F055382439FA501AB173EFAA8BE475EADA6FB7733B07645D109103860723A81DDC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699542, "uuid": "a934e98c-78cb-458c-a6ab-b3029bc743de", "value": "12288:tH3WnIHGVrCetj+MBHg5WRSbE519jIhgvQ6F0wBFkiX7WNYnVfvQ20HjlgcbPtbc:eZBvAWSE8bGrc8Xg1J1Ooxwylqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699542, "uuid": "44a6486e-6582-46a5-94fe-64283a110adc", "value": 1332224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699542, "uuid": "ebba5afa-bd61-4b18-a45c-eb550c3486a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699542, "uuid": "02c4a56c-5237-4b5b-a573-c3b0c8af9800", "value": "Halkbank_Ekstre_20230403_103056_630714.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54362a01-d371-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680671921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680671921, "uuid": "499f9e86-1ccd-4c45-b9ea-fb79f801ca2d", "comment": "Malware payload (AgentTesla)", "value": "4ad0745db58ade48aa09117591a7aca9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680671921, "uuid": "de8fa32e-4781-4561-b63d-6aa231efc4ef", "comment": "Malware payload (AgentTesla)", "value": "338dbde580b80bc6d1ad8fce71083fa8304dcf246daa0f7dfbfdc0b7c07c1bf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680671921, "uuid": "8eaf51a4-5ed3-4f20-a726-4fce08eda11c", "comment": "Malware payload (AgentTesla)", "value": "7d978695a3b9f01305c2117e5e160237d30aad54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680671921, "uuid": "4920cee4-67c6-410d-85a9-c75eb7067fef", "comment": "Malware payload (AgentTesla)", "value": "70608efaaee958aaf6f8f5b46ee5dabe01f6bb08efdd8ff476b307e2b902ee29a9fc05718321bce996c1fe3880cb5180", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680671921, "uuid": "52018de4-3397-48e9-b271-d3f5c8ec3642", "value": "T184C423CD29CF3E7DDEC056D91D19B906905E32441643F3C9466B92CA38837F87AB8AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680671921, "uuid": "0ecdc482-8b3d-43bf-af15-aa206ef5da31", "value": "12288:12tIQgfUkib2A0/4Ac6s6POeZU3gaGMo8Cng01HB2li:12tngfRAX6sSeg/g0Rgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680671921, "uuid": "b9531191-88cb-4733-a08b-a3270b424005", "value": 556927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680671921, "uuid": "300c7295-7786-4b72-bb4f-fa02b8e15cad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680671921, "uuid": "dbbe8e8d-fc3c-466b-a885-37dc2e65e165", "value": "DHL_AWB_NO_#AWB 4019299583.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3ed408-d3c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680707234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707234, "uuid": "1bc64270-1e69-434d-bdac-6621238679d4", "comment": "Malware payload (Formbook)", "value": "a454408e0e7c205c90e3d345c0ba23c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707234, "uuid": "7a328b7c-1717-4ebd-8c16-3c1d988c75d3", "comment": "Malware payload (Formbook)", "value": "33becf21d0011660512060b0ed7cb1135f2704af7637b0c9f06378b08dfd0b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707234, "uuid": "ebde1f47-568c-458f-b39f-d184cb39b52a", "comment": "Malware payload (Formbook)", "value": "c6bc457708c107f79dd675d8f105365edfa9d5b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707234, "uuid": "34536897-7557-465b-a854-85b65ebfea9b", "comment": "Malware payload (Formbook)", "value": "dc95aaebdf82b78303443e72db8be62f1a8ae925f203dfe54c7ba466425482ada450349bad5aaf3c8bf73025a85173f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707234, "uuid": "c06f91ca-f5cc-4663-939c-94fda6033c15", "value": "T16FE45B7D2DB89E66F439E3788BE0D023A1A1E7D3BB21CB181BD7124D4E1190275EE16D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707234, "uuid": "0c7c50e7-4970-4258-a2df-e024aab0348c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707234, "uuid": "b5b74426-978a-4699-801c-b6ee9181796a", "value": "12288:F/RmSzczsLnlTxKRyc6l7WUrIbknm+Wqq:FnBdoRyNliUr2km+Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680707234, "uuid": "6651b70a-a37c-4688-b31c-d9e0eb4fb520", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680707234, "uuid": "a19ca817-b823-4c41-901f-1fad505cb331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707234, "uuid": "5994062b-cd1e-4298-9fd5-b9eb3acccbd4", "value": "33becf21d0011660512060b0ed7cb1135f2704af7637b0c9f06378b08dfd0b7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9e52b7-d376-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680674354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674354, "uuid": "ca8e2aa3-2b22-45d0-ae11-6375ccef5cda", "comment": "Malware payload (SnakeKeylogger)", "value": "c057375810d910fa597ed62275e359b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674354, "uuid": "b8518711-acd2-4d7e-bd03-ef73d56fdf56", "comment": "Malware payload (SnakeKeylogger)", "value": "341db7699f4f2349d2cec4a85f09a899b322268b811d722aa9da9e035c0db874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674354, "uuid": "13fbf81a-b004-4cc7-8d80-42f6075d322d", "comment": "Malware payload (SnakeKeylogger)", "value": "ebbf981673b34b3c9b103c273c46ec3f4975dd2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674354, "uuid": "a71c8610-1523-4872-989f-2d759a287ea3", "comment": "Malware payload (SnakeKeylogger)", "value": "e5ddb10f29011ebd415d11c7ebcee5b64de7cc856d270e4c5cbc0d76b14b056aa58740f1ed5b489b90a0937eef5f668a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674354, "uuid": "91080968-fe7b-4f6c-bc84-2cd9e5a1151d", "value": "T1F8D4122433E55F34C99F4B7AE9B2310603F9BD2A2451F34D6EC2A4D91EA3700DA516B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674354, "uuid": "540dd8d8-334e-4eda-b476-cea1442ee0af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674354, "uuid": "335c5c77-a2d0-4c4e-b95f-4f4569fd97ae", "value": "12288:srt8R4lOv+iUl9kTvBLWAt75xvubnFOXg3mHglwU:srt8RB+fklt99U3mAqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680674354, "uuid": "ba87df37-5e8e-4fff-b5cd-8ec8191c1290", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680674354, "uuid": "82f32741-b372-49bc-905e-394c41f7e81b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674354, "uuid": "c1bd7c48-c9d7-4aeb-9384-e2e9f94f8c77", "value": "Maersk MRKU8781602.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b7abef-d3ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680724933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724933, "uuid": "44f39d22-f9bc-4772-9ef7-f3911446bfb2", "comment": "Malware payload", "value": "dba1f95413351b47bfa7c50c3a529844", "object_relation": "md5", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724933, "uuid": "f0e71f08-91e9-4080-8cc5-3528b44bf7ce", "comment": "Malware payload", "value": "345a58b6a943b3a9235473232e3b07d8259a4a852b6b81c73412bef8a404a2f8", "object_relation": "sha256", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724933, "uuid": "7cf7da87-7217-4875-bd48-40b233b5c7b6", "comment": "Malware payload", "value": "8c0d086705215f36b084fbaa71244fc6daac7458", "object_relation": "sha1", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724933, "uuid": "f44dd34e-ba17-4811-9d78-afb18ddd3203", "comment": "Malware payload", "value": "79e4e6d02f003392477d5a38bc87f1533f8e3a37b26c3a3ab26c9bfacce9d3940eed8e85bc748c9fe6378a86f16499e4", "object_relation": "sha3-384", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724933, "uuid": "ad0f61f8-6620-4937-9fbb-220501fb8f71", "value": "T1A527333BF168643EC5AE1B7516B356109E3B7A61681A8C2E13FC340ECF765601E3F662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724933, "uuid": "9123af1e-23a8-44d0-b91e-fda057ed4c0a", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724933, "uuid": "8483d417-faac-4d6c-8012-a9842a95f62e", "value": "393216:Xn9cyPs8Wk3wPFLfb/w9433cyciW74mzRcwCC2OfDnA5fhyZxaH/5kd:X9cyk8nwNLzI94cyciszALWDAOLie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680724933, "uuid": "22c951c9-7e3f-43cb-99d1-8c4483241464", "value": 20907768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680724933, "uuid": "2e67a5c9-22ab-4e90-81fb-2cd1d71d2679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724933, "uuid": "1a641aa6-d8a7-41f7-9880-0103031bf135", "value": "yspx-v3.2.25-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99f8e5a-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680699686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699686, "uuid": "f015184a-7842-466c-af61-edeb56a8c6a7", "comment": "Malware payload (Formbook)", "value": "57908a1f3f0a596d694baf2a9a746aae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699686, "uuid": "8e04f38d-c97a-4afa-9255-ccb23d802c50", "comment": "Malware payload (Formbook)", "value": "34da43dd685ff44693360ea3feb0aba8946f7844a7711ed297533e51c2a7ec90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699686, "uuid": "a4ad8c0a-6637-42fd-bef5-8159e681592c", "comment": "Malware payload (Formbook)", "value": "f7af5a9f14cce10fef0b7e97212a05c41bee0c9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699686, "uuid": "3ecbf33e-2c5c-4979-9457-b70c9c1f10e6", "comment": "Malware payload (Formbook)", "value": "1e21b0205a5ed594f7946bda3c55a9ae4888c58eacf26c58839a25fe8b0ab3a0b015b8e9f7e4ee42b8e3518203874e70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699686, "uuid": "e76c32e8-bd38-43c5-88a8-20c0d555cd6e", "value": "T14CE4121C2EAC9129C2BF0F39C962150553B65C76A636E33E0ED5246E1E73B58E061FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699686, "uuid": "9e972557-493c-4567-b281-be183be6c4f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699686, "uuid": "b1d998c0-26c5-45f3-8cc4-ad9bc3be0d9b", "value": "12288:D4tWXCxG/ZC5MAhNELarBrDOHxeGLitoqYcAGSfvF8R5RnQU9l:DMWXkGxCOAhrBaHxeZyqY3nXeRnnP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699686, "uuid": "256a33c4-80f5-41ab-9168-418b0cf5d9dc", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699686, "uuid": "6ae015d3-11a9-4dd3-8f6b-6f4f67da139d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699686, "uuid": "68453812-8c76-4249-8f0c-9606a370d230", "value": "New_Product_Catalogue_2023.pptx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0fb899-d3e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680719769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719769, "uuid": "ef2b017c-ce9e-4517-9015-705a1dd154c6", "comment": "Malware payload (Loki)", "value": "403977677195dc45cb4d5e533a79b18b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719769, "uuid": "fc7f1690-1f78-4473-9819-c7e776970c04", "comment": "Malware payload (Loki)", "value": "35d73f1132978e70d922aed106443aaed23b9cc9d56a65940ca8f6242108c255", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719769, "uuid": "a910145f-14d5-4b29-9993-793682bb27ff", "comment": "Malware payload (Loki)", "value": "1c701e5894b6993b39439e96fcdc917c3aa4457a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719769, "uuid": "5fed1fbb-0a3f-4d9c-82f3-307f2812da24", "comment": "Malware payload (Loki)", "value": "6f095f8a58a26801a9fa85ef936890fa6d0290712e79909cb08c049ca3b7bed183dc6a0bcb8a87ad36cafbbb48b71899", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719769, "uuid": "462625e1-cc73-4af7-9d75-b08cfba1dc48", "value": "T19BB4121E37BED339DAD643BBD493110003B4E9569266F31A2CE741E60DA3B9E4D90B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719769, "uuid": "1bca5140-2da1-4c4e-a1be-025f464c0313", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719769, "uuid": "5adb4143-307a-49e0-9281-d3adfa5c7910", "value": "12288:lr/qPxWXOMpqXOxXWXVCL66+wn3s0N+/oJ35f+B8NsI:lji0toXOdWXDDZ0A/oJ35FNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719769, "uuid": "a20b4844-0f01-4ef2-bf55-96d340ccf6cd", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719769, "uuid": "a73c234b-befe-45e9-8801-31d131a3e3ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719769, "uuid": "b98baf6b-37f5-43fe-b0c5-09ae777b3d0c", "value": "403977677195dc45cb4d5e533a79b18b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04938b30-d384-11ed-88f6-42010a9c006e", "comment": "Malware payload (BumbleBee)", "timestamp": 1680679948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680679948, "uuid": "5f901c6a-4603-4059-bfd7-3395124eec63", "comment": "Malware payload (BumbleBee)", "value": "1eb4bd24c3d02a38a333eaeee4b9b49d", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680679948, "uuid": "9ec4fd73-3d02-41e1-9e9d-467225790103", "comment": "Malware payload (BumbleBee)", "value": "35f2ec59313bbe5b78e4b043f06f8961f6f3e77b870544d15ee7cc1fca987d8c", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680679948, "uuid": "09b7f31f-53f5-4521-ad2b-eb2744f326a6", "comment": "Malware payload (BumbleBee)", "value": "3c85c03088b07bfcbbe969af0cbdde9bd26e69d8", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680679948, "uuid": "b2a2d605-2a44-4e24-b42a-518529c0fb03", "comment": "Malware payload (BumbleBee)", "value": "dab329a371df915391a3153efa1f1a8d9085de5dbf714c648f2049459d1fdc8f4d7f1cf590aabcc9e44701f02d77ac9d", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680679948, "uuid": "e3bb123b-fd28-4c7b-9f9a-3a1e2d9594d7", "value": "T1CF751A08EDC16F0FCC21A4BA894798E2B5ABC8497302D75BE798D63775027294FC786D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680679948, "uuid": "f417b635-b50d-41b7-b511-26fa1a1e1361", "value": "5a83b775f11fca962faec5d7d036c1c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680679948, "uuid": "4be9f196-a082-4b9b-a757-0e7762c741d6", "value": "24576:drYB2BBDhQ0uQn65tmj83OA7IBgXOB6ycon/sl3O6mvV4:dhT+fhavA8BIfyF/st", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680679948, "uuid": "1601aa51-960f-4333-91b2-1c6abbddee34", "value": 1636280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680679948, "uuid": "7f41dae8-10c4-4364-a8e2-0cf9fc75178c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680679948, "uuid": "df38028a-69f1-40fc-baf3-809fbb6a9045", "value": "inst1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01ae451-d3c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680706891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706891, "uuid": "a99ae055-6c42-47ba-9260-dd483a8cb729", "comment": "Malware payload (AgentTesla)", "value": "b1fbc9b75c2d0e2b223459db84337105", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706891, "uuid": "df8ff05d-40e5-4cbb-a3f7-ced9b3bc4862", "comment": "Malware payload (AgentTesla)", "value": "366a6d6e0aed96880c3589d33f5ee493ddfcc1f93cbe61e02b43867fa74f73b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706891, "uuid": "0e5e0b88-235f-4a43-a06d-2f3d6140cfbf", "comment": "Malware payload (AgentTesla)", "value": "8c0a04c9d84e1893235d3e05a3ccfcc9ffff0bba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706891, "uuid": "14032ebc-76c4-4a90-8b2d-fcefab4aacf6", "comment": "Malware payload (AgentTesla)", "value": "358acd2c8575b0df63d6658482b0450c65cddb0020ca637bcfd77557c7d535cf3cd53733e715089b1662b120b0c70756", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706891, "uuid": "28ddf4a6-aac1-4c1a-9158-e9130020998b", "value": "T10AC44A3D2DB88E66F439D3788BE0D137A1A0E7D7AB21CB181BD7124D4E1190679EE06D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706891, "uuid": "b287c3dd-e277-442d-b882-d409872b16c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706891, "uuid": "087a6603-fcf7-451e-9110-a9ac726ee61e", "value": "12288:gHZ2suEnrnKlZZr+chq84QPmlWOQdpZPKCGxPFw76N48:gNHCr+yq8415CfPDqtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680706891, "uuid": "51da980d-5afd-4ea6-816e-185daa1f760a", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680706891, "uuid": "0e3864d3-81fc-432e-b8fa-9bb8ca3b3b19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706891, "uuid": "90edce8a-09df-41cf-9ea6-4aef3cfda7ab", "value": "366a6d6e0aed96880c3589d33f5ee493ddfcc1f93cbe61e02b43867fa74f73b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f78b0bd-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680718245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718245, "uuid": "c88ac322-89b2-473a-96c4-aaaf96320e42", "comment": "Malware payload (SnakeKeylogger)", "value": "9d0537221683b743b80e6bd9df8a2466", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718245, "uuid": "a35de42f-2fcf-4125-8286-656a31022c9d", "comment": "Malware payload (SnakeKeylogger)", "value": "36942e212e661bc7ccd11b0c36a0b2c623f9a81a252a29edf5120c92f777f4c4", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718245, "uuid": "36e420f9-36fd-4bc2-87fd-533b62586844", "comment": "Malware payload (SnakeKeylogger)", "value": "08d2c2aa61cd0026bb005d77cd35f2cebd1e3292", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718245, "uuid": "20293414-5571-40ad-bca5-a15d32206f3d", "comment": "Malware payload (SnakeKeylogger)", "value": "c1c3d18c6e8f3dd0a6145d0f09ce80233e51b19374486768db30010721feef576bdb7eb4ee8631d9239437c6476e6bdb", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718245, "uuid": "5b3b2b15-35fa-4c92-8928-4c37bfe0d0b5", "value": "T181C42359C68B586358385FFB265E3EF3823E4B8B56CAB0A4B6135244B3D1CBD8E407C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718245, "uuid": "31b9d828-77c4-44ec-af16-11e33560eb1c", "value": "12288:YqVl3ZDClqE5dBbCkga6uHVL8zgAd0u/z:FSrbRgaugK0u/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718245, "uuid": "8b8fea4d-12d6-4e42-9a6f-d3a98e695642", "value": 547105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718245, "uuid": "309759aa-d59a-4aeb-b8e3-0ebb2b40eef3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718245, "uuid": "ee279498-6803-4011-ad6f-3d90d1e1eb41", "value": "PT.GLOBAL.PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f09c9a-d353-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680658987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658987, "uuid": "2ba8f862-e600-42e5-814d-55cac43b3208", "comment": "Malware payload (Smoke Loader)", "value": "a83786ef9eb326c03f65bb250afd809c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658987, "uuid": "8d342e73-384d-40ac-9d71-4768c84bcb30", "comment": "Malware payload (Smoke Loader)", "value": "3750283e9abf1a4d7d11cd47e0464fe9e27af3e823f1dfd9272a51bacf424bce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658987, "uuid": "d471cb11-1962-4885-8e13-bf9216a858bb", "comment": "Malware payload (Smoke Loader)", "value": "eeae8d6dbcb6cb8b80a4c5722fa976291eaa99b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658987, "uuid": "02f54392-9ac6-4125-83d6-7647c12c0896", "comment": "Malware payload (Smoke Loader)", "value": "9a2004ad1fd01fa544dcce8e0bd3dea8f573027fe93536addbd98d994defa39d979674717434020b1b32690c96493859", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658987, "uuid": "11d55dea-d77c-4b70-bdea-ef4b4871718e", "value": "T171647D0246E8A830E13F56328F2EC3F9261EBC629E197F9B5675BE3F0930171D5A2705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658987, "uuid": "fd860aa0-604c-480c-bce7-39385bafb57e", "value": "32bc4bcb8001a7f823bc4790d11e13f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658987, "uuid": "17282c3b-52c4-4d79-8c84-a59a72154693", "value": "3072:pJeEDJvx63iMTqu0+hupmNHR4kFyguVDuhYgguJk57jY1BeiZW3QH8EP:pzVvxI9T/xpgzDudguu7jYn+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680658987, "uuid": "745c6447-1f5a-4fad-8747-df9873abc410", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680658987, "uuid": "b56bedc8-98a5-40fc-a19b-96cf1fc34111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658987, "uuid": "963ae490-0325-4cd9-82b7-bd55a48f17e3", "value": "a83786ef9eb326c03f65bb250afd809c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500ae6e8-d3a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680695107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695107, "uuid": "8eb643aa-80d1-4cc5-976a-12fa5006f6ee", "comment": "Malware payload (Smoke Loader)", "value": "48b361fa20b9819110580f9179a8ee59", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695107, "uuid": "df87d031-e4ba-4262-81ed-a9489445b843", "comment": "Malware payload (Smoke Loader)", "value": "384ddb2499fe36465749a75b4dde647e767ad3196da60b821c4b574188ecad0a", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695107, "uuid": "78ce3af4-aac1-441c-94b4-478db49b0ad4", "comment": "Malware payload (Smoke Loader)", "value": "b8ffbd678229901cb0d212b3df0b2e433bc1a8aa", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695107, "uuid": "16bbcb7e-ebb1-4646-986c-566fa2abdc2a", "comment": "Malware payload (Smoke Loader)", "value": "f2711721e2f8702bb40151e18c7b9f4b556878226d3c2b8ed9faefe67c4009ca671300120d1430772d67dc186ef3834f", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695107, "uuid": "180f6770-86fa-4354-ab84-dd43262f2251", "value": "T10824CE117AA1C0B2D42380745868C6F8363EBCB2DBA996DB33543F6F2D312D16A77352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695107, "uuid": "0ab4f641-56d9-42ba-9be2-cfaf5d3e76ba", "value": "7e3b1e18e4b8642ee42be6e8ca53a819", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695107, "uuid": "748c2d61-ea46-4dcf-9158-32ab4f61c343", "value": "3072:i0i/+h0U733VqPOkWVaNah5Sr6f2iQ9m/45szy7utJSTv:iB/6TVUrN4Mw2J9mBzUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695107, "uuid": "69c25b67-6603-48f9-b9e9-b8fb7b0ff415", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695107, "uuid": "55a61544-c9ab-45b7-9021-7aa213e817c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695107, "uuid": "431de809-ef93-4e0b-acfa-40d313c6840b", "value": "48b361fa20b9819110580f9179a8ee59.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf70e0eb-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680700475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700475, "uuid": "ac19f009-4dfc-476f-919c-6cb030550c9b", "comment": "Malware payload", "value": "9a4370cd83806609be05f269a98097b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700475, "uuid": "a4d20206-9931-4324-8843-2109c31d3fdb", "comment": "Malware payload", "value": "38d8391aca9614ef39d6a1cff1e7a43d74aeeeb4f8822bb42f7ed77d05f8cebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700475, "uuid": "6d722c47-a615-4aa5-92e8-9f2b97350e61", "comment": "Malware payload", "value": "a80e86e085d61e4d3169d47d17cbb670081979c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700475, "uuid": "3e80e56d-ae04-4411-86f7-68116f7c4dd0", "comment": "Malware payload", "value": "007166dae9ec1ab7501e8a77dd46c0f2f4efac7ea48b655818c960a83df93a981cdc3f98d2ab50925216484074b584b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700475, "uuid": "7b801c39-122c-4422-91e6-b9ed6447be84", "value": "T17906338C234B90CA25F7DB77903BACE6701FB945E2251B5626F812AF6673BC27035172", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700475, "uuid": "47689940-ce09-4bde-b405-07120459fdb3", "value": "98304:z/B7WLWofXOBm5LuybBkGI1WzF2+PFmtmGMlGEkJJ5rGU:97Wa2ckna1yPMjVZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700475, "uuid": "5690f3c3-f436-44ac-bf24-e0711e8cc50c", "value": 3938819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700475, "uuid": "cf91659d-3df0-405d-a5a0-38a36cd7e736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700475, "uuid": "50c8624e-bf06-414f-8178-458c39d2bccc", "value": "9a4370cd83806609be05f269a98097b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29eb8618-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680718236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718236, "uuid": "0c2669de-a362-4a0a-8722-c66b4dc92a91", "comment": "Malware payload (Formbook)", "value": "f78265f9986c0af411940fea4cdd7eca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718236, "uuid": "f076eec5-5ef7-4d85-8954-3da5bd566e2a", "comment": "Malware payload (Formbook)", "value": "39395dc802a5a35a70b779f4c661fd3b6c098831d38f66a943db0d86d31d3856", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718236, "uuid": "b926c1cb-3982-4c5f-9e96-7559e811b03c", "comment": "Malware payload (Formbook)", "value": "f11d24a5f92cb3bec17f1beb572b194e80268083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718236, "uuid": "c4b9d911-4a3d-4859-a5f8-37be297d0bd2", "comment": "Malware payload (Formbook)", "value": "77b486132e7149ea2add92281a2a12ba299c40a3e1d27b134e8d4050f3d97b84af770d5017bc4bcf40901e769a4dac7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718236, "uuid": "9f39f265-0592-406c-8bf7-9562fe555554", "value": "T182358D787B6B9A23C1BDDE31CAF69400A3F184477622E91B3EDD02C50A13F9E189759D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718236, "uuid": "96a0428c-9286-4296-b9ed-c1e88ca432b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718236, "uuid": "8c89ccc1-1ba1-4cc4-a9d4-cc90ea08159b", "value": "24576:LaflaT2ZmB1zez+QUWUR8JQHDn+KC5ZT:LafkaZ+rWw8JENC5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718236, "uuid": "8fc0a841-5359-4feb-b3e5-d8dcb068b3d7", "value": 1152512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718236, "uuid": "842d86e6-35e3-4d0b-88e2-2034f10efe6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718236, "uuid": "2e4e2f7d-057c-443d-b7a4-de346826d029", "value": "new order needed.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1032bc7d-d378-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680674813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674813, "uuid": "a5868fef-b587-4d85-b320-44b152caa5b4", "comment": "Malware payload (SnakeKeylogger)", "value": "82053b6d9604b51006912808da199017", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674813, "uuid": "8ee12094-bd2b-454a-b89c-22113264020f", "comment": "Malware payload (SnakeKeylogger)", "value": "3a2d743dbef0e04c98f7704269458d98c1c5d363fac04932254f35e1dc2c1821", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674813, "uuid": "758ea81d-4e12-4395-85e0-2a327832d4c4", "comment": "Malware payload (SnakeKeylogger)", "value": "75d72201ad1175b933d12f7a54b16ef263e7940d", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674813, "uuid": "4b4c4b6f-7f1a-40b0-b335-0308ef7f1ed5", "comment": "Malware payload (SnakeKeylogger)", "value": "4376116382995a3f0018950217b023578e816b3d25f658f195348fc7c0fd4e77558293a44698e64a5acbdc9208b0ed65", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674813, "uuid": "b646be6d-81a7-451f-8365-a7be7c3386cb", "value": "T12FE423EC8D0EEF7D52E037F59B58EF416488813865177F24B706EC4A5237EE868068AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674813, "uuid": "f1f25933-995d-43f2-9b10-c4e685a5db02", "value": "12288:rs2JdEeRQ5za25wbaSd6WHHxU5UB538T9fI4O/ig6TBR36MyZ/OPeA:rsWJC522Ozs0ff3QZIZqfW3Z/OPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680674813, "uuid": "4fb5907d-df8f-48b0-b6e8-716b9c38339c", "value": 661065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680674813, "uuid": "98349a6a-b0f7-46e3-8b36-bb4be2f924ec", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674813, "uuid": "fad20847-1137-48ff-82c3-2fd41513677b", "value": "Pending invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1584186c-d35f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680664085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664085, "uuid": "53791a05-f153-4368-9152-56874b036ed4", "comment": "Malware payload (Amadey)", "value": "b5cd01cd201dc169f945fc1ee711e9ed", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664085, "uuid": "712b04a3-9a5b-4cec-808d-4e10defb3ddc", "comment": "Malware payload (Amadey)", "value": "3a7d2e6e9afea4002aaeba10db3b8957280a81c12a923cd4947cf63bc9cb1c3c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664085, "uuid": "a5ce02bd-2d79-482f-8eb3-26ce957cba49", "comment": "Malware payload (Amadey)", "value": "11fdd458ea0d4fc2d8cb2f910d666b410a7ac4fe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664085, "uuid": "9dfbbac3-2826-4798-90f8-908c60f93c4a", "comment": "Malware payload (Amadey)", "value": "b2e46dde7c2c6d645e01f2742e46a7ce9929bcd52c0656582ce0b2bc000b760343ecc6a3ada61d2031e26f85efcbc956", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664085, "uuid": "e1b4cb06-db62-4868-ae4a-d5c0ea062d8d", "value": "T123449E0163E0AC70E55B0A318E2AC7FD2A6FB8615D657B5E17B5693F1E383A1D23270C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664085, "uuid": "e57b4f26-044b-4b86-b126-78fc94cec747", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664085, "uuid": "c2c5414f-4813-4530-a468-c5933ea53a70", "value": "3072:2X71eNxRkDohCvxxeLhq1amX4zY18Y0gZKD7jj8/M3v/JyvqZ/rPK5qaJSNn:Ew0DoIShqamozY6KkeMJyvM/TdaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680664085, "uuid": "f6232169-db25-42f8-a388-f67586bb3769", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680664085, "uuid": "9cdc6390-0c17-4ac2-b8f2-ea91fabeb385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664085, "uuid": "bd8faf88-bf48-40b9-b754-e858d63ce1ed", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624bb764-d3c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680706734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706734, "uuid": "ae562a86-58d4-4fa3-8da1-604e328c6a5a", "comment": "Malware payload (Formbook)", "value": "bbb2be7e4ae274998d9556dc7a54b3d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706734, "uuid": "8ad24cd2-ea7d-45ab-92ee-44770c30c389", "comment": "Malware payload (Formbook)", "value": "3ab1320757d68dbf0e5eb5d31cf81247952c244bbfbda9466cd83d112efc2c72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706734, "uuid": "840ac62c-6daa-4f56-94a9-a23204926b59", "comment": "Malware payload (Formbook)", "value": "18ab8df1348f235a681ad16fd13967d585c4cd77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706734, "uuid": "f84496d7-d9e8-43d7-93a6-0b4507457e06", "comment": "Malware payload (Formbook)", "value": "102f53f390af6c2feb35d19b26ad9f0d16e44fe3531b9c251a09dcfb6c37087e97e4484fe79223cbb3e343d983729bd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706734, "uuid": "8fa59f3c-a1a8-42a6-8d01-01023c49a15f", "value": "T19B841220B9F8C483F51A9672597497A7ABF1C95014BECB4F2B404F693BA6382A45C373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706734, "uuid": "45a86c70-bb75-4a85-843b-f9ddf476af86", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706734, "uuid": "b396b93d-ec67-469f-bafa-85fd26d71a04", "value": "6144:PYa6LX7Bk3/zn2OFnYWNrlrPqoHQtklllz8p/uNF8rRfThdYIg:PY5XezNYWrPJwGl38pFrJThdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680706734, "uuid": "f0bb6918-0b16-451a-a4e5-b57e75b2b476", "value": 374418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680706734, "uuid": "7f42f0b6-e6ae-4373-8042-f16e4f130273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706734, "uuid": "cdd1587b-db75-48ed-995f-8eaebb739c25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa59cf40-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1680699688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699688, "uuid": "8114663f-4285-445a-ad62-2fd7657c0100", "comment": "Malware payload (STRRAT)", "value": "c701993bb163d4ad586f6fda66b21e50", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699688, "uuid": "9ea0078d-9ec3-434f-ad09-c8c99062c5af", "comment": "Malware payload (STRRAT)", "value": "3c1579368c5938e7bc45f5e33a9ebd0937ade7d5e17a58ec55d3025289228fa9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699688, "uuid": "6c6f7b24-26ab-4471-96a4-b61d15618d3e", "comment": "Malware payload (STRRAT)", "value": "e2353009cfe63b9840e8d90d356347257992894f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699688, "uuid": "c294be11-e7d6-488d-8a7c-8515ab1cc6f1", "comment": "Malware payload (STRRAT)", "value": "a7b0b65e0e9835b8f13939498c39379ccbe5a6f6ffd50c213421bb6cc95238e1616906be32f59b8d3876212ec9af2a05", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699688, "uuid": "cb1064b9-108a-4976-8483-3214b247888a", "value": "T1FF05F6C625743E1E5373E56CC712AE93ED38E71B2C672DC265447E0E6D3A488AD39E20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699688, "uuid": "c35912b8-24db-4b37-808b-8c8d1a3f0fb6", "value": "6144:MQjPK01kioh6Jv58dF/OzJO5I8oPSVcsTb7zdPfH5t+VA0Zat7N9geIKy5HYL0r/:XFxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699688, "uuid": "9f6b0da5-c2f4-485a-a730-9e6129656ec7", "value": 836658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699688, "uuid": "9414b744-c1c3-4048-9c1b-0806d93a64eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699688, "uuid": "67075d7a-21fb-4b65-b7ac-7cda90474de0", "value": "Payment Notification.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d033502-d3c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680707906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707906, "uuid": "4dcab1af-6450-46ec-a854-7f95a2b4938b", "comment": "Malware payload (Formbook)", "value": "52a21d8d4ea296947f167808685a9a03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707906, "uuid": "66cbfed8-ab84-48ea-98d8-84217abb87d9", "comment": "Malware payload (Formbook)", "value": "3c8c96576826bbfe7096f554b988a3fcfb4c70bb0c2161e8ba0bce8e5e7e50d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707906, "uuid": "99ef251d-bc1c-4414-8eff-4c284692bdc6", "comment": "Malware payload (Formbook)", "value": "ce1a52a8b8119c9ceb307e7a44c41da32d25586a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707906, "uuid": "21fb2662-ece2-46da-986a-5a61758e1b05", "comment": "Malware payload (Formbook)", "value": "8e826148268514c5c9969b859ad7f5bbebfaf0420567a9ff16f3edbc07330e7b1cbdc51b95603df49d5745927e83f1f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707906, "uuid": "04459b61-f528-4d88-a3f6-e4f51e055891", "value": "T11F0422B05425F746E17C65B580FA15E112AF083213AF7E9022F92447F1A2C25EED8FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707906, "uuid": "bdf87fef-8832-493b-b0c8-1e6cc4c21789", "value": "3072:EzVlbbNzc+rjP5zIxxqQkMYVrbiC8hPM6kIo8oveJ0SL9H4LbWokTIh8h:SrRz5fiv0Ehkr8ovo0SmVkTIh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680707906, "uuid": "a615a9e1-60dd-4fce-bb5d-ecb893f6aaaf", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680707906, "uuid": "a26727e6-9408-4db5-ac42-3727a6a69a0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707906, "uuid": "37aa43a4-3ff9-4a49-88d4-238e5a426c9c", "value": "3c8c96576826bbfe7096f554b988a3fcfb4c70bb0c2161e8ba0bce8e5e7e50d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e951f284-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680700518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700518, "uuid": "cf562bd8-0f2e-4acb-9cb5-a69f3895c0c3", "comment": "Malware payload (Formbook)", "value": "b88ae2b89cd56a04346dd7647cc28f63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700518, "uuid": "10b42c93-382c-4179-badd-458f21e006e7", "comment": "Malware payload (Formbook)", "value": "3c9cd0210c788796e67b2720b914088d04b85d68fb955dcbffe6927235c84507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700518, "uuid": "171123e3-fb3b-489d-8798-505d0634f636", "comment": "Malware payload (Formbook)", "value": "482580da0757724bf2302e01965c61f126912216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700518, "uuid": "66a3d060-5580-46fc-9e13-c53007b9eaf0", "comment": "Malware payload (Formbook)", "value": "d7adf54682c700f20adb52f1f7b760ab25dccbc78acbe94bc59a8949c9025f0ca8e739a816440a4e905079c910cf22e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700518, "uuid": "ef2a3174-7639-4332-9ad6-917a34b65a2d", "value": "T18184E0C5FA4094B4EC299732263BCC7159937C3D90B81A1D2BCE3E7B3EBB452A41A553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700518, "uuid": "195006b1-708e-4fb2-8ae5-090b0793e623", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700518, "uuid": "110ca1cc-e4a5-4339-b165-ce0f0b5f3603", "value": "6144:jYa6yIh+LVQFxRY4YheAgnnshjo2jBTdhmX9HEKPlO7U+mEDT:jY1h+LVQBY4YkAgnd2jBkk8Q3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700518, "uuid": "2b520096-4802-401f-9a4b-6d08b0778f39", "value": 376987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700518, "uuid": "4b832a04-92b8-4ed4-8f11-81ff4ec420a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700518, "uuid": "db1803f0-7304-431d-8605-182b467803ab", "value": "b88ae2b89cd56a04346dd7647cc28f63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36c6476-d396-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1680688053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688053, "uuid": "75e42518-9429-49ae-a04a-51a51fda2ee5", "comment": "Malware payload (Tofsee)", "value": "960d7cd34b919e2f1938133f204d45b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688053, "uuid": "a2167e09-c565-4e66-8706-70438785817e", "comment": "Malware payload (Tofsee)", "value": "3d01a57112c5134e05ebecb7cf6e5a04f3c978923fb3a544413dfad0ac0cc4aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688053, "uuid": "d4616d24-cd12-47e9-824e-3f9a14c94ca4", "comment": "Malware payload (Tofsee)", "value": "a627fede3c74d7bbbb00008d2544ee455e611803", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688053, "uuid": "fb731672-f91c-4198-a31b-c4bec97084e6", "comment": "Malware payload (Tofsee)", "value": "9c90b70e756781c1fa53b3817c4b53634edcc1cdcbacae3876d1cc47a9bfdb72f395c826247f0bcb3856b7851756f0d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680688053, "uuid": "284bddfb-80c6-414d-b21f-222830abcce5", "value": "T1AA44D022B3D1C832E56A41394821E6F57A3FBCB04B558ADB7784277E1D313E2AE75342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680688053, "uuid": "0c2b8721-8bde-4ec9-bb97-da2229ec4d1d", "value": "d74655147abdbbd28f9cbdc19367e2ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680688053, "uuid": "cb65bde1-0c99-4f6a-bfb5-94b0fee34341", "value": "3072:f1OymRfM7gvVxxk9L0e9ZYPUNPfMo/cBzcm624AWSJVGtj5WlfRB0Xv:dOrRVVbk9Ln9ZsUNPHUB1/rtlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680688053, "uuid": "c4ad7055-960d-4615-b044-2e0e9084f9a3", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680688053, "uuid": "f4fb65e1-b7c6-411e-9dd4-ac98f1a92b54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680688053, "uuid": "1308f665-8cbb-473e-9559-6440435f9d6c", "value": "3d01a57112c5134e05ebecb7cf6e5a04f3c978923fb3a544413dfad0ac0cc4aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a39770-d368-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1680668217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680668217, "uuid": "0625fa42-a76e-4301-995b-ae02b4694fd4", "comment": "Malware payload (Mekotio)", "value": "03f9f4723d3127e8e715566510a69d04", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680668217, "uuid": "bfc384dc-fd2c-4411-8cd9-ceab9a1f92a3", "comment": "Malware payload (Mekotio)", "value": "3d7d08f5d0592b5d2133fa7f2c976cc75ad3f7d93bc8cb8749eca18c0dadfa74", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680668217, "uuid": "26eda7d9-673f-4ff8-b935-c2a2962e8087", "comment": "Malware payload (Mekotio)", "value": "a52f9bbd086fb4c827f244ec33b081d78494c903", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680668217, "uuid": "c0848589-a344-49e4-a59a-9fade550e1f4", "comment": "Malware payload (Mekotio)", "value": "2864926ade42c3358b5d1438f27df721bd45e612d312df3bfa068e208e4270877ff65418befb2da4b42719ba739caf56", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680668217, "uuid": "4b9a9ef6-0994-49b6-8dd4-125f76b8d875", "value": "T1B617D113A282E03FD8ABED327A2AE7D47939BB9016018C4767F41DDC5F796803639257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680668217, "uuid": "7bb928d4-7198-4d03-8a3e-0d8176cf851b", "value": "1a1f490aec7b9e60556b1999b01c1689", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680668217, "uuid": "b2b2c476-5735-4dac-b753-ff551d06a058", "value": "393216:l+wty02fT2m5RtxUoUMhqUWspOiLaRBjFRjzhhVx9R8K2bnsWna/:Y0m5RtxUoUmRLaRf1zhfx9R8JnsWna/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680668217, "uuid": "9e911e77-00a3-4ed9-ad43-41609c56c256", "value": 19091456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680668217, "uuid": "79c4a4e3-d21b-4f99-85d9-4cb1bd2c66e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680668217, "uuid": "7f67bce2-0c1e-4073-a474-7c9163fc8efa", "value": "3d7d08f5d0592b5d2133fa7f2c976cc75ad3f7d93bc8cb8749eca18c0dadfa74.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398d3ea3-d3ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680697217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697217, "uuid": "81319332-e2ee-4a90-852c-bc5766e3a919", "comment": "Malware payload (Formbook)", "value": "b4f63e508c2f7a20c40d74bd1478aa21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697217, "uuid": "dba33cc8-b1d8-4d0f-8c7c-b332c48c8427", "comment": "Malware payload (Formbook)", "value": "3da9fb7836eba199f838a991f8b25e1c5930572a0b3b1935c4d9342020986093", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697217, "uuid": "b5ed3094-a004-41c2-bf7f-224b0a383db6", "comment": "Malware payload (Formbook)", "value": "5b5d738c5bc450fc7101177581328ee9b1006574", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697217, "uuid": "5a819659-eff0-4c0a-9ac8-ced08d00f70c", "comment": "Malware payload (Formbook)", "value": "e14e385d1299862e604f16f15cab496730f6731bed1b52fce60942791bd3b73171416d5a76026c62dd1fb93c7556c72e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697217, "uuid": "71233525-52da-4a49-a9fe-c09a4fafb31a", "value": "T16404234347CAE6E8F727157536599FFC40C725BC31A8E45E7C38AA201FBE1DD90A8A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697217, "uuid": "e07ea229-3977-426d-b507-908565a7327b", "value": "3072:+v2nYDcl5S857LjTJ/fuDiRDBW/0CmoWEkpQ1H6SlmJwRE/RYyvzAyFKMgDh1G:+eYDlQLjTJeORDBGB1aAmJwREVbA2f+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680697217, "uuid": "15cb6dda-e7d7-4bb3-a6bf-8a8604493b4c", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680697217, "uuid": "3fd427fb-77ab-4361-9994-226062cc3496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697217, "uuid": "b9b06fc7-de42-47eb-885f-2dc4db182293", "value": "3da9fb7836eba199f838a991f8b25e1c5930572a0b3b1935c4d9342020986093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950c750b-d3aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Grandoreiro)", "timestamp": 1680696511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696511, "uuid": "4d6ba093-db67-489a-aa90-aac640a665ee", "comment": "Malware payload (Grandoreiro)", "value": "f8e3482185e2c916fc032786e676d320", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696511, "uuid": "f1e799a5-95f8-4d59-ac23-0fcb927c8318", "comment": "Malware payload (Grandoreiro)", "value": "3e033ac5385c7a77ef87090674c19061d8fce08a48d451d78a03d32eda516243", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696511, "uuid": "741affd8-a142-4a51-b7ce-d801f61213a0", "comment": "Malware payload (Grandoreiro)", "value": "f605b599179349ec50919c521191daf718a587c8", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696511, "uuid": "5653e0b5-8198-4189-9be0-288669790ee4", "comment": "Malware payload (Grandoreiro)", "value": "d2c2dda0382b3c9adcaa7523c4a0bcc2e0b03d9e684ba85a141b543abea9d3b7db119bfd93c3db2a7e1b163d331384cd", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696511, "uuid": "88d548f4-383b-4ca2-a634-d33c710b6c5f", "value": "T14DE58D23B385A53EC0AF1635596BF725993B7AA067228CCB57F4085CCE755C02F3AA43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696511, "uuid": "8e93fddc-55c3-484e-867e-09f7b8983ea4", "value": "49152:LoYafBZfn6JDi5FQ5dtSdgIH/5roi5VzQ78r6F5mCmR+CYuNA:YfPf/BoEzMo6cYIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696511, "uuid": "e32da8f9-bbe1-4776-830c-a39fd9f71fcf", "value": 3157504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696511, "uuid": "a49b7818-2d09-49dd-89ae-7de64986acc9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696511, "uuid": "f5d8b347-c8ee-4e1d-9523-d16eadc4d8b6", "value": "Archivo.EndesaFactur-A4-SIMPLEX-TLLK_B23032023E294942222422244454.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264fdce4-d3d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1680716082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680716082, "uuid": "c9ef9ad1-e80a-48e8-95b2-6f3fba0d9f3c", "comment": "Malware payload (Quakbot)", "value": "dfc1983c3e7a041ba251b2310b6d1524", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama248", "colour": "#1B2A52", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680716082, "uuid": "71bcd2e6-3862-4c44-b000-66dbb949e96b", "comment": "Malware payload (Quakbot)", "value": "3e13e46159b545b37b47bddbbda467ee5269d88df981d47617bee1646e0adba4", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama248", "colour": "#1B2A52", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680716082, "uuid": "8c60de7d-ea99-40d1-a739-07ce10b8d9a4", "comment": "Malware payload (Quakbot)", "value": "0988905bc960607608a0cbe3c8d5624735175392", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama248", "colour": "#1B2A52", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680716082, "uuid": "475877ce-8da0-42bb-bce5-a14ce6247f05", "comment": "Malware payload (Quakbot)", "value": "5de44500d9fc160b35d84d879ea55ed49186c2f190d1b09c452b14e5e7eaffba556b09b68ec536efbb2634e176d26b83", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama248", "colour": "#1B2A52", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680716082, "uuid": "5865c790-cf28-4623-9475-d17332096af3", "value": "T190D44A1F9FDE3C658FB7E88978DD8BEA120E37CF04750285220E6C0E476A85E14DA59D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680716082, "uuid": "80402d1e-0b29-42e0-8e46-51a77b0881c4", "value": "12288:izoY8doM8oIOgG8O680zoY8doM8oIOgG8O68t:KUgd28Ugd2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680716082, "uuid": "2d1305c5-7af1-4200-bf1d-19f0790a1142", "value": 647985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680716082, "uuid": "59492771-a743-406b-b49b-b86aa44cfd39", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680716082, "uuid": "0dc51dc8-b37b-4c27-b592-37313d64b6cb", "value": "StatusUpdate 331708 Apr 4.xhtml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda9b715-d3c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1680709491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709491, "uuid": "00dcbbae-2a21-4c98-b23e-49e6a05126f4", "comment": "Malware payload (DarkCloud)", "value": "3c4527dc61da9a0c8c17b3177e634a9f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709491, "uuid": "09d8a8de-ff10-4f37-85d8-160d027fc204", "comment": "Malware payload (DarkCloud)", "value": "3ebff29a9b26f2a968315a7aada1b6aa885afd56a0d8d54e5875371c42dd3520", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709491, "uuid": "6e4ee825-e578-4963-9394-75002208b70f", "comment": "Malware payload (DarkCloud)", "value": "00c55d38943818dcdc9242a5fe2cfec977d2c411", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709491, "uuid": "1f0011d4-0aae-47fe-aa4f-eac8b8e2087c", "comment": "Malware payload (DarkCloud)", "value": "22c8dd6d157aa82c67cdd4160f1563a71f3b5c2aea5ea3dd17dba2a0e7c9f3393f017afb65860532ebdc732b8e7287d2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709491, "uuid": "e67481cc-df66-43cb-9aef-f4dc9aad9d0f", "value": "T154A43A2AE710F02AF897C8797B919257A81AAD731140A82FF7919F8935316D3D0F136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709491, "uuid": "38cf8a1e-7faa-4fe9-b640-b2d990351d4c", "value": "ab1f67286790bad81d99cb0480169060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709491, "uuid": "efbe836e-6aad-49cd-ac15-09dbe9434300", "value": "12288:W8wFE98FsRkv/ta/GkcenDbGI4ovU6zKjkuQjYKkJj6GmZU:lHbw6zKjFGYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680709491, "uuid": "b3ada87d-8698-4482-a0f5-8cae98cd714c", "value": 484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680709491, "uuid": "b05d4221-bd65-4d5c-89d9-d4d03f22de47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709491, "uuid": "b2cbb0d6-752f-4af0-9905-75dd0721aa33", "value": "3ebff29a9b26f2a968315a7aada1b6aa885afd56a0d8d54e5875371c42dd3520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e58ba1-d3df-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680719405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719405, "uuid": "0bd1c9fc-b5b5-43d9-8881-30d7a9e3c9bc", "comment": "Malware payload (SnakeKeylogger)", "value": "6f1a4a40506b59bf5577f1325c9c2572", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719405, "uuid": "04c00469-baac-4d9c-9643-c2bf7b8ecf4f", "comment": "Malware payload (SnakeKeylogger)", "value": "4018954cd403dd6290586606332d069967bb4bad1302bf071475d94423aaaa1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719405, "uuid": "1be46186-e0f0-43dd-a0cf-f928eb6b729b", "comment": "Malware payload (SnakeKeylogger)", "value": "f35ef390beba20453fadbe044c6152d5a0a5ecf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719405, "uuid": "c5fd190c-f31f-47ae-bb79-410c14d9770f", "comment": "Malware payload (SnakeKeylogger)", "value": "5b4e38d6622e6c38103f01424d8bf1751afda12a34050b7ea981b882fcab934fe6b86e7b5d492c0cd0798229acf21cf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719405, "uuid": "e009afd9-368a-46f0-8343-7d0f106afc4d", "value": "T1E1C47C7D59BC1B36D03BDBB58BA44810BBD4E97FB211CD2978D7018906269C234E3A7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719405, "uuid": "44482d92-e78a-41da-bb00-7924d434799b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719405, "uuid": "eb95b2bc-20dd-499a-96d0-0f1c3668cd0b", "value": "12288:aVBlzDnnFyUxO80hj41j4c147PEQyZ4XPYR1+:aVBFnFHxO9EJyPZYR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719405, "uuid": "e5301435-c877-48f2-95cd-44b2c9250b15", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719405, "uuid": "07c93b36-3e45-4722-beab-879eb6b65045", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719405, "uuid": "0ea81fad-3413-4288-b389-8440eb32fde8", "value": "Pending invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24b030f-d3e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680721525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721525, "uuid": "199fc895-7f22-46c6-839e-b198720f3096", "comment": "Malware payload (RedLineStealer)", "value": "33771c983b3540e90e8ff62c44be6135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721525, "uuid": "f23ed20b-8da3-40cf-aec8-a0fdf6381435", "comment": "Malware payload (RedLineStealer)", "value": "4206cf0f3c13f1532beb4458ddbc5f8422e2892b21e64ffa140c87525ad0eaf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721525, "uuid": "90e152a7-e0a5-4259-a7cf-5e9698f849fa", "comment": "Malware payload (RedLineStealer)", "value": "829536ef1b85fae82126422ef47177e996f68f00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721525, "uuid": "79acaddd-e7f5-466c-a4e9-9cdfe3653409", "comment": "Malware payload (RedLineStealer)", "value": "46b7f27eec11cb0e0b3b71eac76648eb32ea9a7bfb5bb7b51ac71b7c791b3dc8a64e81f7775f8080127d2b7bb76a424c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721525, "uuid": "5c499b7b-90e1-4a48-bc08-25ab86595360", "value": "T196051216B6F90072D9B82FB0C9F601930B3B7CB2C978937B2B56A55E08736849172777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721525, "uuid": "b3d036e1-a0e8-4e14-ba95-f147250f3f44", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721525, "uuid": "c302fb0e-dd82-4dbe-8ef6-460f344b68e8", "value": "12288:UMrMy901OoFekW/IMMTImyDWdb2Ng2gfwYuQ3OpgGVq138vkDOvq:QyaO6mMTImyqRDFwgDG0OkDOvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680721525, "uuid": "6c5c6686-3c1d-454c-8a8a-8c6d0829f1b7", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680721525, "uuid": "9bb1e0f7-ab16-4965-9882-0f0d42fe525b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721525, "uuid": "6e530a1c-f41b-48e0-b7ee-0df5a6649bdd", "value": "33771c983b3540e90e8ff62c44be6135.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02cd514-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680700530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700530, "uuid": "0829213e-114e-41d9-bac8-cae92bba6567", "comment": "Malware payload (Formbook)", "value": "07267fb4371d348b4acecd5ebfab5d48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700530, "uuid": "96e43afc-e4c9-4fe1-abeb-5b4a3e1610a5", "comment": "Malware payload (Formbook)", "value": "441b9e71d315dbc21471e1c3cf9824c4303ba40effa313c89345f399cf28cda2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700530, "uuid": "e9bc6086-dfe2-45e2-87c7-53682f897782", "comment": "Malware payload (Formbook)", "value": "53bd5d2a9e2426bdb10608c07ae0816dcbb819c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700530, "uuid": "520b1f17-2008-4413-b033-4e27ecd17737", "comment": "Malware payload (Formbook)", "value": "62258503fc026a3e93225dd2f1eeb6c9b34a076126dc15146ca9c6b59c217f0a6a7290548bc17f7c81af40b4fe2ae9fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700530, "uuid": "272f5e39-7587-4a2d-8686-735a0224bef1", "value": "T1DC54120812D8D8F7F46F16B11F7F8A7ABDD5A92700259A0B03605AAC36777429E0F792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700530, "uuid": "cb7960ea-3db7-4731-a6a5-87e068312717", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700530, "uuid": "95db1d31-5333-4377-bda0-227bdca04e62", "value": "6144:PYa6E1fCKW2rYT4SL+03K09Yeus7s6Zijbz2ZOIKQJmCHRq8PCXpe:PYKUKW2rYT4SLRaF6Z5ZONWxqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700530, "uuid": "01e99db0-e285-4027-bf09-62ce9f180e97", "value": 296831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700530, "uuid": "198a7f12-9375-42ad-b0a4-b9f89901c2c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700530, "uuid": "8639d83a-bbd2-40dd-a1eb-c6ae341db24e", "value": "07267fb4371d348b4acecd5ebfab5d48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418c9ce1-d3ed-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680725147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680725147, "uuid": "8225f6eb-20a4-4101-846a-6984220ec355", "comment": "Malware payload", "value": "37d4cb1dbd600b7023364682f0f1382a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680725147, "uuid": "ffbd6f9f-0e63-408a-8272-cecf8dd1dfe0", "comment": "Malware payload", "value": "46964354653f48cedd5944c50402e6fd397fce383c23aac85e9d194a1024e0ee", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680725147, "uuid": "8537a4ac-8012-4071-8c4c-9e0ec4e4745d", "comment": "Malware payload", "value": "6a7d60069bf8199532b59ea94821ff7b243b4ad6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680725147, "uuid": "c83b1621-be03-4b62-be1c-188e1b7eb71f", "comment": "Malware payload", "value": "f1cfcd75caa5a2bab471f862c934d18066970996be9752db4b4600ef1b5794af106b25a10687525b41dedad8b9409360", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680725147, "uuid": "c5837c31-9a48-4f6a-b7f7-55bfae553e5c", "value": "T138B3C8A7F3D5233619D303B5660F65DBB62A8434936D8B3064EED02D338A09D867B7E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680725147, "uuid": "ab6ee527-f011-4c21-9911-fcc248f699de", "value": "3072:CV/KjQ4mjJVbsgDAegKUqGTIIPdI7N+AnaYKFCYliCFCj:zQVAwSPq7jIQv6vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680725147, "uuid": "9bb10013-418f-46bc-83da-3e87a2c4e10b", "value": 117206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680725147, "uuid": "b7d5c5da-3655-460a-846d-45d76a69da56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680725147, "uuid": "ccbefe02-69c1-4547-97f7-12ae673842cf", "value": "Notice_5_apr.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac854eb3-d35f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680664338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664338, "uuid": "4b06fd47-9f34-4e9e-b886-5adb70c75447", "comment": "Malware payload (Stop)", "value": "de84291fff030357e25ee26a55d184f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664338, "uuid": "5d7ea552-b8d9-4faa-aa3a-d7fb465531ec", "comment": "Malware payload (Stop)", "value": "476fef34e6b6d47c1cac40b5760e5606e21bf72c112093a269a61339da5e98fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664338, "uuid": "6a3bd39c-b726-4724-b536-02e2fe2c5191", "comment": "Malware payload (Stop)", "value": "72fddd0c423b7550fe5d257a225fde31f359adf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664338, "uuid": "0aa0b8b6-3116-4509-92d0-fb9b34c59f87", "comment": "Malware payload (Stop)", "value": "3b5e5e4733b14f3a1ed684d93ed380cde5e7a220caa41dddc89a4eabec233128fda63bdebdcd7c036212932e64267665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664338, "uuid": "5e5bc13b-6365-4d8a-92e6-bf6864a682b9", "value": "T14BF4020063E0A471E1AB1B328D1AC3FD2F2FB8A19D557EAE17A5493F1A343A1D17271D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664338, "uuid": "185680d8-c126-4ea3-9b68-6d2ae116a764", "value": "347f2e8ea0dc4c8c2fb93a44134e1752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664338, "uuid": "d5b45f8c-1ade-4274-b3e4-2c5241564d62", "value": "12288:2YfXrl/ZhUsDemjuUafGQrNj4Ifu22quaHnAGl96bYtdrrBWhzy+lZv:2mXZZasDUNjIaH/9IarBWJRlZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680664338, "uuid": "d785a593-c800-4cb9-83ca-baf8a6063ce9", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680664338, "uuid": "bfe18a39-e94b-4bb9-9e9e-0aabdb9f388e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664338, "uuid": "122895c8-6ff9-4488-b868-d539fc4831f1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b5b027-d3d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1680716236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680716236, "uuid": "30550b11-d1ea-4487-89ac-4b84bef18e61", "comment": "Malware payload (Quakbot)", "value": "d0a338ff4f216fc647281eb49f08628a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama248", "colour": "#1B2A52", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680716236, "uuid": "efd2b877-f426-4c3e-bfad-6781ff5f4df6", "comment": "Malware payload (Quakbot)", "value": "483d45f68e449c607129770a374a718dff4bad42a314c4424d91d5d2ea9c3430", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama248", "colour": "#1B2A52", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680716236, "uuid": "afcdb060-d1a1-40fb-a810-7985f05439e7", "comment": "Malware payload (Quakbot)", "value": "59569dfd57245fe2132364d690aca1ed7f2dcba4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama248", "colour": "#1B2A52", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680716236, "uuid": "dd32618c-9540-438e-ba4b-91a5c3d54c2c", "comment": "Malware payload (Quakbot)", "value": "b2bb8d33a799aaa9ee82eed7433259071bfb74a7b9ceb3b4517406bdd3b7a0f6cc9bdcea12eaf52e0966cb89b00bf0aa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama248", "colour": "#1B2A52", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680716236, "uuid": "a7e8cb78-46fd-42b3-bbcb-3e1523d3f275", "value": "T15144CF43BBC1C475E4C701BF167D93F60E365A2C97A7DAE79FC45590C8262C0B23A68A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680716236, "uuid": "524ddd96-91ae-44d8-b768-4ea3513869c7", "value": "6773aa39021b4b6dbb81de5fec9e5772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680716236, "uuid": "00465d2e-646d-43e0-9611-d6ceb9d680b6", "value": "6144:Ie73XJK8VCoxyusKqXk3gykDeTyFdchqbhIf:pJJCjKzQCyEMbhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680716236, "uuid": "f4d424f5-5a87-4f64-b882-b450b1bb4bb1", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680716236, "uuid": "5a8b5aea-c8fc-481d-8a70-6e954dfa27f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680716236, "uuid": "fb4c1eee-2aa3-4787-b267-d0f749cbcdcb", "value": "vodka.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e585e79-d3c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680709197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709197, "uuid": "00286175-d3dc-4e4f-8b64-7f3907d673cc", "comment": "Malware payload (AsyncRAT)", "value": "a56b90c7d675437506bebeb2dd2269ee", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709197, "uuid": "958500de-d67c-4f47-a928-08a3839cdccd", "comment": "Malware payload (AsyncRAT)", "value": "494e1115bfbb0cadf7ac1e0e3d5813c36c0e2e829f8246a7856b34e9b2d100de", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709197, "uuid": "98961887-80a4-4add-a718-0ab082475ba8", "comment": "Malware payload (AsyncRAT)", "value": "eb09006e6ff9fb3c69beb5ef7e2a07915ef877de", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709197, "uuid": "7aa7bb3a-7b9a-43af-b837-d7611e2b23f8", "comment": "Malware payload (AsyncRAT)", "value": "acaed7624ac6da70e3cf6e75815277278527903360ec11bed396ba181677fc1269ef4573987610a6d18b9d5d0445d991", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709197, "uuid": "60542fb2-30fe-45ea-9572-648b5dd7c02f", "value": "T1C8D4F142F6D648B2E5731A364939BB11A47D7D301E34DA1FA3D87D289E321D2A131FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709197, "uuid": "52924bc2-858f-4509-9c35-993ed177a07e", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709197, "uuid": "01b34e25-d087-4228-8051-938666c3d424", "value": "12288:NcrNS33L10QdrXjcDnNxchou77AnooV1wOFePfVAhy0NnYOyyzDzjj1en:wNA3R5drXoDNCAnooRFKfVKyo6C3ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680709197, "uuid": "0b00d933-1f56-4c64-a677-9a2de0d2dace", "value": 653340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680709197, "uuid": "e05465a4-a0d1-4354-8341-47e9b04623d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709197, "uuid": "d915eaa8-fcef-4770-8bf1-282584e5c9f4", "value": "494e1115bfbb0cadf7ac1e0e3d5813c36c0e2e829f8246a7856b34e9b2d100de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63578201-d3c1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680706306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706306, "uuid": "56f48925-576c-46c5-88dc-958300d7507d", "comment": "Malware payload", "value": "ef70b2b12d40d6c0bfa9523e912b904c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706306, "uuid": "5bbbdc2d-3c6b-4d26-9553-a1d9786922f1", "comment": "Malware payload", "value": "497406ab6755bb8957d596106d07297e3ec7000c5ae5de0b11e7dae6ae6b66fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706306, "uuid": "95984a29-4bd8-4c45-b072-772d5936b6d2", "comment": "Malware payload", "value": "ea8373ab3166b04408378ceb1f085671a5ee2f69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706306, "uuid": "f0eb3bdf-74f2-4139-9747-6defa1d70101", "comment": "Malware payload", "value": "077a71498148e159c38965b5015bd7a4b82c1eedee8feabf7b76d61dfdda8e5cacd8a2298650e9dea5a9ceb035339f6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706306, "uuid": "781fd95a-bbd0-4641-80f9-688566c61a4b", "value": "T197C4126CB3B46663CE5C46BBD41B220503F195365A93FBC1CCC2BBEA19C7F9849015AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706306, "uuid": "3c4963d3-5941-4107-a08c-20ccff86487d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706306, "uuid": "ada3e03b-1994-4a1e-9e81-9ae5d8d0c6d4", "value": "12288:ivSS1Vm5CKw/7keE4ay5vusGk/2hoRFT1kh:0VmNQke59mO8EOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680706306, "uuid": "ed88c80c-810d-4beb-82de-3b6bb058f429", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680706306, "uuid": "b62df99e-e014-4507-bf83-6e9a18edeaf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706306, "uuid": "f49cec8c-a8ac-4aa9-b715-6b7376cd8a62", "value": "ef70b2b12d40d6c0bfa9523e912b904c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f936e7-d3df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680719409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719409, "uuid": "90937d83-8c17-4829-8651-332ebbc6b951", "comment": "Malware payload (Smoke Loader)", "value": "ce8ca395273eb15f0afa0252e325abea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719409, "uuid": "29118eb2-e93e-42a1-8996-0ad9217afb4c", "comment": "Malware payload (Smoke Loader)", "value": "4c9367e9e7fa7992c5aad7d16ac8f4f8c8cc8eb7478881cfaa0acfd3f39a2a52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719409, "uuid": "a229cb9b-c46b-474f-9eb7-d605978e73f0", "comment": "Malware payload (Smoke Loader)", "value": "ea3fa23ca8cf570f22a0f19a2d5b183b5a958e3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719409, "uuid": "e406b11f-ce36-4bbe-895a-941758f1bfb2", "comment": "Malware payload (Smoke Loader)", "value": "21e4119926fc0cca41be34caf847a3b118760940dc7ab3ebc12121a597c7aa5d94be800625a396355c661b924f84ed65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719409, "uuid": "80bfd4eb-50b4-4542-94e0-d193e577ecf1", "value": "T12FA45B7D49BD1A36D13BDBB58BE44810BAE4A57FB211CD3979D30089062B9C235E363E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719409, "uuid": "d1026f1e-53e0-40a4-881c-3810b4b6d463", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719409, "uuid": "9da7ab45-0c74-40e5-9805-dd70a56d337e", "value": "12288:DuBSzDnnFylRI0WBL7XtBDgkBGGdF08h:DuBonFaRdWVbtPdS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719409, "uuid": "cce37a93-e3f5-494f-9b67-b14d5d50a9f1", "value": 484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719409, "uuid": "4be2d01d-9784-433e-b8ab-d3788cfff859", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719409, "uuid": "8f017adf-9ef6-4399-b34c-a3a966d602f5", "value": "ce8ca395273eb15f0afa0252e325abea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37748aef-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680718258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718258, "uuid": "5f1dfb12-bcae-4c7b-8a3e-2d499f1d9e9d", "comment": "Malware payload (GuLoader)", "value": "f3aebf1b8b072945e1083cbdbc762bf0", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718258, "uuid": "390e414a-c1f7-4446-8855-3556e61a3bc0", "comment": "Malware payload (GuLoader)", "value": "4cd8f168d08082de5c2e3c7e3ec9ac771707abdbd9816c201c9d7d21ec0c4cdc", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718258, "uuid": "fbe472cf-0b8f-4081-bba0-9006db48c5ac", "comment": "Malware payload (GuLoader)", "value": "30f06f96ab85a125c06b1a483d91fdafcc4e68cb", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718258, "uuid": "94bf77e7-28aa-4cf2-8f6f-012937573b22", "comment": "Malware payload (GuLoader)", "value": "16c74d6dda5a4973efcb24aad0f2d0aa67fc6f360cccea71d362efdcd32d355a270f570962de4605df4efb0f70b534f1", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718258, "uuid": "77d87e6b-ca85-457b-8b3c-6f3a05b2068b", "value": "T15054238CC925F42BC855C5B99CA68B45CCE337A31D00C2F21005A686F0FD6D7FA6A79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718258, "uuid": "c187f51f-fa23-43dd-8be3-a7ea3eb7e90c", "value": "6144:zZpU/QBAhOZ/dbkvfnl6PPVSbPOyMJpHPAxGYTUUG2:zZO4kabkvPl6P9Sb2pvAdTxG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718258, "uuid": "ae4eeca3-7b10-44dc-80d8-8a3fa5401b73", "value": 304785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718258, "uuid": "efeca958-4b81-42c4-85cc-d27bd1324244", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718258, "uuid": "97365a60-a89c-43e4-9119-82e66c65ac0b", "value": "Scan00000083432233.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c1b90c-d3fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680731594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680731594, "uuid": "f44a9b14-5e0e-4755-9d57-1a59ed77b872", "comment": "Malware payload (AgentTesla)", "value": "2b99589abe119120bf1d3f5b5de18cb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680731594, "uuid": "67ded566-a288-46cb-bc89-8f7634319782", "comment": "Malware payload (AgentTesla)", "value": "4d291bfa70ef6f4d962f4c0442a4d0f822461cf0cb4ee3303005e7f37529f4f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680731594, "uuid": "b4cf4b62-97a8-4179-aacc-526aabf6ae9d", "comment": "Malware payload (AgentTesla)", "value": "ffcb86b04d777a17b01632c99f89986ba2750cd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680731594, "uuid": "23a236ae-4ed7-47d3-ad62-48e7f7ebcae1", "comment": "Malware payload (AgentTesla)", "value": "54036f55792e6f10434bf26b86f5a3a2f5c7c3690fb541670d5ee195ebe59b9c67e6897301597c8a742b744d07de4922", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680731594, "uuid": "95914b39-bc38-463b-b4d5-acbcb6f6cfbd", "value": "T19A85C0721BEBFDDBD7FD0E74E45631D46CEC686B536C929835C80ACA58E6B508C218B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680731594, "uuid": "0e0e5bff-3e47-402c-abd6-1d25077fddad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680731594, "uuid": "d5f8981a-6a08-4ae5-a2db-fd2c162cffa3", "value": "24576:saT0IbmQbB/h1ea4xHt2eSkJ5u2eywz/z5uiMbh95u9O9v+tNP/Ta+gKdiUn4c:uIaQbBXMN5SkYIiD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680731594, "uuid": "a6aefa05-c004-46dc-8c96-be5950b88496", "value": 1863168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680731594, "uuid": "f1898a66-f0dc-4ed2-9472-c746612d9868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680731594, "uuid": "8becda95-6fef-4047-839b-839cb4f84ba6", "value": "Bill of Lading-invoices-packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93e3a92-d3c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680708625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708625, "uuid": "a64a3d75-276f-4d35-ab99-7361fbf12153", "comment": "Malware payload (RedLineStealer)", "value": "cf074e73018de19667ec651132d5142c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708625, "uuid": "83b4f8e8-d47d-4556-ac6f-2a4fcef50186", "comment": "Malware payload (RedLineStealer)", "value": "4da66c4261c74240b5c6614b77c1a03713b041b657ca01681fba4938657022ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708625, "uuid": "32bd6413-e00e-4123-b3c8-afd6d0c0a82d", "comment": "Malware payload (RedLineStealer)", "value": "320b8fe63ca5b995ce50953d9e2327f2cb6bdd05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708625, "uuid": "31652ab6-cc2a-42c0-8d30-51a6cd2f4128", "comment": "Malware payload (RedLineStealer)", "value": "eb6bfa06c2348b45bf6e48aa7f8bd5a4557a3ce3e56b658a90d3aa3b426f1dff5762000cf7df4c09ca4b88d2eed0c024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680708625, "uuid": "5397900b-25ce-4abe-a2c7-4d171bcd52f0", "value": "T16C05231FB6C82077D8B527B42CF611830B36BC969E34423E378A784B5C72695A1717BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680708625, "uuid": "63e0aa93-a27f-4662-963d-3b259fdef4a8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680708625, "uuid": "bfcd0fd6-6942-4b16-b440-3786d3fc1073", "value": "12288:nMr2y90WDsHkepQm59JwVXcWq/Ii+p0wmdEcpOIBfa2IQzdANm2M:hyVjI9JwlcWq/mFpKOIha2Hzdwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680708625, "uuid": "cce0078e-00df-4f83-b6ce-8f06bfb7a49e", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680708625, "uuid": "02714bbe-20ad-4b95-b53a-f08554dac072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680708625, "uuid": "36ddcae4-f8b2-4242-b92e-66e862e0fb06", "value": "cf074e73018de19667ec651132d5142c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5f74e1-d38b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680683318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680683318, "uuid": "b4b4c228-4d18-4a1d-a537-ba6ec43326f3", "comment": "Malware payload", "value": "c470d03d2dc4b42d295bcbcbb5d3f577", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680683318, "uuid": "075473f6-029b-448a-a09c-95c0a3919306", "comment": "Malware payload", "value": "4e86830398233776a4e85bdfb37eba2602ef568f641a80273413508d43db1272", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680683318, "uuid": "5238b0fe-f1a9-4137-bd15-3584b0ea0fb0", "comment": "Malware payload", "value": "8c7cfa3b390cb117a66460de2e36533072e5fc0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680683318, "uuid": "696ea0b2-97f6-474e-a403-20e372b4a2c0", "comment": "Malware payload", "value": "67b1958aab7ffd741b480223d51b5eb0c9c06680104b17e3624f9506524fa73e66457bd7b434356e1f8837bbfbea82c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680683318, "uuid": "4575008f-3e47-491b-a584-2389f104dd89", "value": "T14123D1ABD33E4624E85EDB385C03D51B16B2A854AF17802F3748667605803BC677AE7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680683318, "uuid": "e43050e3-70c2-4c60-bb9d-145835512fd5", "value": "768:AFTaLRR8TQk1ILL7JtBw8/r4Qc1H39zDoqD7C0Je6gdhdj7hzFanV0pIsI/:GTqRRWkFtOTQqHBDoqq0oPF76nM9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680683318, "uuid": "4fabf0a2-8e13-4ec2-8fe5-10724c48f4f0", "value": 47983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680683318, "uuid": "604fb9c4-a31a-48c8-bcce-60a4e4cb6c66", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680683318, "uuid": "bc065356-2e51-4b37-a46d-e518c8a9535c", "value": "SecuriteInfo.com.Trojan.Generic.31952689.13906.30781", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6652ed8-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1680700540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700540, "uuid": "b3dcabc4-6e04-4883-8912-f3e717289c29", "comment": "Malware payload (Fabookie)", "value": "8cb1aab16a61fae45dc58e58f26224e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700540, "uuid": "41217377-0b5e-496f-adbd-60268d78062b", "comment": "Malware payload (Fabookie)", "value": "4ec2e908cb0ec7053e456e6f1c1223a24979f7c0628798ffe22d8c8c575031f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700540, "uuid": "4456cbc2-59f1-476b-b920-eb71a2e7739b", "comment": "Malware payload (Fabookie)", "value": "ac21edbbf16f053d5aab864df03cdf7b273e4551", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700540, "uuid": "ed3ac270-5b66-4a7e-80a1-824dd39657f5", "comment": "Malware payload (Fabookie)", "value": "d411b33d507e4973d97f9fb6c9b3b5ea9c37bd4414773a83a55db5f05175c0fa31db22cc5828520c79bd5110ce193a29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700540, "uuid": "ef019250-9cb0-4fe7-be8f-073debb35e01", "value": "T18954AF4A739611FAE0768234C8665A01E37278391F22D75FAA6432377F233909D3BB75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700540, "uuid": "e4f63dcb-b0a4-4309-9497-a6d91b4afcb0", "value": "ac95dacb2904d888e6ef077884b26ac7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700540, "uuid": "e0f024f4-b845-4ce6-82bb-d1b2229d550b", "value": "6144:qYwUqOWBsx0napCxjg1gSYA/Ui+2rgMCL:XwW3RpCjCcixWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700540, "uuid": "76d9c6e9-54b2-4af0-9e7c-5a1864d31748", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700540, "uuid": "1895fe87-b08a-4d59-97dc-24757fe2cc4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700540, "uuid": "ab735001-92f0-47d0-bc52-2e1c14986e59", "value": "8cb1aab16a61fae45dc58e58f26224e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c1dbe5-d3ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680696757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696757, "uuid": "8ebe3d05-4cb8-4a2f-950b-bf52a3b12fa3", "comment": "Malware payload (RecordBreaker)", "value": "ab5f62b13d5214d433749f2bc6a5f4d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696757, "uuid": "5e375db6-eb68-4407-920a-baf34ad8578e", "comment": "Malware payload (RecordBreaker)", "value": "50aa6bbce02f52f4550e3bf63aa7aafc440daa558e9fce976c89e7aa8904efee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696757, "uuid": "9ccbd7fc-80db-49a8-9986-27ac16f341bf", "comment": "Malware payload (RecordBreaker)", "value": "aa6a312eb35f9dc8f39f11f7762bf4ff104bbec6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696757, "uuid": "dbfa2b12-4c98-4905-b53c-470757c22cfc", "comment": "Malware payload (RecordBreaker)", "value": "15ac13a64d8bd2bd745c7e0b91fcd8ecd8ab63c94446d26c0c2e4f018264af562e56b620308d113b62287238735662f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696757, "uuid": "3c7997ec-2c7d-491b-baec-f0a7a73f6246", "value": "T14EE633376BA82594F894C87C9522FF9571F66F0B9A81E0743EE5B9C82C33699DE03503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696757, "uuid": "da7c5a2a-d24f-483b-b8fd-303fba6c9b19", "value": "619ea37bdfbff7e675af72540c0fc653", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696757, "uuid": "c125e8f3-96c1-47a1-ad23-dcbdf94e0d08", "value": "196608:5abaAlF5haRlbr4NaBRa/aBeOA65J+lUdPf1LKkrdjw3m7cCiwJMrs+Bc:5ab/Uln4NaBsvo+lgf9dckPiyMoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696757, "uuid": "055146c5-55f0-426a-96eb-c6042adc06bf", "value": 14349312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696757, "uuid": "08f0ff3f-df70-4265-a951-cd18fb9c86ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696757, "uuid": "3faeb270-6792-4631-8dfc-e3fbcd019c85", "value": "50aa6bbce02f52f4550e3bf63aa7aafc440daa558e9fce976c89e7aa8904efee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24974fd4-d3aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680696323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696323, "uuid": "bccfabfc-3fa6-4bf0-9f86-abbc52b28a18", "comment": "Malware payload (RedLineStealer)", "value": "d801967d672e091cbac773b793eac4e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696323, "uuid": "1f9006c5-668e-479f-b048-7fb7dfb348d0", "comment": "Malware payload (RedLineStealer)", "value": "50c7b08ce78d3693fe5685b3db4643014b47a33ea8fe44511163b961669d2fb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696323, "uuid": "e2b4a324-23b0-4de0-85f3-c584cdf52f94", "comment": "Malware payload (RedLineStealer)", "value": "4527534abc52ec6ab16b16093a65bc6bd6fd2460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696323, "uuid": "0e6d52b9-a7f2-46f3-be39-9a1fb7196309", "comment": "Malware payload (RedLineStealer)", "value": "19da8653030c2d4939aefcf0fd59ab73f1dcb532ab6f3f5590a98b07781a516ffc732d2832029a2da816bf70d06f104c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696323, "uuid": "a1073d83-1068-46e0-ada5-aa1c97a0d401", "value": "T161051202F7CC8032DDB417B00DF612C70A35BEA2AD7457A767586A9D18B36C9A93137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696323, "uuid": "a9d5fbb3-aa34-47a0-bde7-7d068d2be9da", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696323, "uuid": "711a1a3b-0968-48f9-93f5-590ead7a0390", "value": "12288:qMrLy90dwSggM/UHxXHa2XdDDR6p1Ec+6JzzZ6jBfJWyt1Yz7237S4csQvgx9d6a:9yIwJA60S1E16RzZ6jBdmf237DY49XB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696323, "uuid": "39355dda-a9b3-4599-9952-9652a808af2a", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696323, "uuid": "94177adc-ec2d-44c0-be50-fd16aaa4bc5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696323, "uuid": "89b78f40-3878-42d1-938f-354abe6eaead", "value": "d801967d672e091cbac773b793eac4e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1562d84-d378-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680675057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675057, "uuid": "e11577b8-68e4-448f-ab99-b11c0a30c4e0", "comment": "Malware payload (RemcosRAT)", "value": "01130192806f22b1bd29e2422772fa12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675057, "uuid": "75306623-1276-4634-8830-1324df7292f6", "comment": "Malware payload (RemcosRAT)", "value": "50e39da793e84dc45780be3dca5aed8fa300ae2aaf7708a58da92e31865f2e81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675057, "uuid": "95b00983-dc7c-4b2a-9233-98d5c150c40a", "comment": "Malware payload (RemcosRAT)", "value": "f172720ad288926e3d440a6d8eb4fb302636e765", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675057, "uuid": "c9eb2cc8-bfe7-43b9-a3e1-d9c470aeb8a2", "comment": "Malware payload (RemcosRAT)", "value": "b3ae8edfc9784a0a8e5067403f1d28a1ab9b5793b8a88700c44bd8d5a9e04b9600f2b1ebfa9379e159d41a2fef534390", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675057, "uuid": "c95ac1e9-dd62-48d0-bea2-73bcc280a721", "value": "T17425235937F08F31C09F437AE8A2721407F1EA6568A2FB1C5DC1A8E66DF3B51C9116A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675057, "uuid": "38c34b44-3716-447e-ad50-390dea624d1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675057, "uuid": "78811611-a218-425f-aa3e-b665f54e074f", "value": "24576:A9+b3jVcYyKK4dG2t7XTf25EA/I6l9CZ:A9szSnKKj2t/f25EPy9CZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680675057, "uuid": "8acec684-f3d5-4681-8fcc-d8ae805fa276", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680675057, "uuid": "5a3c8d33-abf9-4b5d-a973-db0477937f35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675057, "uuid": "b26d44c7-5c73-4a27-a8e5-d10a6c133a59", "value": "Shipping Documents PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c890f41-d3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680719931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719931, "uuid": "53915102-c230-4508-b4b7-5479f9fe2545", "comment": "Malware payload", "value": "e12a0d1bd5e147284d417c53ffa2a0d1", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-space", "colour": "#DF369E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719931, "uuid": "b40b09bf-e7ac-4617-87fa-20d5fb8c6fb6", "comment": "Malware payload", "value": "517520eeb37db12046b9b2a0c5519c42be9d9b742ddcdb04e1f08e465500aa10", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-space", "colour": "#DF369E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719931, "uuid": "9d22dd1e-5296-42e6-847c-e88dcaffff4b", "comment": "Malware payload", "value": "b6fb3558d9e1bebe3d4fae708b70cbbc2b357a26", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-space", "colour": "#DF369E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719931, "uuid": "42c2ba1b-8eef-4ce7-94b0-7a35ca300183", "comment": "Malware payload", "value": "ca01b83aeba712d1a25ae8910700a73af3c6a74becf847314f1875cf9d8f5300df900b1dbcecb3e291631f38caa054de", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-space", "colour": "#DF369E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719931, "uuid": "05bb5713-79b9-4d90-81c1-6ae19dafd1b5", "value": "T16CC633F91D9E8B1A1222453432BC66266425E7401192BE49BD815CBA7DCFBEFF1CDF20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719931, "uuid": "e49b986c-1aa8-43f5-aae3-ac37b2af4b97", "value": "196608:7zhAW+o+O0C8xStt7ikSP5tPtSw5WTPmeNo2jOfK+YMH4Z33oZQ7gvct:HhAW+o+e80tGkSP5DZwzjNobi8y3OQ7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719931, "uuid": "fa78a5a1-91e0-45b6-9c0f-f8df3db85e0f", "value": 12530734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719931, "uuid": "ea77baf2-2a3a-411a-80ff-5e8fb39df143", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719931, "uuid": "9f771bc2-9af5-4776-8e8c-eb6381149413", "value": "new_kiddions.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7112f3-d350-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680658003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658003, "uuid": "58ca5b04-abba-4532-88b5-6280bea08010", "comment": "Malware payload (Smoke Loader)", "value": "69111df7fc0947400288418a6c144912", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658003, "uuid": "e8bf9545-5666-4f2c-b3a0-fdf026721274", "comment": "Malware payload (Smoke Loader)", "value": "51771771852796654addefd16d009fe17a11b5979e4c9bc3cbdbf6b7a3209b6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658003, "uuid": "d2900511-5dd6-4c26-b806-2e8f654718ee", "comment": "Malware payload (Smoke Loader)", "value": "b36422a47fdff5d510061d4715f7fd45de81a74a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658003, "uuid": "421eb2e3-f1c0-4836-bde2-181381882e79", "comment": "Malware payload (Smoke Loader)", "value": "edb0ba62ff0067fff422ff2fd297ba89db7809a11944e662ea4869bfdf06ab46bef9936b339526f77f81cc6a98b8992d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658003, "uuid": "4f8188d0-b347-4826-8148-b39a088e3acd", "value": "T1F1449D0167E06830E51B87328E2EC7BD6A6EB4619E657B5E17B5493F1E303A1D23A70C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658003, "uuid": "1413f3d0-0f07-4139-a9a7-85fb23a5710b", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658003, "uuid": "7b6d45c9-1fe8-4ab9-97b6-c9d67d6148de", "value": "3072:vX7ceNxRkDohCvxxeLhq1amX4zY1eg0YVoAhVQNGloPQvelM9AqGqaJSNn:4w0DoIShqamozY4+QcloPomM3aW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680658003, "uuid": "1e60f170-9bdf-45da-8107-73ff063ee57f", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680658003, "uuid": "be59687f-3ee4-4314-8581-f5ecae29b696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658003, "uuid": "fa5f69df-4902-4fde-ba48-5a23e514b8c5", "value": "69111df7fc0947400288418a6c144912", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cb3bb7-d3ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680703269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703269, "uuid": "492a6227-fbbb-48e4-9535-ff1f91343fc3", "comment": "Malware payload (Loki)", "value": "10e6048d84bb2890c19a6a05745f5e3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703269, "uuid": "504f73b9-3b3f-485a-a27c-be891df85bab", "comment": "Malware payload (Loki)", "value": "51d0b286785f92a96b91afd25bd35a7d4c7db867d32cda23883c747446ec6e6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703269, "uuid": "8bd65f60-25ca-42f3-9c1d-1e302252643b", "comment": "Malware payload (Loki)", "value": "2e9ed5b17daad27f69b7d56831296ef3c6bad0aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703269, "uuid": "80402106-8fa3-47b4-9937-46dbed8835a3", "comment": "Malware payload (Loki)", "value": "c545a58910317da7225819a637d12f13bcd97ef453b31ceae4d27180b872e3f0b3de5ed07fb726b3c4fec918a715353f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703269, "uuid": "fc02454e-81f3-4264-b6d1-400c5e50c5f6", "value": "T197D4F12437D98A68D437A77E84E0D2F01376DCDAD8A1CB670FC9BDCBB3997460621186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703269, "uuid": "513db877-1093-4e79-9db9-137ad64d96e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703269, "uuid": "5b49b2af-e2db-4c88-b361-7e17814153fe", "value": "12288:OxwqHNYCPv+Nj8YA1Uyd7qhrkJYyXsbyNGs41CD410frPTJ6pI4imOMt+:OxwqHNYKs4b1okYyXsaPD41G96pdimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680703269, "uuid": "74947f29-2ad2-425c-81b9-6c28a3f56e2d", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680703269, "uuid": "3920b08d-48c1-4b4c-9d80-f60416057091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703269, "uuid": "6c1cde2b-89ed-42ec-b0a8-51690a965b90", "value": "PO_#40018599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acee974-d36f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680671154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680671154, "uuid": "e310c00e-98e7-4b24-8f6d-d7ce806569ea", "comment": "Malware payload (AgentTesla)", "value": "bd307413efbd34b32edbd388dd122e08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680671154, "uuid": "416225e8-05ed-483e-a847-65e4bf6100be", "comment": "Malware payload (AgentTesla)", "value": "5453c16d0530e3bf32f870269a92db07188195005273c769b05752f4bb7c18e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680671154, "uuid": "a9e02da2-9448-4af3-b643-77746402de8c", "comment": "Malware payload (AgentTesla)", "value": "70658d3afbfd654812981dda2db80bbcf1868e91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680671154, "uuid": "c62acad7-cb93-4260-b0e2-3fbbc3b8f940", "comment": "Malware payload (AgentTesla)", "value": "8d68f46dbc2d35554579864dca165cc08b3da3d7758c0dec0b226c2152e36961176de94d943b863728af16a78e51f5f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680671154, "uuid": "57e877dd-5ced-4920-b884-3a4a60eb2ecf", "value": "T10C3608416FE65D16F1F62BFCAC352398DAB4E86B86D3AB06310DF0692F253650C53362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680671154, "uuid": "8436725a-188a-463b-9abc-b5bee5cb6aa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680671154, "uuid": "38f7ae7e-e7fd-410a-a307-5829d187a880", "value": "49152:lI/YSTwT53vWMbUAezVitNzf4OywDJZgAkDKGq8OxtP2MLCJ582:VF5/WNxYdej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680671154, "uuid": "37d75ae5-5dff-4046-a407-37f90d672d0d", "value": 5204992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680671154, "uuid": "78bdebd4-fd94-416f-9546-ad2165f48677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680671154, "uuid": "d1c172ee-b67f-4d12-b88b-e47885dd89bd", "value": "QUOTE REQUEST - 109051__________________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bd9108-d3a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680696170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696170, "uuid": "6c60ae0f-d010-4725-8064-70f117d110e5", "comment": "Malware payload (RemcosRAT)", "value": "27431c66dcfb0971097afd7a9dddcb80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696170, "uuid": "53fb72c5-4678-4e75-913f-e20f0a277302", "comment": "Malware payload (RemcosRAT)", "value": "54702414cd971b3b306d4dcedcc289b50c06706529784933830b0cff9d124331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696170, "uuid": "4cfb41c7-678c-46ff-9c43-a181b6d62ae9", "comment": "Malware payload (RemcosRAT)", "value": "7b0334a3ed935bdae05033d722cac0be484f39ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696170, "uuid": "c9ec4fbf-e086-471c-8249-4262e85a582e", "comment": "Malware payload (RemcosRAT)", "value": "2e852e106f7356364621b0b8165f027614d6341c4bc6d52b668ed3c73fb3b27655c23d31d0aa3335512429ba8d7b5c4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696170, "uuid": "5039d639-51e0-4727-98d4-c8da737bd5ea", "value": "T17E74F143B70454EADC1E817305AB0AA34B72FC3D8261668B7BE6FB2F1871253475B91E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696170, "uuid": "7c297b5b-133d-42f5-9e59-27691edfe504", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696170, "uuid": "ae6440d6-2daa-45fd-8f4e-7ec32b9a3a01", "value": "6144:41onnCZ8SifzRWKO2CxJChnfncsgeH0tP0SBTdP/egsH6UT/SumifJFk:Aos85RBEJChnxI0SXP/e7HCUfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696170, "uuid": "1cfbe72d-dbe2-41f1-a71e-012cb5ba3b42", "value": 347952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696170, "uuid": "cbf323ba-9c0e-47f0-a7bc-698d0c93891a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696170, "uuid": "32d17bd6-c5e0-42af-87df-217928969150", "value": "54702414cd971b3b306d4dcedcc289b50c06706529784933830b0cff9d124331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75249cc0-d394-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680687009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687009, "uuid": "973772b8-dea1-4bf6-a996-46a98e04be8e", "comment": "Malware payload", "value": "2792f3aa4b0f15c488c32bcd1e03afd8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687009, "uuid": "7a2ce23d-15c0-4171-8906-981323bd2d88", "comment": "Malware payload", "value": "5487a1b50399574ff09d2f8bb6fa87d0b194c840e8aeda26196b612a6a3fcb3a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687009, "uuid": "e01ca1ab-7b41-4d93-a518-c6d5f1a44d1d", "comment": "Malware payload", "value": "b49223709c7a83125912a2474e79b446c622b232", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687009, "uuid": "1deaa4b8-94a1-4eaa-ac70-346a6fa0b00b", "comment": "Malware payload", "value": "339e151282605084e1b42a7672f9394c7a0508b32f6efde124fc7526b010125530ce2509b2232ffd6ba2d9d8d7617b7f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687009, "uuid": "0e233644-c2ee-427b-b9b4-d8ac0b0f032c", "value": "T10B040204FE90C69CEA43C0BEE15E859DEF2C4A8E450DC76F36F095A05A95CD2CB039DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687009, "uuid": "2dec4b01-103b-4e3e-8974-90ea7575bf1c", "value": "3072:/aZCV6DcW4xLOMB6DrxnuahzqBc7EPTe+1sVCwWL3OGE1ZynOtQwSelrRVZBAMrQ:Wc6yxLzQ/xuCzeLeAwWL3WJpRV3AME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680687009, "uuid": "fc16d32a-25c7-4cd1-bf50-70669bd52752", "value": 189466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680687009, "uuid": "5f54b09a-d969-455e-b4d7-837f68061d8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687009, "uuid": "5373dbea-0732-4c55-ba75-1690fc5b7326", "value": "auz.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad65a846-d371-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680672071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680672071, "uuid": "2a19e91d-cfbd-4ac6-979c-1c87bf8ad2c2", "comment": "Malware payload", "value": "57d87761cb6c793e5880269ede3dfb27", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680672071, "uuid": "fd66329b-ddd1-4a5f-a5dd-747069b35cbb", "comment": "Malware payload", "value": "54fbc9feaff7de7b0ab3d92e0a93477d4c03a5253abd9deaa74fb7ce219351a4", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680672071, "uuid": "313fed40-e757-4461-883e-918296001ae6", "comment": "Malware payload", "value": "3f0dc98bad8fefff8d3066fc18b69112fc253286", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680672071, "uuid": "34d3afbf-5805-485d-b4d0-78f349a8f15f", "comment": "Malware payload", "value": "2f141a66c7ebfe67b29a44ffc53bb073adf675a941b8247a4aa77a3ee607109d4ebaa1a68b7e1b3643f515518400dce7", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680672071, "uuid": "5e037fcc-6199-428e-9873-f28b8cee42e6", "value": "T191A4239B45F34D2EDA11E762BE6677CC5832F8FECA412461CA20E704DC4AE1B511BAD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680672071, "uuid": "9f9aa396-d053-43f1-af8e-cb83a7d75582", "value": "6144:h825wExOhewNXQhEy+9z7UZUG7yiqSigdNY1A2NAgNteIMPZxoBPMjRyxy1ZihDq:e6OhhNR3+vfissxA2emQIokfUPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680672071, "uuid": "e3e31a88-e9b8-4578-8242-a343192c3e88", "value": 461387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680672071, "uuid": "d626638a-a95e-4284-b2a6-6624b4f8284e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680672071, "uuid": "20e51349-7a9b-4e4b-afbc-8a4b13ab1aa0", "value": "FTE_230404.pdf.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6943a776-d3c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680706746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706746, "uuid": "ab082d92-5448-41ac-8e39-df9e2f2f21bd", "comment": "Malware payload (Smoke Loader)", "value": "d4310c99d42ad36aed4679860c1c368b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706746, "uuid": "60ff8018-8b27-4e62-8eaa-b81b11ff8e87", "comment": "Malware payload (Smoke Loader)", "value": "5531490b3951e8793cb6ee449f75d6fb0b5c1347d1197ccda7ff1b9b15cf9661", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706746, "uuid": "ea7c7e89-982e-4e86-addd-6761ca715923", "comment": "Malware payload (Smoke Loader)", "value": "547b0af6d1f0abcea19160d361c4f2e605c3b864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706746, "uuid": "cd4c3cf8-1e50-491f-84e4-53d68c24e83b", "comment": "Malware payload (Smoke Loader)", "value": "feae3439eb53d52aa55c8ec1dcf2b2c31155d3524f7cf2d4ebc5d94ab44f89f7ecc117d3b41a971109bad65ff6f8dc2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706746, "uuid": "02ac737c-43d2-4ad6-9d30-e23af7eb6b32", "value": "T14A841292F7E54839D072CFB01C50DA62483B79655DBCA50873ECAD8F9F3B681825A783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706746, "uuid": "2f104aff-f160-4425-b545-5dde6c73a435", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706746, "uuid": "ea321623-1ae3-4459-b964-88fe757aa5d3", "value": "6144:x/QiQXCvJm+ksmpk3U9jW1U4P9b4OGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZogE:pQi3vs6m6URA3Ph4lL//plmW9bTXeVh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680706746, "uuid": "f20a47d7-2697-435b-bf54-209845ae0328", "value": 390082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680706746, "uuid": "421c562b-4657-41d0-9109-35e24d10b5ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706746, "uuid": "a72cebe2-5e88-4eff-ba95-aca11b9f1499", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59ca2b1-d395-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1680687627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687627, "uuid": "c0b9b7a6-e3f7-476f-88dd-5a717de09a4c", "comment": "Malware payload (CryptBot)", "value": "1ab121ae9a7cdef5fcf43f61866eebc5", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687627, "uuid": "0b6eee7e-eaa7-41e8-aecb-30e773999c98", "comment": "Malware payload (CryptBot)", "value": "553e2ae84b069b9e634aeab247f736711d4a452e4eb2da356b171446cc7d2fc5", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687627, "uuid": "806a6281-35e1-4149-b014-de34e369c543", "comment": "Malware payload (CryptBot)", "value": "39b95cdd83887b1a707a457cf99715fd65b1732f", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687627, "uuid": "da8885c8-0226-4c4f-97d5-48d88bf84c4f", "comment": "Malware payload (CryptBot)", "value": "3dd52d3ae5d02d270bf954506a1352df7c6ebaa2bb9091558a68a50bc7fcaac6a6aaff94b122210ca29cec24070d3265", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687627, "uuid": "0ec8570f-15b5-4edb-8719-9d886df6748c", "value": "T1AE56233313511285E4F9CD38C4277EE532FB1A2B8A85B87875EEBAC617328E4E617543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687627, "uuid": "e7b6fe8d-fbcd-46cd-984b-9f9477c9dc38", "value": "36d75ecd818f0c5cde41f4ee2b1e9296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687627, "uuid": "be9ed3ee-3916-416f-b6cb-4b8166446ce1", "value": "98304:NBzuKKm0TuBuFscUmsH7P4UxrcYlu6R72N02LklRhcNKQ7zqKy+nJW:Nx0TuBvciH7gUhB72e2AlaTCCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680687627, "uuid": "329e349f-e933-4c6d-9a5b-849c6627ad97", "value": 6397440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680687627, "uuid": "6578919f-4020-4564-a163-5b9595a77ad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687627, "uuid": "90a3101d-7e11-4e7d-b4a3-aecd1d781a8e", "value": "1ab121ae9a7cdef5fcf43f61866eebc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46ac40a-d388-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680682041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680682041, "uuid": "72d01b9a-1104-42ec-b539-f10e10229bc4", "comment": "Malware payload (njrat)", "value": "ba095ed2b17501668e3ba5b3955d813c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680682041, "uuid": "b5405ff5-a064-4111-8b51-a31a204070ef", "comment": "Malware payload (njrat)", "value": "55652638b209e7d7fcfb32b3008e06a275a731addd8209550239f27e302cddc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680682041, "uuid": "6383595e-0e07-4c57-88f5-2d500276e36d", "comment": "Malware payload (njrat)", "value": "094b2dc687c4a18afab7952a141f581467795a55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680682041, "uuid": "e33cf221-ad50-4790-8b2e-b14dfeb17431", "comment": "Malware payload (njrat)", "value": "a60877fdf7c56fdd883ab2f5d73fb16ea4ef5f423650430d0614f535aa10706189742c87ef9557ecff3eeaad037f90e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680682041, "uuid": "a956f7c3-2daf-43a4-977e-8f4c1c36e3da", "value": "T1FAF2195D3FA18172C5EF2BB006A6D72102F2D1075A23EB5F8CD844FA6A777C14D81AE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680682041, "uuid": "f84965a6-75d4-4aab-8eb8-b67834032d30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680682041, "uuid": "a10184f6-5529-4e37-857f-c5b61a7189b3", "value": "384:RLdCitHzikD9MKnEZePC4/rY2OzRLTm3yilqr6Xb/2vG+h:RbtHziq9EZeK4/rsJvG+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680682041, "uuid": "db5371b9-f8a5-416d-aa5b-e897c7ea6751", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680682041, "uuid": "040b0871-1b22-4faf-8969-c45b8724306e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680682041, "uuid": "5bb14788-0345-4522-ba9e-d7dd8eb43d7b", "value": "bLpy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0ffc8e-d3ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1680698323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698323, "uuid": "5cc9e2ee-491d-4423-b23d-0e576d580d07", "comment": "Malware payload (Quakbot)", "value": "789e3789de0eb630000adb1a2ed27d7e", "object_relation": "md5", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pw-755", "colour": "#660AC6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698323, "uuid": "ce5aff7a-5117-4491-b164-29b56bf9851e", "comment": "Malware payload (Quakbot)", "value": "561af3176733040a90c62df0d19780b373da1f7e45a7c25a09f922fd96f6bc0f", "object_relation": "sha256", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pw-755", "colour": "#660AC6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698323, "uuid": "cb28590e-1b91-4488-b3d0-4133eee6c3bb", "comment": "Malware payload (Quakbot)", "value": "1d0f4f4a049e5e0f6ff10a655416a9cd604e3efc", "object_relation": "sha1", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pw-755", "colour": "#660AC6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698323, "uuid": "c2f821ac-0ac3-4e55-9464-475693c3bd6f", "comment": "Malware payload (Quakbot)", "value": "e999a0135b22a3511316d7af9fa01bad7fd949a1857da80a7f9ec7c6066c0e271cc0e64807363c91e1a2a296ee4c5ac7", "object_relation": "sha3-384", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pw-755", "colour": "#660AC6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680698323, "uuid": "9be27ad8-9275-4ace-b51f-3c0c4759ee43", "value": "T1BE930298EA28C6B295894F794E15B3AFD8F6F03B4B14985BA360D850F41CA457F2830E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680698323, "uuid": "0a2545f3-2da2-4428-9a2d-a40de1044931", "value": "1536:0gCZONtdZzqaJpGlR9P9dtxHJd2MhUvYIAY27QqG8j0SLGEI:0RkNtzfsJPHriuYFn8jB9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680698323, "uuid": "4c235ce6-5f2f-4c9e-9c47-04e9709d471f", "value": 91031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680698323, "uuid": "f9348172-b4b6-4318-b9f0-f72e24e9a93d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680698323, "uuid": "ff0f80fe-1309-4343-a066-eda80e130df4", "value": "Lcw.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a00131-d3e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1680719784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719784, "uuid": "c442262f-6370-4d13-88c1-51917ee95ae8", "comment": "Malware payload (EternityStealer)", "value": "91d64c2f0b9d848979eff6e954f56f52", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719784, "uuid": "0e186aef-867c-46ee-881a-f111cc26ce8d", "comment": "Malware payload (EternityStealer)", "value": "5837870868a86382aef92c68f51c5dc00662d2f7d9fcdd094db20f1b24400ec9", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719784, "uuid": "fe946b13-8e1c-448e-bffa-eb97eb512028", "comment": "Malware payload (EternityStealer)", "value": "5ba879aefb73122dc6a43e17139080c213c72b77", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719784, "uuid": "02474be5-cd6c-42c4-bbd1-258187d966de", "comment": "Malware payload (EternityStealer)", "value": "8bd06cc9ec328ac30c23afc54dca35988d45d151631a3b67e78d729746cb98c04e3f925728afe6d6910f943906fb5348", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719784, "uuid": "d86c9c81-8312-4cca-960d-4ca7239ec224", "value": "T12895017D59BD0B36D13BD7B18BE49810B6D4A97BB211CD3A7CD34088061A9C225F7A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719784, "uuid": "f16c643d-f9a1-446e-becb-34aa8eb880d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719784, "uuid": "ab7769b3-ed57-44c7-a1ad-f62447bc699f", "value": "49152:vcBIFs6IRdkLSoXp5L541i7VpADzmfdUdELd0FdI:qyLSoVSiBp24nGdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719784, "uuid": "7b83ead3-6d52-46e5-a58f-c5515fb46172", "value": 1970176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719784, "uuid": "33cd1d58-07e1-4163-9a70-48fc0e9a2e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719784, "uuid": "131c0b2e-7851-4646-9d11-57bf2a5e8ee1", "value": "91d64c2f0b9d848979eff6e954f56f52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a0dc94-d3ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680697098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697098, "uuid": "c70d24a6-7a50-442f-9c41-57a832bf7bb1", "comment": "Malware payload (GuLoader)", "value": "dd509cd9fbaa858ebdfb32f4f3221dfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697098, "uuid": "4b49ded9-f95d-4baa-9d67-eafbfe510eca", "comment": "Malware payload (GuLoader)", "value": "586b71c7c5a721f7f4b23ffdd6c69341f4aaf656d98ff89627d0f2a02359ecf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697098, "uuid": "f5d80469-09b6-48bc-8bf1-d4d4b7c408a1", "comment": "Malware payload (GuLoader)", "value": "93c0e5074bb6954abd2a171d47d685e4208466a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697098, "uuid": "1e245ced-080f-4703-bf51-2fef16ad9ba0", "comment": "Malware payload (GuLoader)", "value": "ec3aaf5f3e6ca192fe15d059d3f84dab5a81261b15fc1f94e9ae5f1c98218333579c1cef1dd93ed1eadb0a195cbc0f44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697098, "uuid": "e00c07a1-5c6f-48e9-bef5-b14df16cb4c9", "value": "T1E1C4DE406780DA6EE3D262B18F53D67983289C5C2660CD61A1E12CEF34FDEF3D86905B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697098, "uuid": "fc49d957-90d7-4ec0-95f9-71f1f4040dc6", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697098, "uuid": "6074e4cf-1ef8-4d18-9eef-301c4274a560", "value": "12288:fteSpimXrQxT+07IOtpp7Am/B+8HzGxmis:sSomXrQxTd7IOtpSmZlHUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680697098, "uuid": "cf21dde7-708b-40ab-a83d-2e0a8b2469f1", "value": 581562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680697098, "uuid": "d2e792e8-4578-492c-96b5-2f5622dbfd2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697098, "uuid": "9c2f2989-18ed-4858-90bd-ab5e9aebb44f", "value": "586b71c7c5a721f7f4b23ffdd6c69341f4aaf656d98ff89627d0f2a02359ecf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31bdbef3-d3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680719967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719967, "uuid": "3c984fe1-b965-4144-8c39-adcb491d18fe", "comment": "Malware payload (AgentTesla)", "value": "49669a2b32fccd49e05af82e6846184c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719967, "uuid": "4066f035-71d6-4328-8173-a37cee9343b6", "comment": "Malware payload (AgentTesla)", "value": "59af75ad132550cfcce6cdb085078ee057c966dff05a6624dc1f81252eab4e85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719967, "uuid": "6fd4acf7-e0ac-44a6-998c-84ec3bd4c8ac", "comment": "Malware payload (AgentTesla)", "value": "30b710714a57e1e385444cd93174e941673997bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719967, "uuid": "3181f225-4066-4d2c-bfaa-623cd772e044", "comment": "Malware payload (AgentTesla)", "value": "33d62eb817b62db7696eb0c9ce51664d64d5757747229d811a23abbb94c87428517fe78784e064ab623019e48d591d6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719967, "uuid": "eea77c57-827c-4d5b-b2a3-ce3f72f19788", "value": "T1450633E0AE31297805FC867AB45F6E0C1B8ECFC54B04F4EF456910D2D65E7B38D928A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719967, "uuid": "af831fcc-ab19-42db-a8ea-c3a6c20ad8e5", "value": "49152:PZeuEWkhNoiSTx/ZUrfC8kiQoOq+dLnG0IgicVqte6za8:37wP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719967, "uuid": "f4365a64-413a-44a8-bd0e-792db79df090", "value": 3772270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719967, "uuid": "9f3d957f-e992-4ec4-8b2c-eba6d45f998d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719967, "uuid": "9d5651e6-ba2c-4397-a9b7-f85d8d966ac9", "value": "Purchase Order.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677d4c86-d3c2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680706743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706743, "uuid": "c40ecfcc-ca6a-4d2f-ad23-4d9c35a0ef16", "comment": "Malware payload", "value": "caf63ce88573af5cb46405721e63d4d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706743, "uuid": "65db3a01-eb6b-40e7-a3cb-b78776ce9032", "comment": "Malware payload", "value": "5a21f81192263f01c592ac864655e040b9263eaf2aadaae49fed7fdf5553b26a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706743, "uuid": "028960e5-0a1d-4d33-a9db-d8ffd1de058f", "comment": "Malware payload", "value": "27e884445a018b962e2eda0211ec4994f4b57afd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706743, "uuid": "1cb9f709-7f6f-458b-bf91-f4a31abeb59b", "comment": "Malware payload", "value": "7d933bfc006283495caefb9cd98d3889d6088fdeabcba07b941196f66db308c6e2ff275aeb0146b8bdcd615f862766b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706743, "uuid": "fb94a86d-f5a0-45a5-87d7-652684b171c9", "value": "T1B815120721C59470C466D7FB44E2E279259E2D1233D16A9B33CCA94F592C9D62B3CE3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706743, "uuid": "0f36b8b3-9264-4021-a4dd-88c3cf993d8f", "value": "bdc5460897466ea2db5d4e59ab3f0e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706743, "uuid": "5aa9a9d9-788a-48f1-909a-dde292d27eb2", "value": "24576:FMRgVex85KmMj9DENY9Q3RpSbbSOd//28:FMQexPmG9DENYCFOd//v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680706743, "uuid": "a80c9b42-1d10-4a03-9ed3-05e9d54eb56c", "value": 925856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680706743, "uuid": "e2e178d6-ea9f-48a2-a229-9fcddd2845ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706743, "uuid": "2a816b13-ca34-4159-b7a3-c6db58405e0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f526d7c6-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680700538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700538, "uuid": "399fc36c-dd53-42fd-a413-8532b3de8350", "comment": "Malware payload (Formbook)", "value": "d89736e82bcd61f6461e0f1eca3a7f26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700538, "uuid": "5761af4e-5cfa-42fc-902b-8f1cf590679a", "comment": "Malware payload (Formbook)", "value": "5a95e92547f26d8b505c2c70b8c96dd8c41cb73ce948781b08a0adc831b1b158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700538, "uuid": "5819c339-b8ca-4b43-8fa1-751867483a9d", "comment": "Malware payload (Formbook)", "value": "ceaf71bd101b1a8a18c919aeac32a8223c089754", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700538, "uuid": "fce756ac-b3b7-46a1-9b6f-2e6d397bc4c2", "comment": "Malware payload (Formbook)", "value": "64b55d5b3e1c0569ec8e8a9dd3dde34742aeb0cb9cbf664603eb1eb63523f985c8aa47b9c9828815ec75f1587bd5ca9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700538, "uuid": "0b8b1b70-f109-458d-928d-e41299f9f242", "value": "T1B7662902B7E5DA21D5BA73B6D2E065288BF1EC424211D61A30BD325A6F73363CE0675F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700538, "uuid": "fcc93ad3-c2fa-4b05-addc-f150b8ea2b2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700538, "uuid": "74d7595b-6715-4afd-8320-31be2f2e127d", "value": "49152:VcJs1RoFxKOUvhw+CH8vjVp+rbjCBO3uvaj+fchjNnAsM4jI4T9QoW/dkqOO:V6Sv5xp+rh3uvajzh5az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700538, "uuid": "61c584a0-c343-48c9-9f00-3dd285b4293a", "value": 7102464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700538, "uuid": "8cb0bf48-6d1b-4f7d-b758-631e4a03ba69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700538, "uuid": "b5ddfcdd-ff0f-4135-aaad-d79b3fca37e4", "value": "d89736e82bcd61f6461e0f1eca3a7f26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6249b7dc-d34b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680655624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655624, "uuid": "43d2fc97-d68d-4a7e-9e5e-d8c3454bcb05", "comment": "Malware payload (Formbook)", "value": "5cbe3c33135407c9910469b6db11db61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655624, "uuid": "71a695fd-9a23-42c1-bc73-c3edd769eb49", "comment": "Malware payload (Formbook)", "value": "5b33627e8c4cb8392b64cd3b82b65cccb9a986dac0a19d9e8b7577274aaeee73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655624, "uuid": "1d5d3e9f-d9fe-4d8c-a6ee-1426b271a58c", "comment": "Malware payload (Formbook)", "value": "5c7856c764f9245cf69d41769cb5f1238997bcd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655624, "uuid": "f4fd090e-7890-47d1-8c16-548f05af7b43", "comment": "Malware payload (Formbook)", "value": "6228ff886b156899a2576d267787b15d5f6bb1a56b52a5a6d8ef415242de4f37563cbcbd9398ae336ff9170b927dae87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655624, "uuid": "630248bc-a3c2-4e0d-94cc-f674eff7d2ac", "value": "T19C56184653CB5925E0BB6732B4B8A109CB74EC255356E35FB0CC78BA2F32B915C5232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655624, "uuid": "591a41cb-5f95-4859-83e7-07495949fd07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655624, "uuid": "1fce6d6a-ce6d-40c1-9516-7a3e96409dc8", "value": "49152:Sd1fc7AM3fdrw+EEn4kNxPuE7dUh2BLQI4b0z32NrSVVyNzv3z/dUC9YjO:Sdtcpfdrw+Lvz4h7jb0cru6v/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680655624, "uuid": "55451144-6a58-44cf-b180-a9c09336ae99", "value": 5888000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680655624, "uuid": "a4f5e62a-0e57-4476-9a43-bccd696cf71a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655624, "uuid": "4383df9a-34c6-44fd-ba78-72e2bda0b8a2", "value": "5cbe3c33135407c9910469b6db11db61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28dd9afc-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680718234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718234, "uuid": "8936852f-6367-499e-aaf0-a7a9fca1ed59", "comment": "Malware payload (Formbook)", "value": "78533aab7e4a45cb6167c8655fe0a0b5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718234, "uuid": "9521f5cc-3369-4711-97ec-274d50568749", "comment": "Malware payload (Formbook)", "value": "5bd3b8fd6b50b1fd1646374253b53e8f74e52d31216d42f65cfe00f437643276", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718234, "uuid": "9aef66d7-a209-4be4-a218-119b2f849f84", "comment": "Malware payload (Formbook)", "value": "483f384925a0953a80086e227b60140c7aa635c6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718234, "uuid": "63eb9ab6-f2e3-47d0-b1a0-255accf9196e", "comment": "Malware payload (Formbook)", "value": "ea33d89f86060ce58f786804e2962f250e3a7f57c561ec115d9339e8e6de947501bf625e1125f932ee8681d4d7609302", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718234, "uuid": "88444f44-4b68-4135-811b-290e3ef02b54", "value": "T138758D787B6B9A23C1BDCE31CAF69400A3F194477622E91B3EDD02C50A13F9E189759D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718234, "uuid": "cfd936f2-d063-4bf0-a292-d3f45012d60c", "value": "24576:eaflaT2ZmB1zez+QUWUR8JQHDn+KC5ZT:eafkaZ+rWw8JENC5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718234, "uuid": "03ffcd8e-26de-4e6a-b358-d1ac4c2c7036", "value": 1703936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718234, "uuid": "23879446-506a-4650-a04d-cd9075837ec9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718234, "uuid": "1592c796-30b1-467d-babe-5807a43d272e", "value": "new order.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d786b8f4-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680700488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700488, "uuid": "b5817d05-ec74-44d9-bef4-d9e586bb8b35", "comment": "Malware payload (Smoke Loader)", "value": "69a2c23215457787e503323691674795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700488, "uuid": "56428c7f-9f8c-4957-b563-8acd04d96ea1", "comment": "Malware payload (Smoke Loader)", "value": "5cb990efb5548b238ff6e2637377088db3863e061fbd1f991ee0a6fd930688e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700488, "uuid": "93929d61-ddb5-4113-99a4-293308a2b386", "comment": "Malware payload (Smoke Loader)", "value": "eb138c8a7d277d0032dbcf0de1f8c38de32fb372", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700488, "uuid": "b7370a46-2347-4844-8e5c-ceab400c70a9", "comment": "Malware payload (Smoke Loader)", "value": "4d4dc9d8c5cd65f9447992aa47a076abf0540ac49e4272a8d953258d19de93e51cc1f71c078c6112a63cd127a88a99f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700488, "uuid": "efb05f7b-ff91-40e6-87ca-53df4cb821a1", "value": "T118546D0253E17820E76386328E2AC7F46E5EF8615E157BFE16589B3F2972F72C261305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700488, "uuid": "98e46634-21c9-4164-8057-4190a55f3884", "value": "4ab2a4d536313c74a2690207bf67c9d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700488, "uuid": "5737b369-6717-49fc-8689-b0edff206123", "value": "3072:CBpivPpRlFYXXAKvxVY9K3dgrhEBIr2W7tTpca/9OZlNbCJQN0fF2Rh:GqlFYH49K3jWTpB9OwTf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700488, "uuid": "a3071e8b-e0dc-46d0-bc5d-3be66017a43c", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700488, "uuid": "a1807fd8-da16-42c4-b217-6682f980d743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700488, "uuid": "1098fc95-1a39-4940-8e79-03ec6b308a0e", "value": "69a2c23215457787e503323691674795.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1332a302-d3d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680714332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680714332, "uuid": "619073ae-78ce-451a-b1e7-eea5f8d5d0bc", "comment": "Malware payload (njrat)", "value": "abd16e1eb6c613c526d36d71e8b2bf12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680714332, "uuid": "6d5f3365-5f3a-41fd-ac98-4992051fb8f7", "comment": "Malware payload (njrat)", "value": "5d5e48aa78fcd1a31cd502f625ff88a9a3f6fa2df4e0dec349c9d9757e54c8e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680714332, "uuid": "ef92df2b-c05e-4b69-b4b1-8bd8fc9a9320", "comment": "Malware payload (njrat)", "value": "24093ab0df51926a52853949407da4875d902935", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680714332, "uuid": "4c089f84-c9b2-440f-be4e-9e9e0ba59066", "comment": "Malware payload (njrat)", "value": "748c7262d83453d6ac35daf1fb787360155790292804b0d3204ebea5c5c9def59d98274a1277ad14adc6ef27875d6a31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680714332, "uuid": "990eef84-f68c-40a0-8a76-a7228bcfb8c3", "value": "T1A1B22A4E3FA98856C47C1B7496A6965003B091470423EE3FCDC554CBAFB36DA2D48EF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680714332, "uuid": "08cae56a-3a44-44c3-a031-33c3658ee3c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680714332, "uuid": "0686fca1-c567-4d39-b017-b84a5233ffa5", "value": "384:dRY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZP/+:dmL2s+tRyRpcnu2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680714332, "uuid": "c306ff1d-94a6-4ea8-bd0e-0e8d0ba1f127", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680714332, "uuid": "f9b01344-1742-4ee3-99c8-8f329932628c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680714332, "uuid": "ae5b25a7-b495-4101-8da8-3fbbd6a702e6", "value": "abd16e1eb6c613c526d36d71e8b2bf12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22dd5b3-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680700399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700399, "uuid": "ea92b327-3a15-4e13-ace1-9ae9d9122c9c", "comment": "Malware payload (AgentTesla)", "value": "4edd98a789c2a35a866abca56a1b1bdc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700399, "uuid": "5161b643-c501-49bf-92bf-795a98ccaeac", "comment": "Malware payload (AgentTesla)", "value": "5d89fd91fbb0c2d4d75df1bde8c233dc0fe3e576966a5ab65b231ecc58935272", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700399, "uuid": "d86b7150-c2fc-4c18-baec-c3bb82358554", "comment": "Malware payload (AgentTesla)", "value": "7bd84faf4479ca0ce06838029494cacdf0900524", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700399, "uuid": "545e48fc-5bbf-4d2d-94ad-2234dea75f5c", "comment": "Malware payload (AgentTesla)", "value": "12f1d94e0132859d228eda870238b7a638637605bf37d1001e6f351487ae15ff6b577879edb64dfa37ae8265355e050e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700399, "uuid": "8fa46c56-11cf-4f36-be57-7d15b11ae4e5", "value": "T157E4122633E81731C58E8BBACD61324597BEF61B9826F31C5EE1B4E84EB3740D940297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700399, "uuid": "30e1ffb9-1faa-4240-9e39-9b2d3d3eb0a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700399, "uuid": "e5bd77da-795d-4d51-bca3-d4cce242732e", "value": "12288:17BbHiHd9XbkBHbgFiXeM7KdxvHi3BWIQwBqKxD+d:17BbHiHd9r94L74tSBWIhYOyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700399, "uuid": "3de93521-dd00-4493-94a9-5ca586563838", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700399, "uuid": "f57da4ac-f77c-48a4-9a8f-c39051f56607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700399, "uuid": "310098f5-deba-4818-8201-8006984b87ed", "value": "4edd98a789c2a35a866abca56a1b1bdc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8a4ff6-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680700448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700448, "uuid": "2fb11cfb-291f-4979-8dc3-839a9657c6b4", "comment": "Malware payload", "value": "65875a23945fa2445782545d61437479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700448, "uuid": "aef8aade-16be-4e8b-9ddf-85a9e7276386", "comment": "Malware payload", "value": "5ebf2c9ed8804732ce0ffba0be8912ac78321f763ddd9cee221f0df0ba61779d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700448, "uuid": "a8f71c08-c821-4a51-8b0e-c05f2cb6c8f8", "comment": "Malware payload", "value": "f2cf4c554b2e15ac09cda4ba541b689183ee25a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700448, "uuid": "da602ae5-c7e9-4ef5-8ef9-eaa1a0328209", "comment": "Malware payload", "value": "a21f4e334cc7f63727a2f934c0c55af709b45510fdf9150401cad146337573b2c743a5e779207888fea9d13799aaa0ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700448, "uuid": "4f825a16-ab8d-4f5a-8c9c-f314646eebc6", "value": "T168F54A3377639DD2D35A2B33C0D501004F60EA73A727DA8AB99B13DA16427E59F4873A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700448, "uuid": "c6298d82-4972-471a-89c8-a8f1fb20d837", "value": "49152:ZHVpQMSWLLKUmQUSgYaNrb5c90DNQdjK/7:Z1pjSWLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700448, "uuid": "dd0aef7e-d659-4154-8ab8-958f43477e36", "value": 3591549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700448, "uuid": "c5fd3c8e-98b2-4533-8f0e-85334443cc06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700448, "uuid": "8729c3c5-14b2-4228-ba2a-7b2c653e55d7", "value": "65875a23945fa2445782545d61437479.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b140e8ca-d371-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680672077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680672077, "uuid": "22b01c71-5667-412d-82b0-ab70af2807e2", "comment": "Malware payload", "value": "3d7c943e5c4ad6d118a79d1109bbcab8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680672077, "uuid": "0e3e38e0-cb02-45b0-9819-8f5e298a4977", "comment": "Malware payload", "value": "5f8e2b838a675ecd820088d6c390a7f77cfb86f866648767ef51da2c3481b013", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680672077, "uuid": "e970e6a1-cf9c-422e-b8b4-2f71cdd17f39", "comment": "Malware payload", "value": "034dfd106b6f506603211a07fcfc0d64465efac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680672077, "uuid": "b02a3650-a89b-4cd7-a467-d9f063a94069", "comment": "Malware payload", "value": "7e1693700377af313b4bc09a151c60e869d497d8d0239bd14d0e76e3d2f597ee975e0f81d672d22c2868e427d2da6769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680672077, "uuid": "91b6ceeb-8f30-4dbd-a7f5-ed5880cad738", "value": "T1BEA423265A64CCFBE80657330F351723F665782420B4832F23677B59BC1A785EA3F52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680672077, "uuid": "6a3bab05-8e48-4a81-9594-632021eec892", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680672077, "uuid": "762763d0-499f-4b16-a2f5-bdfeec7ef696", "value": "12288:/YBNgDTcH76qwnp1s3r81VurmwFwPfBOOHN2B3:/YBNgDTc+qwnHsblrmlPfQK2B3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680672077, "uuid": "58d817f4-2ada-4fd4-9b27-9ad530a9af7d", "value": 476864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680672077, "uuid": "e1ea79aa-0282-486b-bb40-e3799c534d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680672077, "uuid": "cedf02b9-d037-4d1f-b322-c79fcbc849f7", "value": "FTE_230404.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94749d88-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680699517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699517, "uuid": "cf82ce4d-05b5-4c5b-9ca2-d386881bf03a", "comment": "Malware payload (GuLoader)", "value": "271da7aee04ba6cdf1aed265341ad9c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699517, "uuid": "e55be837-d443-4e1b-b8dd-ee722f843400", "comment": "Malware payload (GuLoader)", "value": "601d52629466f941c618f71698c7ef86fa1de8329e3de879960b10168c28c5ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699517, "uuid": "863ab594-59c8-442b-866c-1992ebd9bdab", "comment": "Malware payload (GuLoader)", "value": "2efe8487ffbed1d8a674713a585ee5f2e9d3d903", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699517, "uuid": "56ccc8fe-4ae2-41fb-9198-036e56ef3652", "comment": "Malware payload (GuLoader)", "value": "f21cb7982d225d9deb7571e9c98a77e03fcdd3913c914538e0c37abd5714c7e1dff9ddba825773ca862d089d4663ea69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699517, "uuid": "ca8f8c7a-af22-47b1-b1ba-213fba613fe3", "value": "T112D4F10A7C10610ECD6649374C235BE21EB36D3D9DE45A1513BAFE6F88363C67AAD183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699517, "uuid": "686720b3-1622-4eac-a7c4-08b312d9d3da", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699517, "uuid": "e6543353-ff3c-4b21-9b5b-736511ab822f", "value": "12288:uh+G1bh6ScAKWr/ACC2Is9fRChEa+CeKdY:uh+G1bBnzbjCeShEjsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699517, "uuid": "f7203498-a8d2-4e43-b8fd-c7f07e3593be", "value": 617136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699517, "uuid": "12935b34-3d88-4d22-b04a-5bf368dcfc95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699517, "uuid": "21c83c79-d9d7-4aa5-a6ad-05bde7cabad1", "value": "Halkbank_Ekstre_20191415_081738_949589.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00200f2-d3c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680707831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707831, "uuid": "5879125b-a13a-4f02-9dc6-977da511263f", "comment": "Malware payload (AgentTesla)", "value": "3340ed36febc0015346ababf51b090fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707831, "uuid": "41d07a6c-9451-431f-bb97-47f6b6776e0c", "comment": "Malware payload (AgentTesla)", "value": "60fb3a013ee75a17b50bd11ea23d64fd8e656594ecedcbae4f0e96670d658914", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707831, "uuid": "974b75e8-2ac5-496a-9c3a-bfca11750fdc", "comment": "Malware payload (AgentTesla)", "value": "c148bc4430ed3578576614898f1b4d124d7baa5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707831, "uuid": "6edd83cb-fb7f-4072-aa74-d7e525254757", "comment": "Malware payload (AgentTesla)", "value": "8e409f678db9dbae37a20f61ea7b074d371c66c0bd302ac50e578fd8decec0ec8f08b2b74105ef4c4b32e8e53a51cc8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707831, "uuid": "04f4c2f4-c1d3-4eb8-899b-2e37a4f4b18b", "value": "T1FFE4125437D40B35C1EE2B7EDC6B214143F4FA2A2462F71D6EC0B5E959B3B40C896AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707831, "uuid": "e33c90ff-0cbe-4245-830d-3024b22ff037", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707831, "uuid": "367a5402-92ae-4d40-8cea-880b2093784d", "value": "12288:GESh9gW7Gz+6Q188DjzoWoTmOWSNdCPszZ59gR6/OaauLu:GEtp8DjzodT/rN0PlA21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680707831, "uuid": "94b77178-16fc-4ca8-aedd-9dbf87268edd", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680707831, "uuid": "6ea2e421-5727-41fb-a911-f75975b7928c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707831, "uuid": "107fa2c3-b445-4430-a5ec-30e8b3bbe00f", "value": "rDHLDOC7465389.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a896c0-d3ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680724837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724837, "uuid": "ea7198df-4b51-460c-a16e-73ab9ed46771", "comment": "Malware payload", "value": "f9257e835f7e73687bd3c1f38be7e295", "object_relation": "md5", "Tag": [ { "name": "disdroth", "colour": "#C225B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724837, "uuid": "1106ddf1-d65e-4da9-ac0c-4b0b084da68f", "comment": "Malware payload", "value": "614947150352b9365af5badada87e7e61fff6de725d06a75b9ad2110975dc09f", "object_relation": "sha256", "Tag": [ { "name": "disdroth", "colour": "#C225B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724837, "uuid": "940e008d-0c60-42ef-a8ee-0207e3b77d98", "comment": "Malware payload", "value": "bcea5592dcb37dd8c573ebe8e4f7fb17b922c42c", "object_relation": "sha1", "Tag": [ { "name": "disdroth", "colour": "#C225B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724837, "uuid": "f2cd935f-bf7d-467c-9849-f86d48008e59", "comment": "Malware payload", "value": "89bfbd70118d1c9c539f6ae4b5c414c9f8d6a44907bde60639d7547eec629e784faa172770d8f4effae3c99f18759e57", "object_relation": "sha3-384", "Tag": [ { "name": "disdroth", "colour": "#C225B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724837, "uuid": "96ae8c59-6e73-49d5-94d7-c9561a831afc", "value": "T14C746C713798833ACADF0379F052091247FCF58AA9ABBB9D8890B5E97C43351D322567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724837, "uuid": "4b71730c-a501-4f20-ac23-4553253ba3c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724837, "uuid": "cd57c1ce-c996-4647-be7a-afd1ea3f7990", "value": "6144:DE7y/Yb04jDRGC13WOFsPGPGz6fy5gbstob+dn6lpYz9onv:DT/J4j1G6ZFBM9Ist5R6lK9yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680724837, "uuid": "a57e842e-885f-4246-909a-ff29527f2d71", "value": 351616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680724837, "uuid": "a04e1f44-47ea-4124-97ef-d3add620e91f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724837, "uuid": "81bd6fb1-36de-4c8b-a78c-0293c88db91f", "value": "WDElua.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae63b6a3-d3e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680719747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719747, "uuid": "fa12175e-2ead-45ba-9ad6-f5734698dd6e", "comment": "Malware payload (Loki)", "value": "bf7adecde0e7089a30a5345608579324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719747, "uuid": "bf9ad7e9-4612-4a75-92ff-bacc9c7892d8", "comment": "Malware payload (Loki)", "value": "62082dca80037bfed588756bdc0712791e9650eb9f2dd68a5b12d376fa70e13a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719747, "uuid": "ee59415c-0b48-46c7-b3af-5e37a5a1ba7e", "comment": "Malware payload (Loki)", "value": "f2ce22caebfa25a55fa3235762829b378430902f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719747, "uuid": "2a8d433b-f51d-4246-a4e7-fb9e40d191a2", "comment": "Malware payload (Loki)", "value": "a91cd16c0e8e284e4c8cb2a93bb617e10722f5a32c2058530248fc895012375c53f96baa0fc6b5e369fb29dae1fcbeca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719747, "uuid": "99e722f0-e210-459b-8ff5-eeee2da2eff5", "value": "T197E45A521C6642D5C8BA0FA444783A485B789C638FD4903E7D82797FCFFAB4B54893E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719747, "uuid": "b987025d-e002-4146-9c24-a63b3c801378", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719747, "uuid": "556e12fd-d2c3-401e-8f99-97b32993590f", "value": "12288:PE92iNbJOtMvppsjqtzWLauOVmN8y3+9MPRvxxdVDPl:M1hJOgpsGQcB4Jxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719747, "uuid": "bcdeccb8-6bf6-4254-b597-c924292f8bbc", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719747, "uuid": "45050167-72ee-4ab9-b612-58a70533945b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719747, "uuid": "20dc8615-d58a-451a-b7f0-4bdcbf0d16f1", "value": "bf7adecde0e7089a30a5345608579324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7cfd6e-d3f7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680729412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680729412, "uuid": "5e3159a0-cdfc-4e85-acd7-05c07204bd66", "comment": "Malware payload", "value": "e7993618946487aa497269484e3b47fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680729412, "uuid": "cece8166-cabf-44da-8e61-ea22ca538615", "comment": "Malware payload", "value": "62487beda6d314e9f135bdc2cef20f541d91552094f6f0c2f4261e87f76a63af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680729412, "uuid": "798f921c-a021-493f-97bc-a663a4842ae7", "comment": "Malware payload", "value": "cc3e7780d522417e120291c3887122abc56db922", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680729412, "uuid": "3c0bac7a-b75b-4ea9-a35e-4132a6278b8a", "comment": "Malware payload", "value": "9a5f0011f760fbf25cd8d747c98335fbdd28280b2e447de71471654aa84973359ddbd76f9a89b7669b1b08b6f102a51b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680729412, "uuid": "897e97da-de25-4435-8291-0d24798b3ba1", "value": "T14935D093364087CFDE6909F292125529D371AE6E8974D2891AC63396CFFEFE10851E0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680729412, "uuid": "d6a71d06-0d7a-4753-a8c2-8ab38d50f01c", "value": "24576:y0PiESfgiEYH3T0CFEGXE4jcQwZDMrbo0tiY6nnjqKoeY:7ZSfgiE07XEccDZDM3UjqKoeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680729412, "uuid": "22c9b7df-f1cd-4024-b996-be1e068280cc", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680729412, "uuid": "f27db313-e4c5-42da-9d5f-927b4328a4ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680729412, "uuid": "40701bca-0898-4922-b327-4fc5e7f16b7a", "value": "MACHINE QUOTATION#58656.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c04bb71-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680718239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718239, "uuid": "be17f800-1578-42dd-8afc-7c22a74ee306", "comment": "Malware payload (AgentTesla)", "value": "5b204da2156e3d96e1532674e6003c45", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718239, "uuid": "603e6464-716f-4d0b-b3d1-117954851ec4", "comment": "Malware payload (AgentTesla)", "value": "62a89a066577ca565155d367a04d8bddc82dadab47f3b848faa85b03043c7392", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718239, "uuid": "3dc1a467-fec4-45ea-a04b-1c77f34ee22a", "comment": "Malware payload (AgentTesla)", "value": "df9654e9e37797ddeea54bc7508c718032b09599", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718239, "uuid": "eee13cf7-00b1-46af-8871-e9f26035cbfb", "comment": "Malware payload (AgentTesla)", "value": "d43849277e0cb562a7fbcd6848bed1d734c93ee749d854a5a0b24fdb11bda4d75f37a9a086371c699affa3965d9561f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718239, "uuid": "9e7842d9-2f97-4cd3-ad9a-95982296c53c", "value": "T18945121623A85F22E19E43B9D495315047F9BD6938A2F75E7EDCB0E91FB370089423A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718239, "uuid": "1dc480cb-8555-4cba-8044-beca5f5b2cca", "value": "12288:efJ9l03hSUp6PB41O93nqW2HtSAgu7wqD491:efNI5p6PB2kn2XxD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718239, "uuid": "43c9afd1-06c8-4712-86fc-9c987451acbd", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718239, "uuid": "ff860d84-d126-47c3-b650-43949cf92a45", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718239, "uuid": "dfbf5cfb-abd7-4763-8d9e-3754424571a6", "value": "NR. 04-045_PROFORMA INVOICE.pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5a47c2-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680700468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700468, "uuid": "73b539e0-9c56-474b-a65f-2596fe020ed1", "comment": "Malware payload", "value": "34e66264a0b4b1f12661ee36eabbd865", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700468, "uuid": "99eaee96-5fe4-4e6e-9b11-667345c47c5b", "comment": "Malware payload", "value": "62bf76fd3deaf83e4c064cd9de28cbe7d87f310db384a35d80b162d8c90a1372", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700468, "uuid": "9b6e9641-f81d-42bf-ac57-b071133877ec", "comment": "Malware payload", "value": "644c3114612ca0bf206761843180096cf1f44dd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700468, "uuid": "f7a9cf90-7cc3-402c-807f-f04afb061516", "comment": "Malware payload", "value": "e1c251cb576f3369020c3fa0060758344d3aa84629f0ec709e0dfd6d39e6db53684a0a3d9fd4f43c80305ef4ec4b7780", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700468, "uuid": "1c539e77-4613-407f-961b-cc425b7945b2", "value": "T11CE5081AE223812FC8B33BF1834B45C55EA597582633E8DB35D86C9AAB71F527F15203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700468, "uuid": "0af08395-e918-4706-a7cc-584fe21cc57d", "value": "49152:dawg4OcmKTQqSHnG0tnyDMWc9UD+meGn9flu8WAfwK0AsRKTLhGF62ATrR3w+BiG:dawvHSG01yX1n9fU+fRSshbpAzOZdpa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700468, "uuid": "7c450b09-f1af-4f67-b241-289ab006b26b", "value": 3079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700468, "uuid": "16a925f8-4272-4a01-8ccf-c2addd1b3d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700468, "uuid": "f3944ce6-f808-4aa8-b0b9-4c70f6d45f0e", "value": "34e66264a0b4b1f12661ee36eabbd865.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1641258b-d3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1680697587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697587, "uuid": "42af5c7a-9a42-4f56-8320-f3de67cc61ec", "comment": "Malware payload (Quakbot)", "value": "8fbb58fa3aab08aebd0e662cce313006", "object_relation": "md5", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pw-755", "colour": "#660AC6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697587, "uuid": "57b888f1-dd0b-4e24-bb93-f7ad12f2661a", "comment": "Malware payload (Quakbot)", "value": "634353d27017118ccde2fbaba5dc90581845e051fa9414b1012768325a75b132", "object_relation": "sha256", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pw-755", "colour": "#660AC6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697587, "uuid": "0800440c-38ce-4b63-ba6a-5995f272e003", "comment": "Malware payload (Quakbot)", "value": "a3b1c3e2507758fb08539a7282a9cfdddf5ff865", "object_relation": "sha1", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pw-755", "colour": "#660AC6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697587, "uuid": "d2cf51f5-8a83-4316-9833-19e5db18eac6", "comment": "Malware payload (Quakbot)", "value": "c0eabd402610d21544e0e30108ae1cf145243463beeba23cecb5f6512dbddfd7595dae21b68e85a465b2539eb1592068", "object_relation": "sha3-384", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pw-755", "colour": "#660AC6", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697587, "uuid": "52f15a5e-0a4b-4cff-8ce6-b5e42bcadc66", "value": "T17793120511BBEDBEF68052A975090756AFA114C8263B0AE14935B26F37BF94D6CBCFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697587, "uuid": "bba57805-6fa2-4688-b624-2e9b60970fec", "value": "1536:q7V8KO1KTdJTzTSbi7AT/9HLBYW2FhNhIa2oYx621z9Pbd+NYfa5bLKCfTcM85:i8UTnnTai7Y/9OlGHoYz1z9zd8wMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680697587, "uuid": "e0d124aa-9b22-4aa7-93c6-d1785741552a", "value": 94224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680697587, "uuid": "1c3e82ac-1061-4dbb-846d-ee658a7ec7de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697587, "uuid": "79c74204-72ac-4fae-bcd1-478cf0a64bb1", "value": "X.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f98674b-d3e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680719534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719534, "uuid": "11d922e0-aa34-4850-a856-65a56992aeb6", "comment": "Malware payload (SnakeKeylogger)", "value": "d58c64cc21af817751710a6347bc1465", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719534, "uuid": "d39d3ef6-f20f-4760-ba58-b94ddbdd1235", "comment": "Malware payload (SnakeKeylogger)", "value": "639eef62ddbf109ec8d92cb3ef3d48f93e1fff28fdf2d89feeba0fd3d61779a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719534, "uuid": "165b19c9-73fd-45fe-9194-78de2cdfb3d6", "comment": "Malware payload (SnakeKeylogger)", "value": "8bc401c8e1d3e5e6824c64cd713eeb5a683d97f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719534, "uuid": "c0a463ee-f86d-4bda-9425-28ef165bbd4c", "comment": "Malware payload (SnakeKeylogger)", "value": "d1597dba76ad19b18485ad81becbb4098482ca3a2400fe9fbce3017f5d8c5068f4541dbb9a9417f54fccc73de7d1875c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719534, "uuid": "726d8a99-972e-4aab-bc29-5655cd9828c0", "value": "T1A0252B916C5144D6D87B0FF06C3A752017B6AD9A8DE4402D3D8A7A2F9BF3343209EF5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719534, "uuid": "e8661b54-ae0f-4617-b17f-ba6cd68cc86a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719534, "uuid": "bad2f22b-6227-4781-bbce-e75c144141db", "value": "12288:ZEZab2iNuRuZupcMdyeT17oB7E1n2a9IzsV7j5txFVD:Xb1yuZuRdpT1xJ9Ize7jd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719534, "uuid": "b0956ba5-0133-4401-817b-b451f080b729", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719534, "uuid": "57b809ba-1332-48e5-9a76-852de378d94e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719534, "uuid": "8370398f-0acd-4733-a504-9fb7d12c284b", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753b66fb-d396-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680687868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687868, "uuid": "836a6a4d-20d8-42c1-8afd-16f1a270b969", "comment": "Malware payload (Formbook)", "value": "39f0289d03e15ee2dc83e561645c4a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687868, "uuid": "e6a4b013-1705-436a-b799-3a8cb772dbd8", "comment": "Malware payload (Formbook)", "value": "63e437a647e0cd76c38f1e73b5f1d5aa54c8e6a7f26cd31bd0fae9b1994751e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687868, "uuid": "c53bc9e7-dc9a-41f4-8e8c-80695f788e4c", "comment": "Malware payload (Formbook)", "value": "b20ed4c283b9af631ff89720f8242392c4b9543f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687868, "uuid": "cd180888-d133-4a63-9f71-b6599f0f7613", "comment": "Malware payload (Formbook)", "value": "ec1e2e7ed3564bbad018596c20dcb99cd31aa19b463bc9c9d448739408bb0f150e087aa11f3edd1797c5c1e379680fae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687868, "uuid": "ca2becca-7a2b-4323-a14f-bab72ba7c852", "value": "T1A605235117E4C4E3C1A011F7C4A913F91BBE9D4BDA70478F2B18BE4A3A787217A0676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687868, "uuid": "3df2c192-85ae-409b-93e9-db6ca6398158", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687868, "uuid": "1e16f093-2d2c-4056-aabc-bbdc58e1cd04", "value": "24576:uMwf+m50w/dByz96NHuhR60AkJApfZ5ZM1P3A6YlBE5GwM:uMwf0w/dsEwRTApfrW93AXbENM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680687868, "uuid": "a1bf51f6-8f49-45d0-8a1a-7366f5ec3b95", "value": 795192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680687868, "uuid": "e00295be-7bd2-43c7-86f2-e9facdb4301b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687868, "uuid": "6b369ff6-f277-485f-9fad-c0e0167723c1", "value": "63e437a647e0cd76c38f1e73b5f1d5aa54c8e6a7f26cd31bd0fae9b1994751e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d498b83-d3c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680707960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707960, "uuid": "5bf185fe-1007-490f-8524-4ea50d781990", "comment": "Malware payload (njrat)", "value": "36de0c0a242cb651364c4885ddaa2b88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707960, "uuid": "ff582b40-d26e-4633-95c0-79735b064356", "comment": "Malware payload (njrat)", "value": "64135b29aad6b2d04fbdb58f71267dd1c36ffa276b2d2221981302b07425358c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707960, "uuid": "79fae9ca-8d95-465f-9a88-5b7c852a3a50", "comment": "Malware payload (njrat)", "value": "fa3b9ae659ff70e4dc0ffa7edec3d8b88b85cde5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707960, "uuid": "309cdbb7-b50c-4084-abf2-5baf9c958c94", "comment": "Malware payload (njrat)", "value": "2af4e9bb2a8c5722248384333190a5af18e534dcf49c022cb75fd356771ceda0444ff3388a4daea4d635968ed203b345", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707960, "uuid": "1f409e72-4dbc-4a08-adc9-34809c6d5997", "value": "T1CFE2074A7BB54215C6BC16FC8CB313210772E3878572EB6F9CDC88CA5B676D04251EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707960, "uuid": "dd0238be-979a-452d-8bb8-c521b4ef2cb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707960, "uuid": "cfe5320b-ab69-49fe-945a-c8cdcdef0a75", "value": "384:l0bUe5XB4e0XfOD9Qq1pvmufCsIsyWTStTUFQqz9YObbW:mT9Bu2ZQqvvmu6tibW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680707960, "uuid": "5bc7c6e5-b27f-4068-9afe-9e54db0b81f6", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680707960, "uuid": "26db2274-c623-474f-969d-ee72700cc116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707960, "uuid": "89ca0ee6-3816-441a-9159-2d4666353c3e", "value": "xKIEKh88ABD4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4adc7ce-d3c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680709100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709100, "uuid": "bdc4abd4-11da-40f9-8f92-64eb4a454dc0", "comment": "Malware payload (Formbook)", "value": "11da302b0ec768a95348b07d7beb38ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709100, "uuid": "d6c9e19c-e8b3-4db3-b753-8813379b1a72", "comment": "Malware payload (Formbook)", "value": "648033f2f23e6a441081b5866c56f14b4403fa7797fa6c864fb0c1a8e12f7a60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709100, "uuid": "e7537a03-2423-439b-b280-01efde9ee41c", "comment": "Malware payload (Formbook)", "value": "d24c0de4e103d1cbf0364f11dfda098fd960a1a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709100, "uuid": "f58237bf-feb4-4b45-9889-f147ef20dd21", "comment": "Malware payload (Formbook)", "value": "d117ad07d2f8a03c8ef33a38746e5f325e4cf0d76145618a650fb742f5e9101afa6f1a0f18867975594ce7213574e064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709100, "uuid": "a77f7f7e-4ebc-4ffd-adbd-dd9d1f921dbd", "value": "T1E5049E36E701C031E3B211B5B26C1BBB843E1D353364A0A6E7E21AE56FA05E5F56931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709100, "uuid": "9aba0f9a-c573-498f-9fff-4ef222521c21", "value": "3072:lt247PD9MhNDTtkuJLz1pWMpOIlg71kn4V8xSuktX880U6kVpqRx6x1FYoCTQyO5:lEUD9MhNDBnP1dp6Bk4C5ktM80oVgqCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680709100, "uuid": "81ff04bd-b6d4-4214-88ab-f66869ea6f44", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680709100, "uuid": "d05ff127-6c71-4df9-bed9-7fdc76b23d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709100, "uuid": "120a3894-cb90-4612-b343-618806b9f3e4", "value": "648033f2f23e6a441081b5866c56f14b4403fa7797fa6c864fb0c1a8e12f7a60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bfd326e-d3b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680701247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701247, "uuid": "a1f25563-0275-49e0-ba3c-2227b27b6fa7", "comment": "Malware payload (AgentTesla)", "value": "cb0975c1b2be340821e4bc491d79c0ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701247, "uuid": "633ac2c2-a273-4935-85c6-132a23ec4325", "comment": "Malware payload (AgentTesla)", "value": "64f88fe49204514794b879601999c7432322c4ffa0839302422f057d4d9e58a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701247, "uuid": "a120e42b-691f-43fe-b58d-416e66b972fe", "comment": "Malware payload (AgentTesla)", "value": "d7d875c2e539cfdc993bdff1663b088b35de2ced", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701247, "uuid": "87036fb0-dfb9-4c3f-80c7-03143480c76e", "comment": "Malware payload (AgentTesla)", "value": "a50b7e3f81b53f1b869158162fe1795dfc01bb386c629506c8c7b75771ae3f1835c33854ca3588ab1ec122a08c60096b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701247, "uuid": "587e83f4-c3f9-48b3-b673-63f7ddc03d3a", "value": "T1C5F4E008E29D950AC426B53D80DBD2BC6336CD95E952C7E33BC8BD8FB2BAFD51516081", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701247, "uuid": "961cf59c-ef58-404f-8be6-985b173202d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701247, "uuid": "6f62a1a7-3e63-45fa-8c65-6152c92c6aab", "value": "12288:Sa0dbhJFryML3ubDBHbKlI3ZiqImPDBEIil8TzFk8IgRimOMt+HOa7d:VUhH/eLptIIBpO8BimX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680701247, "uuid": "d181fc89-e9af-4a71-a209-3cddfffb1079", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680701247, "uuid": "9a7453af-3e7d-4783-b4e0-7c5c4955f701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701247, "uuid": "43ab8800-de5a-4d1d-947f-4e8943d67dc2", "value": "TT Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee9afed-d3a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680695803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695803, "uuid": "fa3329ef-eb78-4da6-99dc-03e5f2cb4226", "comment": "Malware payload (SnakeKeylogger)", "value": "7dddcc994803ed6ec7d201cfebfa2acd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695803, "uuid": "7f9c1c9a-ef0c-4f9c-9704-a7b6e7b68859", "comment": "Malware payload (SnakeKeylogger)", "value": "65cef9a73e732b359256574dd3619770177a8db2d9d8a77c52caad320e0562a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695803, "uuid": "e4b3975c-ba72-4d20-ae73-1fe5df577269", "comment": "Malware payload (SnakeKeylogger)", "value": "50f550abd256abfd70f269cfca649751e5e854ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695803, "uuid": "a9c75de9-66f5-47b3-a202-983ccea3512e", "comment": "Malware payload (SnakeKeylogger)", "value": "b33cdc8dbc5eb296e19747e67f6a33c012e79cfa8af529dd2efce3ecacf5d8673131a93711ae01c165704a730bdb8fc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695803, "uuid": "53454d81-d4c3-4142-b175-d05b94e1045c", "value": "T19B25231933EC5B22D6DE473AD5A2321187F2F4716862F74E6CD2A8DC6D27B108D12B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695803, "uuid": "20cd625c-16dd-4a8d-91f4-1df88f817348", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695803, "uuid": "2527eca2-5440-49d6-897e-e777d9c95963", "value": "24576:Iatr0NtOMrlDyyNYUNzlDm2HIX3aYpGDmEZR3yY7YjBke:If3r4yqcoRQmEZRIBke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695803, "uuid": "8ebbf32e-4dc4-49d4-a78a-1af8966ae082", "value": 994304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695803, "uuid": "49a2701a-7ce1-464e-a26d-8521704a28e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695803, "uuid": "bc469d1f-a356-44b9-910e-d34702734b3a", "value": "Songa Pride CTM Request_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e90bd88-d3fa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680730806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680730806, "uuid": "c5696a2a-edcf-493e-9565-99d37801cc0b", "comment": "Malware payload", "value": "0ec6b76b1068612ea1456e77dd98ed65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680730806, "uuid": "da07c2b4-f86a-4711-b9a8-c7827f47bf4c", "comment": "Malware payload", "value": "65dd55edad391fcbf7fbddfe26b3389b9c8a765cc22fd490e522a8cdc39314b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680730806, "uuid": "8affe3eb-2feb-4c45-9018-0722f3ee5c90", "comment": "Malware payload", "value": "dd43788e4046916d03782b11ece438fcb92c8375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680730806, "uuid": "69052341-7278-4bde-8944-2544955fb177", "comment": "Malware payload", "value": "bc2c0438e844b1fb7dde81663569b8f836432f860e107314bc44f34550c25db0758707233fc099e9b79bd1b31f6f314f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680730806, "uuid": "c78a71de-4326-4659-b18c-a511fa83fda0", "value": "T1A8F4121071D1C0B2D5B755B044E9CBAAAE3A34320B35D5D3B69D5BFA6F202D2A3721CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680730806, "uuid": "45856202-4b9a-4d9c-bfb6-84ac72928bda", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680730806, "uuid": "95bf1c24-4c2e-4aeb-aedd-5f0e39829b13", "value": "12288:jh1Lk70Tnvjc85xcaQ/XLpAwYmlbtirLdQCdi3ayHU0VacKfz7KRZoR7LPXQ:/k70TrcVaY3YmofdTi3ChcA/K/oZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680730806, "uuid": "363f7c9a-6ad1-4d86-bd41-1631250d5145", "value": 769736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680730806, "uuid": "14b8b09b-f794-4189-8c3b-7ee7d5eef9e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680730806, "uuid": "6c42075c-e3e4-436d-875b-2d16e24f1e1e", "value": "RAW-PVNC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ce4813-d379-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680675440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675440, "uuid": "835b4d37-d6f4-4e47-a374-e360a776ee7b", "comment": "Malware payload (Mirai)", "value": "e570f5230844f432741798b6d6caf9bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675440, "uuid": "1a78084e-d7a6-4f76-8815-e65791f600de", "comment": "Malware payload (Mirai)", "value": "6651d61dbe8f72196515a131f3c6a5f33b19848304243d980aa390126eafa7db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675440, "uuid": "c2934ca9-4d70-4e40-8232-43ad8d828e12", "comment": "Malware payload (Mirai)", "value": "57699b5473c26883245d30e05ebaee2517f9d5c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675440, "uuid": "3922b2ac-5797-4df1-9565-c84722888c1e", "comment": "Malware payload (Mirai)", "value": "ff8ebe3ad6e715626e3c81f7424a2a5974d48cbd4ad65f71a3f5f03257ffbfffb629f667355aa859950af3647aea15c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675440, "uuid": "508b2190-0ae9-417b-be23-a3c15d86f3eb", "value": "T1686302F3466EF831CB09A67ADE9C95106ED79B398A5D303880421934F2F386D42A63D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675440, "uuid": "551c16de-5110-4dc3-a221-fb7ad001b4bf", "value": "1536:4G6kAks0cUNimNEU3RBJ7naJNctBUrzTCNLQUt6vHb2GMCKOC:F6kAScUgOBNI9rzkLQUtS2Lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680675440, "uuid": "ce47495a-af4b-440d-a9ac-b6004a619681", "value": 66924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680675440, "uuid": "4ee248fe-e93c-4486-adec-86c2f7064ffa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675440, "uuid": "97c56f93-33ea-4c8e-bd9c-4463335e8ce1", "value": "e570f5230844f432741798b6d6caf9bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb48ef6-d3cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680710593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710593, "uuid": "41a9aeac-d386-442d-9c45-925cf3552b73", "comment": "Malware payload (AgentTesla)", "value": "b8c51f1887ecabf9f31cfe114a7d7999", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710593, "uuid": "5b2b9686-dd0b-45fd-b8b5-16d77d3c5327", "comment": "Malware payload (AgentTesla)", "value": "66f46091f0fa300e0ecd50d12d42e53ff2768f71ea5426c549f9ddfa5b81eef0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710593, "uuid": "16b597d2-fed1-42fe-a705-178ac90f3d9f", "comment": "Malware payload (AgentTesla)", "value": "056799d686ba4f4d48b283b119f9a873d0d492a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710593, "uuid": "63c76109-5c3d-48ef-80e2-419b233c92ce", "comment": "Malware payload (AgentTesla)", "value": "a85ed2a424efef2d715f1622968424d0d61394ca905b16a97c3cb56bce8bb114b1125f4cd3288200194c79c84fb551d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710593, "uuid": "c6ad6af2-6ab4-4695-973a-9493c8c40ad2", "value": "T129861803B6D6CB62D2AD5373C1F2112817B5FD426222D759318E336A2F237A2AD17B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710593, "uuid": "067a0a2d-b643-4998-b3a2-ea5d111f569c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710593, "uuid": "36a2f6cb-8134-4dd7-9bf8-9c903ced5780", "value": "49152:iNAuQhtQzcd+wAVWIB/ffYCPxl/gPwjSXcKhLhF6i26q/nSh+DkYYBFuy56rrQ73:+KowU7/79YBYRRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680710593, "uuid": "4b07a975-769c-4e44-b975-8bfa0f91cb23", "value": 7874048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680710593, "uuid": "89d01be4-5ac5-4200-94c5-52e0a2628121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710593, "uuid": "91c88fa4-bd4c-407b-b659-7310c9845507", "value": "RFQ_Kss Enterprises#101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f599c601-d3a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680692378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692378, "uuid": "120674aa-b314-4274-9aba-e00721a174e0", "comment": "Malware payload (RedLineStealer)", "value": "6c4b36c294b2e49533022e802a734ffa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692378, "uuid": "edf6ec4f-366e-40a7-891b-3d20d9302110", "comment": "Malware payload (RedLineStealer)", "value": "69ce3d4b5d22aaa21f6f6f3168f92a8bcc02f23d35a40bb92e2bcc63842534fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692378, "uuid": "c589b014-11f1-4ca2-a570-1ce72f033af5", "comment": "Malware payload (RedLineStealer)", "value": "ecb55bf9ad26e746243a1a1191f196d6b731451f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692378, "uuid": "b4721651-929b-483a-96de-8e25f28b7e93", "comment": "Malware payload (RedLineStealer)", "value": "a69bdaa70021ef6ac4976a08b5d67cf27e6e896f2ac516da3c6edb917cab90113e3ae69322c77d183ce5cd81d68ecda3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692378, "uuid": "2fd9eb6f-89c0-4831-8c4c-d0938c0c9699", "value": "T18604B51437BCCD11E1BA2A3F6961A05147BF98026852F25B7AC367CD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692378, "uuid": "efacd855-5c3f-441a-8a6d-64cb81d3c1ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692378, "uuid": "8a88c8c2-6d2d-483e-92a6-34c15cb2d641", "value": "3072:yxqZW11a2kX8fqvPIeJBeGg9ShLrxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOJ:gqZkqvPZJ8Sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680692378, "uuid": "6023db3a-c8d9-43fa-b8ec-c3d1524aa298", "value": 179286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680692378, "uuid": "7abf091c-7eb9-4161-aa83-1abb9be4f3f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692378, "uuid": "adad31fb-e66f-4848-b3ab-15ae5bd9572b", "value": "69ce3d4b5d22aaa21f6f6f3168f92a8bcc02f23d35a40bb92e2bcc63842534fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d954e5-d3aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680696492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696492, "uuid": "673e8583-1d89-47f7-8d28-6b5143d72708", "comment": "Malware payload (AgentTesla)", "value": "12ab03404ecf1f15f6a5804a86d2c44a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696492, "uuid": "dc9b6285-75b7-4d9f-9dc3-3f85a8ae5bbc", "comment": "Malware payload (AgentTesla)", "value": "6a6df4875f12865773f743e410f22a36be3255b676895cc65ef6ea357fd6a879", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696492, "uuid": "eb2703c9-0e8e-4bb2-9555-64f8812c7daa", "comment": "Malware payload (AgentTesla)", "value": "e8fad76c1016ed3010a8a1b7c31ebecf39f59006", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696492, "uuid": "73203d4b-f3ca-4786-8070-ea5fa7557be2", "comment": "Malware payload (AgentTesla)", "value": "d4a2265eec71d24fc0a72a6cd3716da01ba784923d04061ff0a8120aeaf51f1c3550e87fdbf0b808e8b75f1e3c2b78d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696492, "uuid": "f937683e-d713-437e-be05-704a3078691a", "value": "T15BE2505AE38F02B48F511277161E1A899BBDB23E735051A178AC933433ADC2E02766FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696492, "uuid": "daf9e19b-6dbd-4513-b4fd-a38a2471eb5d", "value": "768:/hFx0XaIsnPRIa4fwJM2HW2ISP/job1VDjAJoSXUh:/hf0Xvx3EM2HWXSPbob1iUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696492, "uuid": "4de995e0-e71e-4816-b70d-91a607fd78a0", "value": 31781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696492, "uuid": "22dec9a0-993e-4eac-bee1-8e5ded266b8d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696492, "uuid": "94f961cc-eb26-4897-a802-e8e943cbcc6e", "value": "PSC_ A-2303310.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c00719-d3a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680694227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694227, "uuid": "0d0e0c4d-bd95-4d14-8b17-456985004fad", "comment": "Malware payload (RedLineStealer)", "value": "6f5d5171cd1d32e4b4320d1d7c46374b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694227, "uuid": "b9e155a9-303f-4a2a-9eca-41e2f5fee6b4", "comment": "Malware payload (RedLineStealer)", "value": "6c68061833a46b0eea57d7ccbd62c8d0c68eeefe51b070febe15188d327dc762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694227, "uuid": "305e0b3e-cb0b-4d8b-a393-ba913d8ad55e", "comment": "Malware payload (RedLineStealer)", "value": "5f1c7c31ead1f985e6bd5ed0e577e305fed71da3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694227, "uuid": "8733f102-e8fd-4ad2-bf80-c10a07b0105f", "comment": "Malware payload (RedLineStealer)", "value": "a959c3e58c82710c017e2a38374f1841554bbe4d7cabd1ece1f1afb572ede61fe33f6ad91450d9fd8ee0ee649c22271a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694227, "uuid": "a96306fe-6f28-4be0-8bd9-44e8a462a0ac", "value": "T1DE352323E9F48072CE792B70AEF002530B31BCA1893DD75B1758195E1E326D8A5B5B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694227, "uuid": "19fcf3f9-095d-44cd-a012-0ea44bf10247", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694227, "uuid": "cf4d4e1c-c69b-45a0-aad2-26813e80a38e", "value": "24576:QytcLoUCtvlHb/exbbiRCDi0KDrPLUWZIajBiEs2xLqecVj2ASzMmP:XiLoU8b/Kbbi7zDrDtdjB6BecBCzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680694227, "uuid": "e1fca46c-cf8d-49f3-a999-32720a75a8ad", "value": 1144832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680694227, "uuid": "2ea2b147-7c7d-4a87-af24-b295f3881048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694227, "uuid": "c821dd17-b9cc-40ee-92cc-b02dc7c2f3dc", "value": "6f5d5171cd1d32e4b4320d1d7c46374b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3b4c23-d3aa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680696498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696498, "uuid": "e198b4c2-285e-496e-8490-4ff1c337c7cd", "comment": "Malware payload", "value": "34d22071c39d6bd314e403e8eba0c753", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696498, "uuid": "35be1efb-c929-4fc7-80c6-6ea55ea4f156", "comment": "Malware payload", "value": "6d5a6f627ed27921596c22ca0344dd70495549c8b3df17e2067f865980f78238", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696498, "uuid": "bbed3f02-49d3-4ecd-ae48-20b716ee08d1", "comment": "Malware payload", "value": "8a9f2ebc44e1dd885e36541d9064f43e98b9fcac", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696498, "uuid": "3aa4eb31-bd6a-4df4-aa40-afdd1041f8eb", "comment": "Malware payload", "value": "bad34012ccd051b4317a6ba89983f86614b0171df13ebe16b442529f2e3df1fd7b2a541c2e9b95e855582cf9153e4495", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696498, "uuid": "12a4dd1e-e6d8-46ca-b4e7-425857b9357f", "value": "T138934A427696DE5EFA21873149E747656333FC308BAB47473224B3293FB9DA04A0771A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696498, "uuid": "6670e28a-15fb-4288-80fc-4b71e1cc98e3", "value": "1536:d6k3hOdsylKlgxopeiBNhZFGzE+cL2kdAdHuS4lcTO9Tv7UYdEJi9az:8k3hOdsylKlgxopeiBNhZFGzE+cL2kdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696498, "uuid": "459726ab-18bd-4639-8ec8-fea4e8604d4c", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696498, "uuid": "15cf0e81-a7a2-44e5-b5ee-c333f96b0686", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696498, "uuid": "f5ee7bf7-4775-4884-b034-1c80e8e23878", "value": "34d22071c39d6bd314e403e8eba0c753.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27637f23-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680718232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718232, "uuid": "dcab10dc-6e1d-4c8c-aa53-fa5694805421", "comment": "Malware payload (Loki)", "value": "b02e6e6ec6abc24c2a6fca969699d8e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718232, "uuid": "52a07a6c-9cfa-4b0f-a1a8-595de6f77d09", "comment": "Malware payload (Loki)", "value": "6e3322a3a24b94c3b8355d8ebc8afb9ea0ea3eb309736181f9d72728199d9794", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718232, "uuid": "b40bdbb1-54db-4c5f-ba8f-7efdbf1d0b95", "comment": "Malware payload (Loki)", "value": "3ea543a37018b8508baae8da3d9b3481f87252ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718232, "uuid": "e817c0da-f58c-4705-9d3e-34290c44f9f2", "comment": "Malware payload (Loki)", "value": "364bf0be4e6256ea29b7dd7feb4c2a970dfa86d9a016d0e194fd6633ba584578ec5496b492d9327772123127cb104834", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718232, "uuid": "2ef8c58e-9888-411a-8106-60af368d0851", "value": "T12F65DF1263ED8360CF735273B625AB01AFBB78A50520FD5F2FD41B79AF60162520E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718232, "uuid": "f134be29-df8b-4c08-9624-e66c1985032d", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718232, "uuid": "08571d33-14f1-4d97-9902-c4bd4879b339", "value": "24576:Q8F+0eKTosPn5f85ufAma9V9I/WUf03UCLhbKrRbN6A:TfsKnekfAma9I5f0xLhbWh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718232, "uuid": "5361cb86-a341-4f52-bf69-321c4e70d8c7", "value": 1417216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718232, "uuid": "a384b632-ded0-41ac-bb5d-80ad62205ef9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718232, "uuid": "7adadf1e-8f8f-49c4-9219-c81f61a5f7b1", "value": "b02e6e6ec6abc24c2a6fca969699d8e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2023687-d39f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680691862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691862, "uuid": "01a589ae-3f1b-4797-a05e-f4d236b978b5", "comment": "Malware payload (RedLineStealer)", "value": "c5dd023f8011ccb36487cbb5c9d0badf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691862, "uuid": "82741d62-0f83-408b-a778-ab123f63610e", "comment": "Malware payload (RedLineStealer)", "value": "7016afd4aa13923a95ff6fd67b2e42b91f55fd31e20930af14f289cd9b19ec0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691862, "uuid": "e1d60b78-dbeb-4159-856d-d3e245aba778", "comment": "Malware payload (RedLineStealer)", "value": "a67e24c344df3cefdd1dc924db45ca67e101e3d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691862, "uuid": "49258db7-a263-4ef6-9da2-185231090ba6", "comment": "Malware payload (RedLineStealer)", "value": "8dfb46237361eddb1978a8ea255bf985281ffad6f55c460d49dd2bceb083dc6e8418f3b4c5cb581323166cff80c852a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691862, "uuid": "50399751-80a5-4404-858e-e824a3fe2dac", "value": "T1D104C51437BCCD11E1BA2A3F6961A05187BFD8026852F25B76C367CD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691862, "uuid": "2d2ee6f4-874d-4ba6-b5c7-e2bf12c349ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691862, "uuid": "cd32ad55-674f-418d-b9eb-fc8a73549c8f", "value": "3072:4xqZWZRanU2n0/Z62eJ5evJ9ih+PxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOm:mqZg/Z6XJIih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680691862, "uuid": "394aa326-e96f-40b7-90c2-c480f12001b1", "value": 179804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680691862, "uuid": "bf7d4845-42a6-4018-ae8f-cd8db1ff381a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691862, "uuid": "2847e7d4-5418-4eb4-8c11-fe7197d22d47", "value": "7016afd4aa13923a95ff6fd67b2e42b91f55fd31e20930af14f289cd9b19ec0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa28d7e3-d39e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680691527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691527, "uuid": "d0aacdc3-b9d8-4e80-868b-a18ed64bc2db", "comment": "Malware payload (RedLineStealer)", "value": "9e6c67e20d54ad59c5c14774e4f40c98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691527, "uuid": "b95a253c-2605-4e74-968f-255860f89171", "comment": "Malware payload (RedLineStealer)", "value": "706a150062aaeb72c33c990b355c3d7c68f735317a5201ce006aeadf6c7df2a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691527, "uuid": "49289a79-4455-45ec-941e-f71e19495425", "comment": "Malware payload (RedLineStealer)", "value": "240b5f0e97265c834d88f9b5446dc94e10265040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691527, "uuid": "4f9b5bfc-fd08-46da-acae-70a631b76411", "comment": "Malware payload (RedLineStealer)", "value": "d74df57f9113a9b811450f9ccb520a08336230fcea94ca945efb4f58eff220e9f499b0c3ef0dbcca6a730a4f27a91b34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691527, "uuid": "47be7d56-8f71-4755-aa39-aeb3f914871e", "value": "T186052246EBDA9036CAB85BB10DF203C30735BCA25D78C3AB6355985E1CB35C0A571B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691527, "uuid": "e283850f-e2b2-4c8b-88ab-a71b2cc480f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691527, "uuid": "2448fdf1-5c75-4221-a201-79e98dd72a67", "value": "24576:Iy91Af0K6yEXJkSWZEjBtBf2kV2EH9YLBzs2v:P96z6yCJemjBzAG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680691527, "uuid": "58cfa13d-d448-4f65-b3e8-024f320784e6", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680691527, "uuid": "4802d801-b758-4793-9c92-f9f9a8f7ae41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691527, "uuid": "e8bd9623-f5a6-4e89-ae70-faa9ab7dfc97", "value": "9e6c67e20d54ad59c5c14774e4f40c98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45d3737-d3a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680695812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695812, "uuid": "3b7a431b-7dcb-4e42-828f-e6e91aeaa28e", "comment": "Malware payload (SnakeKeylogger)", "value": "ef77884f33d230e2b37de22032c360d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695812, "uuid": "8568d3c6-0565-40d0-9f22-c997bd060806", "comment": "Malware payload (SnakeKeylogger)", "value": "7083c8ed81099db6c891014f96b0a56b880ac92bcdc9c681869f74594c3a3a7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695812, "uuid": "30105f16-d6e3-4beb-a97d-babbe6affb29", "comment": "Malware payload (SnakeKeylogger)", "value": "a2564b8ed45d40fca54aece3786662b3c71f1991", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695812, "uuid": "26e915c3-2099-4a7a-b768-1799f858976f", "comment": "Malware payload (SnakeKeylogger)", "value": "344e4cb5ea109c24b22ef7389421cdd742d9eb5c2381a9dc522301c604e861151813186e316ee90fe5748355118e8c7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695812, "uuid": "82d5dc19-2fe0-43f4-ac1f-636b4612ba7c", "value": "T197155DD1F1908C9AED6B09F2AD2BA53014E7BE9D54A4810C559DBB1B36F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695812, "uuid": "8b6959cd-e4a3-47f3-92b1-b976aa0d166e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695812, "uuid": "910e4b0f-da8e-4a0c-946e-0af5b3f2a162", "value": "12288:f+N3cT0lU8vigGGORN3FZTAt0xthNr/7nK9aNzCBiEFOayC3C:fgk0lUMigGNBZTAt0xPZK9aNz894", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695812, "uuid": "f047f792-1ea8-4d1e-b812-8b14463562c7", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695812, "uuid": "ebb2fee6-d722-444c-aab9-e1d1aa5b4c26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695812, "uuid": "1de6ff19-e76a-43b4-b57c-4806e204f8e6", "value": "NEW P04564.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4f8b75-d3b7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680702023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702023, "uuid": "7e02030e-45ae-41f0-8220-dc5c03cb51ef", "comment": "Malware payload", "value": "997dd8e1f951664764d16d33fac161d2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702023, "uuid": "52de8b1b-2fd6-4761-82d7-9b1ccd5cb1a8", "comment": "Malware payload", "value": "70f987fab68e6d87aa1aa6e98fc76acb20f8e8fd8621e56c5764f48c3aa517bd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702023, "uuid": "94076110-6900-4b38-9b22-041cd6026448", "comment": "Malware payload", "value": "a7d5542193af4d8caec561940174b1bff3e1167f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702023, "uuid": "9305f52c-4f66-4fc0-b957-e3872f40b177", "comment": "Malware payload", "value": "fc1e0234c89b579ac84fd03201e7e94fc83567e9300e43939d2c9d8e41312d566a880f1b5ad3624a7574ee150a74978c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702023, "uuid": "dc11c85c-ff99-472f-8e39-47e21f01057c", "value": "T1EFB56C23B384653EC0AB2A39593BF724993B779166128C8B5BF4484CCF759807F3A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702023, "uuid": "0a781e19-a13a-467d-8352-fbb3485c6e46", "value": "e58a4956081d3743d1b2a41b659f2b69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702023, "uuid": "5991f2a2-9ac7-43ff-ad92-018c64a471b4", "value": "24576:NYyf+IaEP/MUYKUvtHxZfxd6n9HDf2TYhG5hSgj05dBXS75gIJ2DM/5roaJLW/Wo:1afBZfn6JDi5FQ5dtSdgIH/5roi5VzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680702023, "uuid": "9c0d042c-ed76-45a7-9366-e32f1672f6b2", "value": 2391040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680702023, "uuid": "5cbcc7cd-77f8-4318-ba93-fcc14e32566e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702023, "uuid": "5b081b19-3db8-443e-90a7-a43c5c411645", "value": "SecuriteInfo.com.Win32.Evo-gen.8161.32668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1bfd003-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680700505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700505, "uuid": "80d1ab99-2a3e-47e7-8b25-1fd96a3be40b", "comment": "Malware payload (Loki)", "value": "d994933d0140fa8e42ffa96dc9cd4d29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700505, "uuid": "160999c3-4a7f-49e6-9706-344498261500", "comment": "Malware payload (Loki)", "value": "72291fd7befce6c37a8b6b8ad7b5b96a1b428356d365f7d3bdcd9c4dacce27c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700505, "uuid": "9af62b13-125a-48fe-bb14-ad3394f6ee4e", "comment": "Malware payload (Loki)", "value": "596986f78c39a1319f25b9763bf263b50ff6922e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700505, "uuid": "f34e1699-b48e-4f5b-8210-13a9490fd617", "comment": "Malware payload (Loki)", "value": "fb5fe8ada9e886090e6319fa76b6e03494fcdc31c59624991baae5a168c10480a81d3232b3a9e09225ce9a1d322a6214", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700505, "uuid": "77e22a12-5f7c-4757-84b3-d19a5e5b0253", "value": "T14FE47C2E8E14C2F4F6BC07B5D0D37F192DA409A247E6851CB97B61C63B85B895C0E98F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700505, "uuid": "9d4085eb-58b1-497c-bc47-2c21ecf8800f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700505, "uuid": "aabfb03c-af9f-4ff6-939c-3bf76e5fbcd0", "value": "12288:YwFZcJqN2iNtHote2yiIpUeEdRPnrgRoO0Eqk1XNRvhlTDcaC:YwFZZN1rHp25IpZEdRvUowqk1XNRZlTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700505, "uuid": "e3152716-281b-460c-a62e-1a15fb199bc5", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700505, "uuid": "ce474039-a04d-4782-82ff-781f3ea82c0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700505, "uuid": "612650d5-f659-4a75-a9ea-90ee357a59ff", "value": "d994933d0140fa8e42ffa96dc9cd4d29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbcce2d-d367-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sova)", "timestamp": 1680667692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680667692, "uuid": "8185903b-a113-4e9b-bc11-88924c944b1f", "comment": "Malware payload (Sova)", "value": "056d831fb3f4423ea395c02d68841887", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680667692, "uuid": "80c78aaa-db02-46c6-898d-547c63abeb75", "comment": "Malware payload (Sova)", "value": "724a56172f40177da76242ee169ac336b63d5df85889368d1531f593b658606b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680667692, "uuid": "1718ca4e-68fe-44e3-affd-92693f3df57f", "comment": "Malware payload (Sova)", "value": "7e7c3a6eaf542db371ca38a1ad9d6728b5d13daf", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680667692, "uuid": "1c8a971d-0a93-41ef-9dea-6f9a02be155d", "comment": "Malware payload (Sova)", "value": "c9b7b224efe6f2215419b89b48bd1538c4b5217d3c295dd2e2897616027961bc8bf71b7800c5b08d8e51ee2014fa2460", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680667692, "uuid": "5944bbbe-f8f4-4fba-99c0-4598a880644b", "value": "T1EF66334BD54DEE0AC8D6C532575D456EEB10438B86B0FB62AA6C32CE18F7D854A0BFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680667692, "uuid": "0dbffdce-613e-4e5d-8ac7-0fa4109ea65e", "value": "98304:6tObNxGuckjHfKQ2OXa1m5l3AMZTn7KKGDaY/2gZ6gjFAYJErRKmkPS:6tObNZKQ2OK1m5l37Zr7KKGegqW8QzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680667692, "uuid": "fdfdf95d-8d6a-41f8-ac34-a8d2a938e675", "value": 6570308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680667692, "uuid": "93337a3e-bcf4-4a2c-b894-63da06ca4c17", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680667692, "uuid": "89b2392c-175b-41b6-889c-ff0563a27b0c", "value": "dump.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320c4af1-d3e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680719538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719538, "uuid": "902cefc2-4682-46e2-a433-7d90b14e26d2", "comment": "Malware payload (GuLoader)", "value": "d8bc3cf51b8aee3622dae45d163794b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719538, "uuid": "22d9d359-7609-4fc0-bb54-d22e0f374548", "comment": "Malware payload (GuLoader)", "value": "728d23546a438f5238ca4a534635f87086f2ffa4fc71e215a0222a733700de96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719538, "uuid": "49bdf0bf-c1f7-406d-8c30-63bc77754cd1", "comment": "Malware payload (GuLoader)", "value": "bce0e2c346036251c3c708931a163bedd9475a51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719538, "uuid": "5bac76e0-75f3-42d2-b7e5-bfe724016e10", "comment": "Malware payload (GuLoader)", "value": "b17fa0b198fa4d501d1612a65bc8d05d65619b1b91a3f186abeba703a9d0cb56180836fcfdceefa394a6919961d2521e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719538, "uuid": "760d9684-188e-4bab-8749-cb473e5197d6", "value": "T1E3E4F10A7D01510ECD6589338C735FE22EB36D2E89E81A1113FEBA5F98367D2765C683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719538, "uuid": "1f838f57-1695-468c-9c44-9a8145d639d3", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719538, "uuid": "f4c83bdf-0152-4adf-8910-c89346990b28", "value": "12288:th+G1b/BfuqutQpHT6kOZO2IGlkr21rYfRChEa+CeKdH:th+G1b/oquOdakMlAulhEjsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719538, "uuid": "227f0535-065c-444f-b8df-f0d40204d666", "value": 659784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719538, "uuid": "d81026ea-140b-477c-b794-80134698ea7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719538, "uuid": "f19099d1-2595-46f4-a118-ccf574e493ef", "value": "Dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dabca4f2-d3ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1680698346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698346, "uuid": "f2811cc5-f0c2-4ad3-bb99-9a8665e6923b", "comment": "Malware payload (Quakbot)", "value": "19c1526182fe5ed0f1abfafc98d84df9", "object_relation": "md5", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698346, "uuid": "77446e0a-3c03-4c9b-b5b8-6599b134f73d", "comment": "Malware payload (Quakbot)", "value": "72b9c35e5d062296103564db4d629b253030e5978757abdc059c67c4ad086aed", "object_relation": "sha256", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698346, "uuid": "d01c99ec-e35d-4ee0-8d74-6ca6e2810b1c", "comment": "Malware payload (Quakbot)", "value": "b002e5340fbdc55344b2738367e4ea79f08df8a7", "object_relation": "sha1", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698346, "uuid": "2965a3d6-974d-4e70-b9a8-49ddb92f21cf", "comment": "Malware payload (Quakbot)", "value": "d7aa18ef50e518aba059edb7a5ad553f1ab29ba12ac6120452aad82dba61217374b4bbb8741889f8896f75fd4b18af25", "object_relation": "sha3-384", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680698346, "uuid": "5d2c607b-1456-481f-971b-7a0124e79172", "value": "T10A44CF43BB91C475E4D301BE217D97FA0E3A4A2C87A3DAE74FD05594C8362C0B63A65B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680698346, "uuid": "0d37acfc-0109-4b2e-9b9a-2af8485528d3", "value": "6773aa39021b4b6dbb81de5fec9e5772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680698346, "uuid": "28eef80b-cf19-484b-99dd-4bc0478141f0", "value": "6144:de73XJK8VCoxyusKqXkfbShAzYXgxMBtARW+Wai:kJJCjKzfbGXXgxMrR+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680698346, "uuid": "8af15637-674e-4117-83a9-118e5da30b8e", "value": 264257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680698346, "uuid": "6ec0206a-c49b-4174-b60d-2402d0f082a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680698346, "uuid": "2f6ddc97-1dcf-4552-871c-97594819292e", "value": "Bestamp.catoptromancyCorselet.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3401b5ad-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1680718253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718253, "uuid": "7380083f-61a6-4d34-a907-7139bf25aaa7", "comment": "Malware payload (AveMariaRAT)", "value": "657ecefa96e9e2aad4975964339f6d88", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718253, "uuid": "76b042f2-beba-4448-b250-15941ec5b26f", "comment": "Malware payload (AveMariaRAT)", "value": "73a4aa86764da7b0fc32b8112040098b1a691a83a0f5168afccbc34d184b50e5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718253, "uuid": "6d3d2491-8c0a-441c-9553-81041985ceec", "comment": "Malware payload (AveMariaRAT)", "value": "c041038ccc3ec0bb069c8200ca80f0b8345f8361", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718253, "uuid": "2c7fd4dd-a67d-4ad5-90b5-d87f7a985a00", "comment": "Malware payload (AveMariaRAT)", "value": "1d5af178d52ecb7433aa65210ed5c8a74abea91afcab2697a2d93b032cc71fdd1f573b34c6e913a2789b3039ddfcdcc1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718253, "uuid": "29ca78bc-c68b-41b8-93c0-c6e3b5a3bd24", "value": "T1B885BF3307D1FFD7E7B5BD76D84612048CAA7C7B2218DA68B8C8A19E51B5D08DC4B8B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718253, "uuid": "171ab742-2827-4fa4-9745-0156fed8e3ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718253, "uuid": "fc60d66d-8001-4802-abc3-4a8b9eef9bd6", "value": "24576:1xYG/b9jNHjWdBxhtvS77w4gl0HA4QE6HsIyoUZ8pdyC2cyft0jFFwSnDB6COT+N:o2qPtvq7wNl0pMQwdqvi/oQlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718253, "uuid": "f84cb633-f74d-432b-9d4b-b26ca8fdf419", "value": 1861120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718253, "uuid": "d9b657ac-a096-438f-a3f1-624ec5de8678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718253, "uuid": "bde13733-a2d8-4087-b3a2-eca0c150a9e9", "value": "QUOTATION_ APRL 310377FIBA00541_PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d477f41a-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680699624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699624, "uuid": "c8803cba-f9f8-4d94-b455-831ca59d1777", "comment": "Malware payload", "value": "462f702baf9dd41fcad0d8f1d82157fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699624, "uuid": "e67e0629-6ccb-40c2-ba61-377e476a3c06", "comment": "Malware payload", "value": "740d44584ef65e610979f22b60e8860f709b9b48e9af1473862154f8903366a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699624, "uuid": "d4f66974-d369-4b48-be00-68047a561899", "comment": "Malware payload", "value": "e4df373dbc801d7ebf0eb1ce8a8b39622a1ffe44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699624, "uuid": "72c1a61a-a470-41da-9385-fe30c49046d9", "comment": "Malware payload", "value": "22a654c7e37806a3798a616f3ecee4b523148fb717263c32616ccfc0e4fd8e060c5ab42c11b366c35619b9132b397aef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699624, "uuid": "b8001f5f-fe69-4f32-aefc-5d6009a5ec49", "value": "T11846D701AFF84D16E5F61FF8642517A8DEB4FC669ED2AB0A300DB0AA0F35B450D536D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699624, "uuid": "32a67e8a-dbcc-4d2d-9485-63642fb0d50d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699624, "uuid": "1838b556-8979-4b05-b7fd-75bd3084f609", "value": "49152:fFv2f1L9T0G8LfFAzNFoi3azajo4iSOIzdz737/tml89jHy9I7r8C:Af1t8b4nT0ncr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699624, "uuid": "b7f57b31-d23e-4ec9-9798-165208dca54b", "value": 5369344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699624, "uuid": "751ab37d-07d4-47dc-9cea-72311ffd6d53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699624, "uuid": "33add99c-4cd6-4597-bb87-298375c1c641", "value": "Order_NOMT101748MACRH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b27c39-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680718205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718205, "uuid": "db9b55e0-5b08-4288-b4b9-08dfa27c749b", "comment": "Malware payload (Formbook)", "value": "0b92c0d90964c501b37a944c5ccc01e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718205, "uuid": "697d4331-f0f1-4bfc-b799-6ae00247d33b", "comment": "Malware payload (Formbook)", "value": "74b472ebfa120b3c19287ed837c243b65de17bd647eea036d338b17f5e2ec548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718205, "uuid": "1a3362e9-5f2f-4d31-84cc-6481aae0d958", "comment": "Malware payload (Formbook)", "value": "36bbbc5bcb3ee4aaf7c7cd6034733a6b5504e38e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718205, "uuid": "5e376c7f-e6ce-4152-8e00-18294e981f5d", "comment": "Malware payload (Formbook)", "value": "ce6b1737cdae1e4a807377d8b2dbdf73deb562e8152be74a4cede909c75429522680723c7274c9114a4ac520fc34cfe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718205, "uuid": "3b7f48e4-6424-4542-9c46-4ecbaf37fe38", "value": "T1BE35D02AB2F07532D1EB063D4C1BE7F8955ABE1239A498093BE7794CDE3425078263D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718205, "uuid": "b84c4349-a893-4d2a-9ff2-35c9e8dc4f13", "value": "30abb98664574a11f503e7dcaebd2167", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718205, "uuid": "1ffa8dd5-e54c-447e-8ec9-11f0eb2234c3", "value": "24576:v6R9yfVUXwTEfF59XADz3OjaZQQJ0nhUGfApjLM:v6mO0MF59XADzejakuGfAtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718205, "uuid": "44a8b142-6a3d-484d-9784-0f0043706dae", "value": 1058304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718205, "uuid": "25af6557-70b7-4eea-bd12-3db92bbbb50f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718205, "uuid": "10545bb7-d0e2-4e4f-88be-91a15f26be7f", "value": "387263527630093.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621f5bdc-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680699432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699432, "uuid": "b95dbf85-f2f5-4c20-85e0-b9c33feeb8ff", "comment": "Malware payload (AgentTesla)", "value": "8bc82ae9b9681cba1a83c134df628219", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699432, "uuid": "7be6791d-872f-4e57-8ed1-bf4f528c2f18", "comment": "Malware payload (AgentTesla)", "value": "75d23412a06fcd5ca151bcdb30972f130fd10fbc1747dcd65b061218a0d4f470", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699432, "uuid": "cabdcce6-fc48-4f07-8d62-0ad2d0bfe197", "comment": "Malware payload (AgentTesla)", "value": "025a06dc1abcd9df981d94b8eacfc53f2cce53b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699432, "uuid": "048fb026-ebba-43e4-a146-1a2312342cc6", "comment": "Malware payload (AgentTesla)", "value": "6bdbb0f30e4a55eff6f3b6d0dc2e9a3fc5d4bbab9493a9ee720c7686782a1f054ab9c00bd1d542b74736087aa2cf92af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699432, "uuid": "b76d19e4-16f7-476d-bf8f-6f30d76753a5", "value": "T1765639466BC99935E1BB8732A4F86209C7B4E8219356D71F304CB1BA2F25B156C6333F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699432, "uuid": "82c8a491-29e8-4b1b-b86e-9aa843bc22a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699432, "uuid": "286a37fb-9660-4e07-9943-d1f754fa804d", "value": "98304:Cd5BO4lMtoiULVQIj5jsvPAcOC7zjwgL1:C3Bll5BQIj5jSAch7fD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699432, "uuid": "5c9a0b3a-1297-4bef-8c62-f166b401cab6", "value": 5939712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699432, "uuid": "534401df-9611-4c03-9bcf-0681a68df246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699432, "uuid": "8817e891-36fa-4d7e-b38b-671216439c56", "value": "Quotation WSS ADM GLOBAL. Limited- Basel 8100224953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec2de90-d37b-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1680676234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680676234, "uuid": "9799e323-f6fd-4c08-96ec-a0cfec80e7f9", "comment": "Malware payload (WSHRAT)", "value": "91e1450d1ada0ac9449c8d075c1d5777", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680676234, "uuid": "acb6bc70-595a-4bf1-8180-ce372984254b", "comment": "Malware payload (WSHRAT)", "value": "76ef8a2c4b1f0f034be3f6de459dd54caa0ba987d9ba906b71fb43b491dc4425", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680676234, "uuid": "5b3bbfb0-5eab-41f1-bb49-dfa87e965192", "comment": "Malware payload (WSHRAT)", "value": "cfe195a981cad4c1ab7613639ef183a63b4d5407", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680676234, "uuid": "1290010f-33eb-476c-a68a-36d9e2ae65b2", "comment": "Malware payload (WSHRAT)", "value": "c87da4afbf6fa9a330d01d2882ac98d34c4e680119a4a50eaa7eb0638a6bd88fb3b9255fc177b06c7c471ef2c4d210e6", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680676234, "uuid": "f4664da6-58b9-41f3-a82e-23f59c298530", "value": "T18F3415023D8BFA3C155F2D0565302E769F8EFE75C61951A22A496F3D83AB08D137F42A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680676234, "uuid": "3902287b-0528-43a9-9342-b6da65082bc5", "value": "768:7KP2y6P4YDe1qkFc/kfcv/Dxf8vXIxOQzzM4MUnJtzJH/S:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680676234, "uuid": "083ff29a-5682-4265-b758-4058c92d297b", "value": 244149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680676234, "uuid": "763f75f5-86e9-464b-a00c-a7cede40b641", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680676234, "uuid": "40f588d0-a6f6-4ded-a581-5be77212512e", "value": "ORDER50423.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ac4800-d3a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680694226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694226, "uuid": "82255095-0bba-4526-8851-2d4c41f71b24", "comment": "Malware payload (RedLineStealer)", "value": "229cada74cb718227a757e25c084a416", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694226, "uuid": "21bb345c-cede-4405-9d6e-9231b4a4e731", "comment": "Malware payload (RedLineStealer)", "value": "77edd91a4c8463ab782c4b7c30a54b14609a540e48523c7bdc5a324b7189dbaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694226, "uuid": "51f2af2c-954a-4e04-aa2c-aac7f6d452cc", "comment": "Malware payload (RedLineStealer)", "value": "301d541b8a05fe939143490c6bbec146ef8fab38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694226, "uuid": "b2481ce5-9752-4c44-83b4-1506bc1037ab", "comment": "Malware payload (RedLineStealer)", "value": "3c0d8cda40f671e0c339cb205a98d673de3619748f420214c241f537eb672d28c97579072a4d68d87d91a2cbc1d38413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694226, "uuid": "63f3f026-d4a3-42fd-bdd5-843d03f76f09", "value": "T1D2E41247E7D88063EDA127F02DF603870B31BDA25D78476B2B59691E09B3AD0B43532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694226, "uuid": "61d8302d-c9ce-4a4c-93a8-8928e1749088", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694226, "uuid": "4570c76e-086e-4eda-aa9c-65384af25535", "value": "12288:1MrPy90I17uHOwF5JkhT9U/ZVjBfmeyd/Yzt2sTSzcHR7o4VA:Wyf7ty5She/ZVjBMgB2sTEg7o4VA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680694226, "uuid": "12b89c1e-77d0-4650-911d-4d3537596aae", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680694226, "uuid": "82cf9f03-7120-42fe-a00b-59aa559db6d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694226, "uuid": "ec1b9a3f-6137-438c-ba83-adbb7089c2c4", "value": "229cada74cb718227a757e25c084a416.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd816175-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680700445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700445, "uuid": "6f8aae2c-6184-46ec-9d87-ed1377441ecc", "comment": "Malware payload", "value": "08417efe2893808f806546e68c8cbe91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700445, "uuid": "46377e4f-5491-4754-a872-2ba45c8f3400", "comment": "Malware payload", "value": "78f5b77edbc8e63bdb279aa6fb32365045f904725e2212ff846afde2eb40d5be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700445, "uuid": "05f5c84a-6e65-4a10-9725-7ca3eb55e03c", "comment": "Malware payload", "value": "8cf7fec7652105e1fb4b61e2515b70f2103f7aee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700445, "uuid": "2fa14e8d-3151-4426-9920-3589e9d7820f", "comment": "Malware payload", "value": "8fbcf4352391ddeb805cd8f6a4ebaf3dfd5bf36d6111525c06e7b05fa0c639c60ffa7b2b8400d50d971c93973ad39640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700445, "uuid": "57a6f9f9-6e9e-429a-9b4c-19a563f8ca1b", "value": "T1E5E54B33777289A3D2592733C1E605140F60EA73A723DA8A795B13DA1A03BF65F4472B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700445, "uuid": "74b2e223-5d7b-4812-9b6a-1afd6312ffd1", "value": "24576:ZHgQPxfQJySWpRWKVhzL5xhQUmQmSjGSu92lbaNhGqbu70GhYnrXfuvLC1LvNS2F:ZHVpQMSWLLKUmQUSgYaNrb5c90DNQdjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700445, "uuid": "98819bb6-18b8-4d0c-8b62-3002e6c2f0df", "value": 3114759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700445, "uuid": "ea6d3d36-a8ed-4726-b049-6c84aa5cefba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700445, "uuid": "95d60e66-b0b0-4caa-8b0c-3ef73a7d3b7a", "value": "08417efe2893808f806546e68c8cbe91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6836acc4-d35f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680664224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664224, "uuid": "a945aab8-b676-4a5c-b87b-e56f23697673", "comment": "Malware payload (Stop)", "value": "2528e082b04cadd6165b409cdf03f0e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664224, "uuid": "bd1b116e-6692-4e17-a564-167a2f9d0d62", "comment": "Malware payload (Stop)", "value": "78fc786e24f59fdd6945b84fde4a2909aec70e98aa90ffe418eb51a62b1dbb81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664224, "uuid": "238d073b-0ff1-4725-ae67-7a4913aa3c91", "comment": "Malware payload (Stop)", "value": "dedf9595821b4cf8b5538b6a09260b33ce9f24a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664224, "uuid": "91ac3c45-e4db-4524-986f-cc6a7c27bd03", "comment": "Malware payload (Stop)", "value": "06b58ce7388782c0134c386ce53776f9e929523609b316c11b910af81cbb9b77cf7c21a7f94e07f9276a2dbd7f9a73ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664224, "uuid": "dbcff05d-4e75-4dcf-8da8-d4a252385f37", "value": "T10AF4021163D0B460E55B47318E2EC7FE3A2EB860AE653A5D0F694A3F1E703A1D27670D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664224, "uuid": "91ad2973-e0cd-4820-9b0b-7889fb4a690b", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664224, "uuid": "26e3ada9-53e9-43c6-8b3c-e9c038a1643d", "value": "12288:GXy2tMXzXKG1S/A+5WyV1TBCJ9S8fKYsaEcrm5lXgfvmb66td6mv3JUlv:Gi2Kz6aS/hWy7tCJ9lsafjHi6k3ov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680664224, "uuid": "ad3ce65c-03b0-4987-9a83-4b21e51f1ff5", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680664224, "uuid": "c7483e5e-a93d-45e5-9480-4615b70d730c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664224, "uuid": "0811b9b8-ec7e-4fb8-971f-5659e4ef6da7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4806b9-d364-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680666356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680666356, "uuid": "bd22378a-0248-4ea7-b088-667f3d250684", "comment": "Malware payload (RedLineStealer)", "value": "dce62039df2bafb63e0e146ee03f3b33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680666356, "uuid": "eadae939-1c0d-4f8a-8dcb-2378a232b6cc", "comment": "Malware payload (RedLineStealer)", "value": "7a3b25296bc9573f15df36192ba3e34cf39bd9beeb236a77d74abe0871db7f5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680666356, "uuid": "b83c8747-4930-4b5a-b9e0-9b05fd79575c", "comment": "Malware payload (RedLineStealer)", "value": "e978615b4e4b246c8cbd20dcf8f763704d73db59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680666356, "uuid": "1218e7a5-7b2d-4c29-a084-be74ff4d7116", "comment": "Malware payload (RedLineStealer)", "value": "6a9e496f376735b7c3977164ad33e1f5c0683dae93aa4e204752e60b79a530969520b18d85fe61c1cea3b4b5fb95742a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680666356, "uuid": "c6e4e65c-2559-485b-89bc-fbd5c959b880", "value": "T19064BE173A80CAAACE7954F6A117408023D9DCBED54EE34D6ACC32A35FF1BD6543660B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680666356, "uuid": "6dcc496a-f303-4348-bb48-429964704f3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680666356, "uuid": "9aa13959-a643-4077-84cc-04737d3fe79a", "value": "6144:H7Ueze6DGennAb6WG/sNXaLGrvlYOwXGZD3OsyjCKHMAIGn:FzvDGenntB8dYfcOHemMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680666356, "uuid": "603f518f-6b48-4f5a-8bdd-9472d6d0fab2", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680666356, "uuid": "aa80c438-e101-440f-b577-7240609a09c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680666356, "uuid": "ef1fc9e3-e4a1-41ec-952d-a565b3ef4f91", "value": "dce62039df2bafb63e0e146ee03f3b33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e6d9cf-d3df-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680719402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719402, "uuid": "48bae76e-3138-4228-9ded-bcb9ea0c14d0", "comment": "Malware payload (SnakeKeylogger)", "value": "d2beab70f1e787397e9faad166255df7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719402, "uuid": "a1d19ffa-7b1a-4e7e-ada4-ea3b2e2d8472", "comment": "Malware payload (SnakeKeylogger)", "value": "7a59016d956677cd8e7e13efcc21f7ee7fc04fc0485e8cdc164a7ac160749521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719402, "uuid": "570afba9-6189-4680-8950-cf2793f6658f", "comment": "Malware payload (SnakeKeylogger)", "value": "3b2956f4e7a75c3383467b89af465928a42a6b3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719402, "uuid": "737bef45-5ee8-4985-ac8d-65cccf4117db", "comment": "Malware payload (SnakeKeylogger)", "value": "512598bfb9fe04ec1057a27a99ecc536d951938f70e58b6209fd30c89885e39144e5d6a97571e94c8ac7aaf482a58832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719402, "uuid": "dc06d279-5a10-4b76-8b3a-e9a1c8282f72", "value": "T1EF252B916C5184D6D87B0FF06C3A752017B6AD998DE4402D7D8A7A2F5BF3343208EF9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719402, "uuid": "fcfd2a42-0a11-4d3a-a43b-d566de58fb50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719402, "uuid": "f764900a-9fe0-44a1-a793-757660d996bf", "value": "12288:UEcpj2iN2jRvs6CLUqRM6YKep0htmf9WZy0DNzPVDM:kj1g5s6CYr6YK/fmf9WZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719402, "uuid": "e37e7d2b-3cc5-4e2f-9c7d-2a79643993a2", "value": 1002496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719402, "uuid": "b6f18a0b-c1e0-46ae-851d-0841ac9c0f55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719402, "uuid": "36768ea2-69df-4cbf-a4fd-de6ab8c5f828", "value": "NEW P04564.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc45299-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680700526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700526, "uuid": "4d1a048d-8aff-44bc-8d77-fe2d82d236c1", "comment": "Malware payload (Formbook)", "value": "413f812916550bdd228ec107d6749d01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700526, "uuid": "a7fc5fb0-6106-4f8f-8d66-26fe55b26379", "comment": "Malware payload (Formbook)", "value": "7cc00acf0a9217655805e26bc6fda5ba5efd12fabc3fc934a79851c841b83936", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700526, "uuid": "b834295e-41c9-4e80-8e7f-f71e86369bd2", "comment": "Malware payload (Formbook)", "value": "f9b0193bc9830406c1d4a6917b55354f5c8be50a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700526, "uuid": "64f17c43-d5dd-4ad5-9265-38787ef15958", "comment": "Malware payload (Formbook)", "value": "41ffd8cb34010d6412340aaa4c1aedfa248b2de2bce735e103e8c7d7b7f75d07b402ab74feecaa64b27ea393d492d2cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700526, "uuid": "0ce00ab0-369e-450d-ac60-0d310864feba", "value": "T133360701AFF84D16E5FA1FF8742513A8DAB5E8669ED3AB0A300DB06B0F257454D533E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700526, "uuid": "f453054b-f011-46f1-86b4-4be3b9c07ff8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700526, "uuid": "46e395b9-ca23-466c-a45c-7fa9cefb8d49", "value": "49152:TXI5SG00U1H5VTTvOIl1F0KLJOnGit1b2mkz0iHOaRgy+yJF8y:5DHznGG9IiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700526, "uuid": "c04c7153-d0ac-4ddb-a594-b9015677c4ef", "value": 5211136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700526, "uuid": "0b8be18b-696c-4dab-8635-a6d3a3b3a302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700526, "uuid": "35eb57fc-e2ea-4ca8-8802-a56571fef968", "value": "413f812916550bdd228ec107d6749d01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e7dd21-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680718251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718251, "uuid": "b88a5e9c-6b73-4253-8db0-63d8dc26c57a", "comment": "Malware payload (AgentTesla)", "value": "feb9e8a8d59c3b7a5707f641064754a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718251, "uuid": "0916943a-20ac-4751-8d1d-4aaeacc03a17", "comment": "Malware payload (AgentTesla)", "value": "7cee7b66c745d0053c5d760e8d0444af4adf12a87d9535f3537d5ec66769c342", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718251, "uuid": "3db47a2d-c60a-453f-9599-a038549cb616", "comment": "Malware payload (AgentTesla)", "value": "113332c239d1a9eb91e17786f1cdf5f182ef034f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718251, "uuid": "9a187c7c-f97d-4c24-b526-ceb8598a0a8e", "comment": "Malware payload (AgentTesla)", "value": "47f953248b81076843b5baf6176934daffa171db2e83096fa34e26e196a0d2b9a1a52222aed2388e868b081854464c89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718251, "uuid": "66706e14-e293-4608-89ce-734f41d71418", "value": "T154D42363894057E8FA34E1D5600CEEE24E1D2E4F1E5E78EB9FFCB6665CA12BB7504102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718251, "uuid": "52a59db8-d94a-4b47-ab49-37b8e2e63518", "value": "12288:7Koi2iWyFQFT7e3jGQXNp2A6GnGdvAsLqHVf8CEuEAnsSlcIg:i1WymaG+l6gCosqDgrEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718251, "uuid": "9b560a81-6f05-4139-945e-bd603320272b", "value": 651160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718251, "uuid": "bd597221-fffa-4b97-bb38-0e1a7171009d", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718251, "uuid": "1da2f553-bbb9-46e1-9f0b-c745b85f9cfb", "value": "PURCHASE ORDER - 5201927651_4.4.2023.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30db4b3-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680700534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700534, "uuid": "df185b9d-c06d-4911-8af0-37f7d11fe37d", "comment": "Malware payload (Formbook)", "value": "813a7be3fa8ab0b17f948d72a113a29b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700534, "uuid": "d3c54dd4-3598-42a9-bacc-9363bc9fc5c0", "comment": "Malware payload (Formbook)", "value": "7cfe9185c121eeb52ee3f946c6773e9779d64a4860bd34efb3adf55485dedace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700534, "uuid": "42a491f2-1638-43af-8bff-25a579a0556b", "comment": "Malware payload (Formbook)", "value": "e1358bfd4233eacb9edd86b8d2189c06d25119e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700534, "uuid": "180b6793-2ccb-4ec1-9811-62e0ee6f4af9", "comment": "Malware payload (Formbook)", "value": "d94a586eb1e57fab45d4ba07ec0d8d8c32578bb413534597e3fd29de3ac308bd3d0eef521816be635198828f6580f73a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700534, "uuid": "65c47cda-937c-4a93-b02f-b0502c70f72d", "value": "T14574221413E0D7AFC8610B7126BDE6BA7766AE220C34D35B07069B5E3F11B52A44DFC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700534, "uuid": "bed1ece8-8bee-484f-bb15-eab2677702ea", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700534, "uuid": "d77f9815-5362-4098-b35b-114037751207", "value": "6144:/Ya6eJV6XVBQkWePa7WcsJcG93Ow7UmWaPpwTDDvQ8mVlisMlAZSl:/YAJVPkWDps+w3OwAmWa6THQHHfMlUSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700534, "uuid": "dce5b455-3f53-46a5-902a-13ffd3e0f14c", "value": 362986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700534, "uuid": "45f5c603-2267-41a2-8acc-ecb6c9e5f8c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700534, "uuid": "f3703266-f134-40d5-baa1-113bc850375a", "value": "813a7be3fa8ab0b17f948d72a113a29b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab4cc15-d34b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680655665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655665, "uuid": "bd84ccc6-252d-4a54-8125-3e0156186566", "comment": "Malware payload (Formbook)", "value": "ac91186f688620b6a391847170b294b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655665, "uuid": "34b6c2ce-e363-4e97-8752-2c5ec82f576e", "comment": "Malware payload (Formbook)", "value": "7d6fe07bc192157a1cf1f1988535d753c4df05ba19f9672bd46319f11d53a4ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655665, "uuid": "c92bc02a-d47a-497b-9922-08ca341ea23a", "comment": "Malware payload (Formbook)", "value": "5d760935daa7ee7119e5f715c85c858648034d2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655665, "uuid": "811ce8f9-01ca-49e7-a19b-72481a9c4c54", "comment": "Malware payload (Formbook)", "value": "33969c4b6d8b1ff6e06ee47d8bce79167f4e8f80f95291b7d8b8c336d70f21c815bb2e2867b8fa5f8a7f0a8a403ef03e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655665, "uuid": "77ec4a33-b9ae-4a07-b177-a61e70f1b5f2", "value": "T1DB35D5AC366432EFC467CC72CEA85C64FB90747B631B8607A06F119D9A0D887DF151BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655665, "uuid": "cb1791d0-8e62-4f11-b2cd-d4ffee0fd22a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655665, "uuid": "59a0569a-6f23-4ac1-955a-f3a849f16645", "value": "12288:Z1/WdFghORhjZ/yywV2MggfacXs5OTqgiYcHXwFr2N4faGrsSjZauwrcpMBrgYo3:D/WzghUFFwVJgYFhiw5q4Ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680655665, "uuid": "b7fd1862-68b2-4d4d-8681-0f3c0d5e2e78", "value": 1123840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680655665, "uuid": "0ca21782-1e09-41e8-95c3-1b4a7b6bf4eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655665, "uuid": "94b8c0f6-98a7-422d-bb19-efe0883be769", "value": "ac91186f688620b6a391847170b294b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c244d18f-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680699594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699594, "uuid": "33075a6e-c41a-425f-9881-6088e26fd1be", "comment": "Malware payload", "value": "18dc1e59e03027fb846997274a96b5f5", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699594, "uuid": "11880d62-80c1-4ef1-9600-27c188a7b832", "comment": "Malware payload", "value": "7d7964b27c6d7c6a8a5089224e423ecc0e9542a075a11f276d2636d72099ecbb", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699594, "uuid": "e7628f0d-0c74-4775-bc42-7731cb036ee1", "comment": "Malware payload", "value": "010a5bd44c71c201c704411ab5c001260887377d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699594, "uuid": "01d946ad-77a8-4cdd-94ed-48c7a31a3a15", "comment": "Malware payload", "value": "1726f75a9a347c05e48c3e84c5728cacb4cc139e9d58fad696c8fc20fec85dae3e512266d8db3652bc51adfa908dedca", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699594, "uuid": "3a842b26-6e28-403f-8ac3-74957dc8d939", "value": "T1EF617C1457EA0708F3F2A73A69BE52554E3B3956E932C74E0059414E52F1A44DCA2F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699594, "uuid": "e7f43220-68d4-4026-b020-a60a88cb80af", "value": "48:8wHaGU9Dmel0iglZ+klpQfYj1sAT1rTRRSJxodgImcC:8wHgB0+E6YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699594, "uuid": "ffd758f6-28a1-4855-860a-c656d41d9ba5", "value": 3444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699594, "uuid": "abbd19e5-2427-4eb5-a56c-22b0c9372ace", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699594, "uuid": "6cc599bc-a86c-448f-9e16-ce8381926632", "value": "Screenshot_202_404_190023.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233996a6-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680718225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718225, "uuid": "ac6a3505-27f5-426c-ab7c-a902b51ff8ad", "comment": "Malware payload (Formbook)", "value": "556ab86719b286b2976da56a2fa754eb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718225, "uuid": "f18826d3-3b89-4bcc-8888-a9e01118f55f", "comment": "Malware payload (Formbook)", "value": "7d9c6f33842f4400d2f41a5b6b1d6dbde728ac95af02e08da1292a17de0c42e8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718225, "uuid": "bcfe4b11-bcfa-41e6-b69a-9920c44d7af5", "comment": "Malware payload (Formbook)", "value": "a948ef62ce21f6b78f54196a2d24819403e4f8cb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718225, "uuid": "47b02c4a-63eb-416a-bc52-7a2c2caa895d", "comment": "Malware payload (Formbook)", "value": "a01be3b38a23d02c16f7cbf3365129e1862dfdac9091fba3821f4b48e974a58eee81b98338264405e78f33539e880328", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718225, "uuid": "f8d97e4f-ba75-4ab9-883d-32a1cdeba963", "value": "T15EC313AAE1190BDE9CB3F210DC31E28E9359806AD26D1548B0E7AE64DF4F47D3F58274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718225, "uuid": "39a72be5-431f-4ded-a8d5-73a61eed650d", "value": "3072:Ld4/Hla766Y2NktE3ufyBElYfeYRPTSzga9XNEKHgIf7pjXA:m/Hla3pNkt/fa+OkBfxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718225, "uuid": "41ae04f8-d1e7-4c92-8adf-3fffb93c9859", "value": 126148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718225, "uuid": "066dd765-a656-4cd9-b22c-5de7a94ac751", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718225, "uuid": "836f5a7c-7911-4730-a13f-a600c7c9fb27", "value": "Fact 153_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8dd5215-d3a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1680696222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696222, "uuid": "e8af3689-105f-48a7-ac34-4d9da7d93455", "comment": "Malware payload (zgRAT)", "value": "711a958711e8c317df36930f33efa56d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696222, "uuid": "9f00c294-833e-4c5f-beba-82079287fb02", "comment": "Malware payload (zgRAT)", "value": "7e03f848906030aeb482b45a795ec5f4034956c4faca88a99fb57be5ba0399eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696222, "uuid": "c4017e8d-e41f-40d9-b2f8-0591acb5979a", "comment": "Malware payload (zgRAT)", "value": "3e2b35426b8379880d9e91db9d8ee3a42fa5cb8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696222, "uuid": "d7b1b6b4-3574-48d8-9880-04d6da78f6fe", "comment": "Malware payload (zgRAT)", "value": "3157049c29890c1d76e5113c86dc206ec89627135752836147bbf3706251f19d48030e092db78c6e5693cfd6f6668e34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696222, "uuid": "286f5df2-30ae-4b36-9e12-67d1e82c9905", "value": "T155463901F7E48B27E1BF137561365018AAF4FCA66316E649315C72EA6F72B002A1B377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696222, "uuid": "cf06e418-6162-4ccb-80f3-d40a54e69e25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696222, "uuid": "75965477-2de8-4a24-86a1-1e2c0e03f7aa", "value": "49152:600WlMMPycorwGzsdnlvp0twPQ2GRYGhWY2RoXJ4njnH:4zUvp0W3Q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696222, "uuid": "efa5c754-213e-4162-81e0-46133346b254", "value": 5640192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696222, "uuid": "1780fe95-249b-4f43-ac3c-b4693d876b59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696222, "uuid": "c33fafce-576c-4521-a05f-7c775b250059", "value": "711a958711e8c317df36930f33efa56d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0cb0ac-d377-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1680674751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674751, "uuid": "d545f1fd-f872-4df2-8833-8ac3a8d04830", "comment": "Malware payload (AveMariaRAT)", "value": "3e4a6a626a6ec6287959069f5d4a23f8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674751, "uuid": "0bf1ba9e-66f9-45e2-8709-354b7137c0f3", "comment": "Malware payload (AveMariaRAT)", "value": "7e397f197a4122d8a085b7a5c9d080aa9f103b87e40cc4166cd283b8ad679faf", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674751, "uuid": "c121d375-093e-4e72-9751-6b8eb6b43337", "comment": "Malware payload (AveMariaRAT)", "value": "3199154897383ac6bae446940e79e65b0fa79253", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674751, "uuid": "46f41dff-2f63-49f7-b963-9330d6d61f9a", "comment": "Malware payload (AveMariaRAT)", "value": "2e0074355cf8219b8742a6bf01d6face2293ece8e168cbf124c23db4d042ee654309828c1a08e55789df51f15156d781", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674751, "uuid": "62270f05-0f48-4fe6-a514-1c264e8c097a", "value": "T1C594364D2A48CA77D12B0FF580629F631224FC967617861E19997CEA3972F891BF7033", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674751, "uuid": "bd02aac8-4ba2-4bb9-a039-6871d9e1ebb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674751, "uuid": "8bd158e0-0d4d-49e4-929c-41d1ab500f01", "value": "12288:cHQdkTZcKDn+GmLIkfWYebn7zqFE7SGUQQoJLzPp4FrSmSA:FdkTZcKDn+GmGaI9QMzPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680674751, "uuid": "d7d03e52-2d4b-4960-ba1c-10e034bd82bf", "value": 421376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680674751, "uuid": "bab36798-5f20-4410-beee-9aac4b7a2cb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674751, "uuid": "0f4e9357-2246-4126-b684-334ece508477", "value": "7e397f197a4122d8a085b7a5c9d080aa9f103b87e40cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396b7ec6-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680718262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718262, "uuid": "6e90dd79-881b-41e9-b025-4212189fdc84", "comment": "Malware payload (Formbook)", "value": "236d63b46907ea78177b2dec4aa204c6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718262, "uuid": "c2e10e3f-6383-482f-8634-9a20457e49f2", "comment": "Malware payload (Formbook)", "value": "7e9791f9b689b63f46ac6c7565b6b805616f22cde83f042607aae4e1989182d6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718262, "uuid": "749fe8b8-fbdc-492d-b2ab-8c5f28d34caf", "comment": "Malware payload (Formbook)", "value": "39d9d39294eb320610e9007d7f3ed05ed4a79c90", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718262, "uuid": "5d5a3edf-4706-473d-a0d8-24ffd07adcea", "comment": "Malware payload (Formbook)", "value": "88b0cf818f67976e200753986c60abf21f01d24aa52d8bcffc726308e48aa60e5d83dfaacbff27587473303d2b41c6d2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718262, "uuid": "eaa80ab8-8f3d-4cbe-b7a0-ab5cf1162388", "value": "T18394237C492D6100B54ADFD890F2AD54D066BA89809B34254F3D9BBE7DF1CC938C68BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718262, "uuid": "316c1d6e-0c4e-4aa1-b317-7ce773c526e4", "value": "6144:VM3Uw5Yai+KgaeQIs4H9JbGv48CoVmBwsBRxE2ffpKOF1O0p3TRe7mVqqj0vHxuB:i3Uvai+FE/6rCv48NmXBfZDScPwwgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718262, "uuid": "f1fa4823-3b91-4de2-a18e-2a3c96de8b1b", "value": 409075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718262, "uuid": "9304da30-1f41-4509-a80b-4116acb523c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718262, "uuid": "1ee62775-b377-4b16-96ce-31a294a2ad97", "value": "U prilogu je nova narudzba_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cecad2d-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1680718241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718241, "uuid": "0a818e4b-adbf-4c29-a798-aeb5a009095b", "comment": "Malware payload (WSHRAT)", "value": "008e9c8eba08ed031c30fc10f805c369", "object_relation": "md5", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718241, "uuid": "dfd4d1cf-553e-49c1-8a73-853953f1223e", "comment": "Malware payload (WSHRAT)", "value": "812a24ac6164c88b6c931ec66339785e85dc0d1f10155c0dfc13353e43352cd5", "object_relation": "sha256", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718241, "uuid": "3ca563bf-e58f-4f4e-b999-f80d0b16827e", "comment": "Malware payload (WSHRAT)", "value": "4a479570f970b73b82580276719d14a0f3f84be6", "object_relation": "sha1", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718241, "uuid": "79715c08-9608-428d-a9d6-36f813e3af36", "comment": "Malware payload (WSHRAT)", "value": "3847f0479b4b3f11efa9baa9ab83eb7a01fbee2bdd2b6c6301603d6ee46f05cf6bbcf0a92fcb72b1000b7d618c280b21", "object_relation": "sha3-384", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718241, "uuid": "102c56e3-4b64-472f-b037-04f79f39f3c9", "value": "T161F1AE223D84A537128071A93260C8F47ECF816B78D8D51A8EEE15C268FE6686FB1603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718241, "uuid": "9f7ded6c-48fb-4bec-af66-b48162308763", "value": "192:Z60eExX1KfXrznz5domBuvqN/YyzdErXyL8:40eEOf7H5KmLY8dErXyL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718241, "uuid": "28be09ec-e382-4044-827a-fc8ef698d1a8", "value": 7623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718241, "uuid": "a2489ce1-23e6-4bc1-b190-019093245020", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718241, "uuid": "c660ccfd-3faf-42e9-9dea-3cadf2d1193a", "value": "ORDER_432023.pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80439921-d379-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680675431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675431, "uuid": "b0e8e1ea-e429-4ca1-94b3-8c8972b4211c", "comment": "Malware payload (Mirai)", "value": "25ec8d6f45d488496443532ce0281b4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675431, "uuid": "37a5f161-1bf8-4b3a-bdc2-64b4465f7bc7", "comment": "Malware payload (Mirai)", "value": "81381a170e890fb8fa2a134847615faaccb2e0884885c42b5d12d12371559c14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675431, "uuid": "6c0d1c6f-82ee-4f72-9abb-8e5deb2e4816", "comment": "Malware payload (Mirai)", "value": "f6da9486b44b8591bcacb500b4a13a90102411be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675431, "uuid": "dd92d8db-4e50-42c0-896b-2894b3456456", "comment": "Malware payload (Mirai)", "value": "775c0b260857e1a27b593fbb282578f5e7242e8df924edc709049866c7dd11aff555b6e87fccdc472ec329777e1b4ee1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675431, "uuid": "702c4be7-68ff-4f69-81e8-7c5ae3beaeea", "value": "T11A935C32BA361E27C0D9A17B11F74325B2F2538F25A8C62E7D721D8EFF2425062572B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675431, "uuid": "b64b8e35-a33a-4d8f-93a1-95b2851f3378", "value": "1536:3wiTnUnn/DIpSCKSP/Y6y+a7mqDb4KT5tPbXtvZbYuwbZn2F:gJ7oPU+Smq4KNtlwbZn2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680675431, "uuid": "51d0c328-3ef0-4909-88bc-5c559d5b97c6", "value": 94152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680675431, "uuid": "73122ea5-9002-4cc1-a92d-5b6310b9b0e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675431, "uuid": "8d34a518-8c9c-418e-bf20-513b62954d05", "value": "25ec8d6f45d488496443532ce0281b4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0108b8-d3a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680692954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692954, "uuid": "2403d860-da5c-4c24-b29d-dcd3207fed90", "comment": "Malware payload (RedLineStealer)", "value": "1ed00c85459b6cf90d601fe1b7472e6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692954, "uuid": "065f5a64-41ef-4f4e-917c-515b639537d2", "comment": "Malware payload (RedLineStealer)", "value": "81dcb9f8d4ada7e654a90a4ea211518ec04ea0c0d1119e32b2e7c58059c15c0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692954, "uuid": "86020550-88e1-4b02-bbd9-10f5ae63537e", "comment": "Malware payload (RedLineStealer)", "value": "71a3875a1d1f72db4307178e8d9405f6fc881212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692954, "uuid": "85c33825-8ac5-4579-b070-2e7e5f8598ba", "comment": "Malware payload (RedLineStealer)", "value": "fe832219a28a983bb5468a9fa43d6a2027202a61eeab36160bc7961bc126dbb40bdb66798ca2e2d9f13d143fabcef30c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692954, "uuid": "399f38ee-1ffd-4306-a0eb-15030d8e073b", "value": "T11E04B51437BCCD11E1BA2A3F6961A05147BF98026852F25B7AC367CD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692954, "uuid": "2b76514e-6fc5-4662-aad3-4ca7c8404c30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692954, "uuid": "7b11babd-5930-4822-94f5-d6305834caab", "value": "3072:yxqZW11a2kX8fqvPIeJBeGg9ShLrxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOJ:gqZkqvPZJ8Sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680692954, "uuid": "a20c2250-42a7-47a3-8e53-df5b78e862af", "value": 179285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680692954, "uuid": "8dc1de09-d40a-4587-b82e-2af7fcff96f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692954, "uuid": "f2c2c802-a9df-4eaa-957f-36038ebbb41c", "value": "81dcb9f8d4ada7e654a90a4ea211518ec04ea0c0d1119e32b2e7c58059c15c0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63bd299-d3aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680696621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696621, "uuid": "f1d37b0e-1208-4bce-a2be-05345785c8df", "comment": "Malware payload (AgentTesla)", "value": "8eeecc5f246690a4f6c741ff478108ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696621, "uuid": "e7b29dce-8d18-46f9-81f5-69b78488f55a", "comment": "Malware payload (AgentTesla)", "value": "824ade3c94d351a00ca7a2ee3d7aa269ad2cb6139f442e3e75558593df3bbcdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696621, "uuid": "c29ac5c6-63b1-4dde-a6ea-11acb3029bba", "comment": "Malware payload (AgentTesla)", "value": "7b9d9fd74fc743bdb2954e0877586af8ab9fc77c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696621, "uuid": "d4ccf46b-179f-4601-b63c-e0cf29c4a0b9", "comment": "Malware payload (AgentTesla)", "value": "da348a5c57a203288342638a985b5635d210e6b1047095208555f9fb1e7ec84822fabbd9737a2c503c290bffd98c8b8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696621, "uuid": "d3865481-2988-4cef-befb-4499fb8069e2", "value": "T1CAC4124B7215DF0AD1594BBBE4A3554243B09532BC51F39AADC838C50FB3F9ACA81DA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696621, "uuid": "78e9d981-e4b4-4038-b316-b2798d971035", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696621, "uuid": "d5fe5e97-dfee-4e07-b6d0-d42f3902a932", "value": "12288:nLOZ0u12ncgtP74AN1OibDDT9sOqKfBzbFu9JUOqFC8GFLCxG8:yZ0uGltP74AjOiLTqOFBU6xFBYkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696621, "uuid": "c5b32a00-699c-4284-8abe-948f92b90c57", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696621, "uuid": "ca8608e5-1675-423c-b512-b391bfd8df2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696621, "uuid": "57326fc4-5cf2-4130-9c71-26a3410ea937", "value": "Curriculum Vitae Adriana Silva.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7449e812-d402-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680734252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734252, "uuid": "fe487bda-08a0-4fef-a9fe-500aaff88487", "comment": "Malware payload", "value": "384bcf230c10b1fb04a698aad1ca1ed8", "object_relation": "md5", "Tag": [ { "name": "GrandaMisha", "colour": "#0D7019", "exportable": true, "hide_tag": false }, { "name": "Misha", "colour": "#75FD00", "exportable": true, "hide_tag": false }, { "name": "Panel", "colour": "#BCF099", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734252, "uuid": "e24dee54-ae90-4c8e-8ef8-75a3a2b12f50", "comment": "Malware payload", "value": "82e3766e3cf57ba127e5aca00ba5127e9a280bc32ee55f0e5908f26dc3de8daa", "object_relation": "sha256", "Tag": [ { "name": "GrandaMisha", "colour": "#0D7019", "exportable": true, "hide_tag": false }, { "name": "Misha", "colour": "#75FD00", "exportable": true, "hide_tag": false }, { "name": "Panel", "colour": "#BCF099", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734252, "uuid": "f070cc8f-2a55-45e3-bfad-f573cbde6564", "comment": "Malware payload", "value": "815433aa770e0781f9ecde7264eb51983c783b76", "object_relation": "sha1", "Tag": [ { "name": "GrandaMisha", "colour": "#0D7019", "exportable": true, "hide_tag": false }, { "name": "Misha", "colour": "#75FD00", "exportable": true, "hide_tag": false }, { "name": "Panel", "colour": "#BCF099", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734252, "uuid": "0ea15816-4d40-4871-a357-6c4b90e58651", "comment": "Malware payload", "value": "8fd66d3b1806109c23060984f3a6cd9e3edacb75e380425221c0236624270c8dc233b19bcf5a64797f1bb66e8fc34882", "object_relation": "sha3-384", "Tag": [ { "name": "GrandaMisha", "colour": "#0D7019", "exportable": true, "hide_tag": false }, { "name": "Misha", "colour": "#75FD00", "exportable": true, "hide_tag": false }, { "name": "Panel", "colour": "#BCF099", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680734252, "uuid": "cb35cd96-6ab3-4b41-920e-5b0021a1b6ff", "value": "T11C0623ADD09A0680D4B56FF4A24F9E24F28CCD65946BD4BACD8B11A0DDB7F52EC09730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680734252, "uuid": "f84f0a8e-405f-48ca-8a02-d739ba367028", "value": "98304:p0nyC0KdKpTy1AQxZ8nCLFNyuwPk4pfTEWrCCCIzWtC:pwy7Kd7179Kuw8M5rCC9z3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680734252, "uuid": "db71d6a4-80b1-41d4-8b9c-4b0868f118c6", "value": 3898106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680734252, "uuid": "42fb7cfe-0175-461a-a2c3-100676e9d03e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680734252, "uuid": "efd89414-f6c9-44f5-bc9c-2f19ef4c4596", "value": "mishapanelp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c62ad1-d38c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1680683431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680683431, "uuid": "48a2e4f6-3f6b-4068-a83e-0a0b215a907b", "comment": "Malware payload (Vjw0rm)", "value": "4843582c8aea6e684092ccc7832088cc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680683431, "uuid": "86e70b8e-0ad9-4359-9790-9da7ff908b8b", "comment": "Malware payload (Vjw0rm)", "value": "8304bd9b72d8eb4a3b02886cdfe24f463ce1b088f6bee71afcca073321de252f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680683431, "uuid": "52386dd4-eff1-4de2-ab33-fb6145ad4e4d", "comment": "Malware payload (Vjw0rm)", "value": "5b926ea46d266420267acba4112e75d12fd7a2b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680683431, "uuid": "3886ad22-d3c2-4ddd-a245-1e1d78301152", "comment": "Malware payload (Vjw0rm)", "value": "9903ef1238f54bce79798be2a9765041cdae29f4898ce531bd30f2b8d4546b4746ac6e942804c4abb43fc521a397058f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680683431, "uuid": "4682246a-319d-44d3-ab28-3f77d9eda347", "value": "T178A51E1B7C032043B68A5A636F39B5D4FD147A1D364B789A9D403A587B930F3BAB0736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680683431, "uuid": "9ccbf734-8038-4e4b-8054-ae52f1b76405", "value": "24576:efFW3X3yqu0Sk0kz3LxAPtS+DZ0dlNJ/R1a7euQjMm0cXkSQnrtJDh0dPklw2BK5:kuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680683431, "uuid": "b8085527-15bb-4b83-9644-3798a7fc52cb", "value": 2142901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680683431, "uuid": "e99672d4-7979-4a8e-98ba-8c97e439ef88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680683431, "uuid": "39950696-8beb-4122-8ed6-e660232c2fb9", "value": "NEW PO# 230469008.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a179ee-d3ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680703299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703299, "uuid": "76012c24-c10f-4b63-a840-c9709f24d4b8", "comment": "Malware payload (Mirai)", "value": "9d3cd0c7e0025b257c214d5975045fb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703299, "uuid": "c0b16355-4ddc-474d-9635-fffee05cd0c1", "comment": "Malware payload (Mirai)", "value": "8308f3e40b2f4d6119a1f766812db93e2ef180dd7ba357c4bc25d3fd9c19179c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703299, "uuid": "c837b6d7-b545-4b8a-8e1c-0fbb0b4f27e6", "comment": "Malware payload (Mirai)", "value": "370625ddcbb1ee3ccec43cdd211d2338eb32ea1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703299, "uuid": "6f44dc6c-0232-41c2-96de-758b1f4018a6", "comment": "Malware payload (Mirai)", "value": "665df3c4ece1a7518ca7614fc85b45e2a7cdf177ee16c248470eaddb88b151158816f7df2c536740a31d6c8c520609b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703299, "uuid": "47c9a739-b9c2-44e0-94dd-efba00eaeb1f", "value": "T16F63B41ABF650FF7DCABCC3709E91B45248DA61A21A97B397D34C818B24B25F05E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703299, "uuid": "5455258c-2f2c-4c25-93e4-893c7118de26", "value": "768:ZHl7yhaNNDZDy9mxH9/eGTunWht7bhOWSOpw5iLeTxesJe7JNjfoXipQiGeGzR8z:lluhqNFDy9mxdvLkJ4wwSxJJEJNrfGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680703299, "uuid": "b8de9b3c-82c4-49d7-86ae-9c42e4a6c938", "value": 73116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680703299, "uuid": "cd72565a-90cb-4826-872a-63250396a694", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703299, "uuid": "a8929a5a-8a57-4331-b641-98ce1f650dac", "value": "9d3cd0c7e0025b257c214d5975045fb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deab3592-d35e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680663993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680663993, "uuid": "03d0a571-1fe3-4e5c-8f0c-dd0e25fd68ee", "comment": "Malware payload (Stop)", "value": "e6b8a68c108007e8328c7aa6c38b98ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680663993, "uuid": "05a2cd89-57c9-43f6-af93-2e157c239c6b", "comment": "Malware payload (Stop)", "value": "836521d8320c827021abd8da5243f5b8b54143b02a5a48633d7ff3e1dfe7a2cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680663993, "uuid": "a1f8a313-92c5-41b5-9010-48e8e6343e4d", "comment": "Malware payload (Stop)", "value": "58c933d1283063b1ffc8edc2ee7861a2a6a5143e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680663993, "uuid": "0202f7a7-7119-46f3-b430-1d480aee0f6e", "comment": "Malware payload (Stop)", "value": "79fdb7932738dceae072b08e5e84cf2b1b9b6c64129d8e135d598b4331cbb497d6bf377802a3d6008971fd572f2848e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680663993, "uuid": "070eb64f-dce4-4867-be9b-75b1aba5a9b5", "value": "T1B5F4020223D06465E56B1B71CA2DCBBD296DF821AE61BE5E17B4183F1E703E0D27271E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680663993, "uuid": "fb127477-7e39-4183-8517-caca3ee9f1f2", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680663993, "uuid": "a2659329-6dd4-4a0f-bdfd-d33eb49c9855", "value": "24576:BKdmLu6vNyt6bjV6VLN+NJl/e3GaRxZ5+S:BlLO6bjOw1G3dF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680663993, "uuid": "29ed1607-0711-4564-bca1-f82b9c227f7d", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680663993, "uuid": "e95126d9-c1d4-4e17-9ffd-75c1bcc51d9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680663993, "uuid": "a1986081-4214-4b9d-a830-0a29cdb8d4e2", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8aa33c-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680700393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700393, "uuid": "99d087b2-d680-4a46-978e-3d48462956ca", "comment": "Malware payload", "value": "4be75fae6a7cbea13bdd6c6e37fb580f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700393, "uuid": "8d014883-b54a-46cb-a676-dbf07d527159", "comment": "Malware payload", "value": "836fa525d8333583a9320ee83bb90308a1e5217f3411f06ece13af01300c44bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700393, "uuid": "964bfe4e-32b7-4d04-92bc-2366390add5c", "comment": "Malware payload", "value": "36cc58e9301277633c8b08eed07255faf0091fc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700393, "uuid": "6d7c0587-cf0b-4854-9c61-d0980be9443a", "comment": "Malware payload", "value": "87263d1a919920770575a719d6b65aec1956b708b369f0476872293ed382c3081fce73270ea32c70911879c7c5838ee0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700393, "uuid": "fc8480a5-1601-43f9-9de1-449d0afa409a", "value": "T1F704AD2072D48031D19366324A60C7B64EBB787576B2AD8F2FEA0AB95F346D1E37431D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700393, "uuid": "c28cf9ce-5f78-4eb0-b71a-04eb6425713d", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700393, "uuid": "776c8049-ca43-4dcc-8cbd-72e2d43a7a72", "value": "3072:rX0c1hxVONhrvrfazEV0rGa5xJ0U4WLtfGvB5W:DnaNF8c0rnbF4NB5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700393, "uuid": "567aa970-9c29-4841-ad45-256008aaef4a", "value": 179181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700393, "uuid": "4202a68d-def4-4145-9a6e-15b91b4a1037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700393, "uuid": "5e15cf2e-109f-4f3c-b558-bab5ed91636b", "value": "4be75fae6a7cbea13bdd6c6e37fb580f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9800256-d387-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680681567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680681567, "uuid": "0e526826-bfd5-4a64-8736-3ad32cbe5054", "comment": "Malware payload", "value": "63b2a52682bf140ec75893127f0b948a", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680681567, "uuid": "b3b86f65-d757-410a-8a45-a3e240c3b03c", "comment": "Malware payload", "value": "83f03eabc63b068d45222bdba3c0392bd76051d51181786d6892cde2b4a42353", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680681567, "uuid": "ffa8d7f6-1c4b-4cd3-a35e-0f0888bbf166", "comment": "Malware payload", "value": "d39cf028468e3bd76644e2289fa2ca01b21873af", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680681567, "uuid": "de7cc0d5-b8c9-4efc-9bb9-38604906b62f", "comment": "Malware payload", "value": "2c1b0f0a389679dd37ec8036b38fd22bfa00f1ab8a242afea7dbd109f4f3d119541aacae32163cddcb066777e4d81786", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680681567, "uuid": "7acaf593-2571-43ee-979e-d83db22ece44", "value": "T1D9629FA23E300125D84711793FC2BE662116FE45BFA0D854506DCB980BB588BF6F4CF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680681567, "uuid": "3ca0ad3c-4341-4a5d-9040-11fd25c8bbf1", "value": "192:5TfDuvjkWamyEaIn0mRGGB3w1T6iIk/+LkXvQn+D:5ToYHsnjGGu9ck0kXo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680681567, "uuid": "a2936dac-5a52-438d-b120-ebf7552491b9", "value": 15319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680681567, "uuid": "4f985e81-d317-4143-b6aa-4e80a6c952d9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680681567, "uuid": "873b1e39-0dcb-43b9-a33a-6875f6d05eeb", "value": "20230405.CHM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16dee6c6-d3a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680695870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695870, "uuid": "229e9db3-e8c9-48b2-865a-158c18af2fda", "comment": "Malware payload (SnakeKeylogger)", "value": "60b239e0366d4e32a77fe9769970b770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695870, "uuid": "5013cfc1-5bb5-4758-ba85-58790d07f33a", "comment": "Malware payload (SnakeKeylogger)", "value": "85212c30ed305f23c6c32f57113d259a5f3b901d714a3624054267e22e59be94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695870, "uuid": "72ffa48d-445e-45af-a60b-b9c5fc322691", "comment": "Malware payload (SnakeKeylogger)", "value": "37e9d0699f0f1cedad8f2ae80105db6e3ed7598a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695870, "uuid": "42f4fe4d-a19f-4914-94f6-d1d4e10ca3d8", "comment": "Malware payload (SnakeKeylogger)", "value": "7d302dbadc5cb884ff76f498bd541e7393c1c0c114bd1a66809a0af01e89daeaa7e23d1a1a2be5bf4b55148415b02f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695870, "uuid": "47444881-f790-4623-b8aa-2cbe1b77d513", "value": "T136E48C2E8E54C2F4FA7C47B9D0D33F192EA409A247D6851CB97761D63B81B8A4C0D98F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695870, "uuid": "aa696211-f71b-4134-be45-6da478fa733c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695870, "uuid": "767e949a-f61b-4343-a511-ec901356e4e7", "value": "12288:UwFZ8TLN2iNPpVS+TWmLCqH7MqAXYzkFkfphobPj2V8fwpHJWy:UwFZqN1JS+iBxR7fwjWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695870, "uuid": "7aef1d34-fc85-4f02-a95e-c8e356b70088", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695870, "uuid": "4046a6eb-996c-4463-94e7-f5540ab0a2ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695870, "uuid": "bfa740fd-af95-4388-afd3-281fd8a1d3ef", "value": "Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8589803-d3a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680695255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695255, "uuid": "98feae03-64b9-4fe6-8502-d4a8d4286eb8", "comment": "Malware payload (GuLoader)", "value": "b1479fe74640c9e5745bf3443d21db50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695255, "uuid": "b9c1f0e0-ffb9-48cc-8d7c-10573760d967", "comment": "Malware payload (GuLoader)", "value": "85d7a4d55ae8442215001edff06de94f3e585132475342d4f350e5acc30fadc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695255, "uuid": "e45c7dbe-764d-48f9-b7d0-ccb8a7facc49", "comment": "Malware payload (GuLoader)", "value": "4489c5adcb2ee780377be65ba62c7f2e599642e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695255, "uuid": "e2bd359c-0032-4606-a37f-69830035e345", "comment": "Malware payload (GuLoader)", "value": "c64c0c3fd433a52c07aaf547bf1ce766f94e160a402902ac4d0fb63edb905f4820da6242ebe5e681d31a595d4524a031", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695255, "uuid": "7f99a979-6670-44a4-8049-daf0d5ec2810", "value": "T168C4E1C3A0B0CBE6DC2C903955024423579EBF2675F8DA127BBB3219B4F1199817B7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695255, "uuid": "1fdbc9f3-3c0a-40ca-81a5-845d371e86fe", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695255, "uuid": "f64a7459-ed6b-46b5-941b-6492ec4bee8e", "value": "12288:YTMY1ltUnHhjvK7V2MEFl8W6UDJphLJhK8WEQ:YThtejS7HEgUDJpXw8Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695255, "uuid": "4dd04be9-a7a7-4f5e-a6bc-302fa2c3da86", "value": 568024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695255, "uuid": "b3e58821-24c0-4cc3-b002-e2356fd3dc39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695255, "uuid": "2dd9a0bb-5d2a-4523-97aa-f63e4d82d7c1", "value": "85d7a4d55ae8442215001edff06de94f3e585132475342d4f350e5acc30fadc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fee086-d3aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680696377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696377, "uuid": "318057ab-bd6b-4d7b-adcf-d19d8b746af5", "comment": "Malware payload (RemcosRAT)", "value": "2e0b232badd67366810bb3f84cf44d95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696377, "uuid": "529efee1-3180-4d66-aacc-d49540c4df80", "comment": "Malware payload (RemcosRAT)", "value": "86f51ccc087df74110dfe190f66745f42a6941f4766c4b4d837318303f506af0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696377, "uuid": "68a16d91-b6bd-4b27-8348-a09bd9bfd52f", "comment": "Malware payload (RemcosRAT)", "value": "1f135813e849410886fd12d5f84341dd9f7f0b06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696377, "uuid": "ea074bea-874a-41e5-a5d3-034aac61be30", "comment": "Malware payload (RemcosRAT)", "value": "f4504c168e6a120be74a436ed2f953519234f19fb2a91965734e246823cbd94f71def4236cf96e1a2439855d4a398ff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696377, "uuid": "469d1aae-7fa3-46b0-90ca-3168c558095b", "value": "T118A4AE01BAC2C072D57524340D2AF775DABCBC212935597BB3E91D6BFE30190A72A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696377, "uuid": "91b928a8-d245-44fd-9dd4-f4a8f26edfdf", "value": "b1c8f7572a6db205362528e88fd3ff32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696377, "uuid": "e15375fd-97c6-4ec9-924c-7972b6117169", "value": "12288:Y406AQY5PupeoDrQ+3JJmYZHQJs/ZPMtRq:M6A15PupeoDrQeZHQoZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696377, "uuid": "5d1d5e2a-9162-46f0-b3ee-17a863c106fe", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696377, "uuid": "141663af-83c8-49b6-a6ed-7f6ed75fe44e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696377, "uuid": "e9de908a-97a9-4b43-a2ba-e2c04a5cd5ac", "value": "2e0b232badd67366810bb3f84cf44d95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05fc0f3-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680699564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699564, "uuid": "561de310-482b-47d6-ba1b-26dbae83ef80", "comment": "Malware payload (Loki)", "value": "48b834400131e5cd8ec01ef5a15124d8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699564, "uuid": "25c6275d-b69b-412f-a65b-bbf598431580", "comment": "Malware payload (Loki)", "value": "872a6eccc6b3b8593d5fac1a0b40b9963856bff3337f64888a8f5c5f48621fe3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699564, "uuid": "23f5b361-b3c4-4605-9d64-64cc48c64756", "comment": "Malware payload (Loki)", "value": "b95d69155361102ef95b37f31f94c09fab5b3552", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699564, "uuid": "e7eb860d-0219-47ac-8d7d-d231b0016093", "comment": "Malware payload (Loki)", "value": "b33c13a887aba69a2368a92cb9f8e841f46fde5c617a4019819bc16f2cab6e65a6c317c307ee6ba247650d28aba81f95", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699564, "uuid": "9c66b80c-a3d3-4ce3-8062-bfba166bed0c", "value": "T1C0C4129933F48B2AD29D4BB9E950316143B1F66A94A3FB0D5EC1F0D90EB3740C61678B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699564, "uuid": "188fc2ba-6461-474e-9068-d51c08454ec6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699564, "uuid": "e9822c31-6e7d-48d7-acb6-2271b34ce191", "value": "12288:jgs42MoIHoFO45Ro/+cqhU47RcCobvez4E2gCxHbCNsZ:jgM0oUig+cqhU47SC2vy4kkbCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699564, "uuid": "274ab7fe-7294-4c66-87e7-7abcb30f328e", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699564, "uuid": "2db9f5eb-3ed7-4f69-b88f-155ce4ef8ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699564, "uuid": "1653d689-4ec2-4896-853e-de32cb718a19", "value": "DHL Invoice_HANR002159473.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a61cfb-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680700373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700373, "uuid": "1f184ffd-27db-4c23-822d-abde0d9ca4e0", "comment": "Malware payload", "value": "96ffde499ea6d62b925eb408d85d3ae9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700373, "uuid": "93b284fd-901b-4b4f-9bde-1267a1976a1f", "comment": "Malware payload", "value": "877eab97a646537a76895ed659d2591c31404a96f4427d04a2c55c85606920a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700373, "uuid": "dfd68290-5961-48bc-9de5-e406101782f1", "comment": "Malware payload", "value": "f042413a99f858b8835f5a1913ad949a7d470434", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700373, "uuid": "9625750f-fc8b-41dd-afee-0811ceaeaa90", "comment": "Malware payload", "value": "714439deefe5dcade66084faf0958268bdc4fba409cb0c70777edfd5da6026a89aa7881623890b060b0573d0283b4000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700373, "uuid": "a6e2286e-8da4-49db-ba15-1bb6e72f3f92", "value": "T1E42523CAB19CE434C41E967C7E97B002B724AD16BD6AC74B240CE25D0C3E9BB9DFA151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700373, "uuid": "5e36ac9d-285d-4352-a077-e4408e7ed9b7", "value": "73ec795c6c369c6ce2c3b4c3f6477daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700373, "uuid": "77cac224-ce03-48f0-8bf0-59115f0d6465", "value": "24576:uyDoTqctaY5effnW8RDsXOvvYh1BKy7ILN7qxx+HP2n:uwoTpE/WwDIngzRqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700373, "uuid": "fb88338d-d4d8-44a4-bff2-3e96dc693e47", "value": 1001560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700373, "uuid": "92e55c9e-143c-4fc0-95ff-c7eefdcd8ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700373, "uuid": "ca7c359f-9f16-49e0-b779-b07064d33295", "value": "96ffde499ea6d62b925eb408d85d3ae9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d809a35-d3c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680706780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706780, "uuid": "68eafcbe-c1b7-4d2d-847d-e8d5a66335a7", "comment": "Malware payload (Formbook)", "value": "1ed1ae52785f50e3ba1bee8c0c71a8d0", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706780, "uuid": "a2fd09e4-2223-49fb-9d48-8426827c2df3", "comment": "Malware payload (Formbook)", "value": "87b9b4c99a296003001f8fbac9c6bce260b054a6ce135d6f99449cc3e27ca816", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706780, "uuid": "924fdb65-6696-4b56-82f8-4b2bb1aded99", "comment": "Malware payload (Formbook)", "value": "a5aed746e30dc95b0303ccd0dc8671561c066ccb", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706780, "uuid": "8254b28e-9892-41f4-826f-0cd5a690accb", "comment": "Malware payload (Formbook)", "value": "51245d5401c069e9e4ace01e811e469611b8dc57db40fa2386b831a14398996eefd7d1c306e60db12371204378414803", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706780, "uuid": "81c141d2-9a8d-4d50-8914-cd156aa16aff", "value": "T127663901BBE59E12C1BA0337D1F054284BF5EC52A211D7A9328D36AB2F737924E17B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706780, "uuid": "57ea30b9-c939-40a2-979d-75376616c870", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706780, "uuid": "77aaf7f2-7502-42ea-b6b2-380659655b0a", "value": "49152:rzXQe7vymrlS47dVN2y5YPkwfTstQ+AVQtXXuIVXXXXXXIi7tJBpDPXa4QfxiVMH:XwqlSgdaaaTH++QtXXuIVXXXXXXIOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680706780, "uuid": "5b610eb8-744a-4535-a53e-4738f04476b2", "value": 6534144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680706780, "uuid": "a9cf34ea-c571-4072-8f7b-02da6c113b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706780, "uuid": "ca5419d8-5d85-4a05-b571-d6b46152f890", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f7fe3e-d3e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680719494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719494, "uuid": "a2476ba4-733a-46b3-b6e3-46838c26daad", "comment": "Malware payload (Formbook)", "value": "34b974d7e780a7d034831c1fa59c4587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719494, "uuid": "a7aa2886-ce09-40c2-8f5b-ee110d2916b3", "comment": "Malware payload (Formbook)", "value": "87bbce3aff8ba59a541bd7fdc7c8df35108dd3ca5829a50448d4efee6abaac1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719494, "uuid": "616c59f1-4bfc-4a91-98e5-5d6839ff5e41", "comment": "Malware payload (Formbook)", "value": "c79b3162d5b5a5a9e36ab32b017a17b35f4fb910", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719494, "uuid": "a7157f4f-360a-4f0c-a620-6ed281544315", "comment": "Malware payload (Formbook)", "value": "353ed85a958333726d8f4969c7a61bfb0cb11170c5468442fd95225c7321b373994f5e68be41c2ae0095f170388037f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719494, "uuid": "ac030ab4-ad4b-4e6f-8e6d-8e293c7309fa", "value": "T15EE4124423F89B25D78E8BBAC8B6215067F5B93A2462F75E5EC674D50CB3F00C4607AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719494, "uuid": "4db0fbe7-b87d-4255-b4b6-c6eaf6ee5cc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719494, "uuid": "fad23d79-c51f-469b-b0e5-fc4f425ee757", "value": "12288:OBPXMutKL7CSvUTJBwKiDOySSeeNaj0Vnl02E2XKxXfKJ:ORMutKiqUEqyVPNVBPKZfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719494, "uuid": "78f99b6f-ce94-43c6-8b80-4b85f9886af7", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719494, "uuid": "1aeb730b-cae8-4ce9-ac5b-95ee4781581f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719494, "uuid": "b74e2f93-bbb0-4c6a-9ff7-7fa0ac97e56e", "value": "Leintz PO-2023-04-05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83dbb388-d364-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1680666418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680666418, "uuid": "141e4c43-2e7b-409b-a868-e4eb83c62fa1", "comment": "Malware payload (Mekotio)", "value": "d8faca1bdbd5ee05ce1fa011268c0f5f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680666418, "uuid": "42ba31ba-dd63-4b61-866c-815fabce544e", "comment": "Malware payload (Mekotio)", "value": "8877f6bdb01fa28c1fa315067f2278988e01247d4523cb3f9de370071e77c442", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680666418, "uuid": "4fd4f3a8-f22c-49e2-8575-ac0f045d1f6a", "comment": "Malware payload (Mekotio)", "value": "72b70d22d750514e11992a87a572f35fc1e3efac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680666418, "uuid": "5c59f2ba-f525-4b38-80c9-78c7fca902ad", "comment": "Malware payload (Mekotio)", "value": "c0a8e4a034cecfe677727019cfe1ae67b846cf96599ff6c7166fd0083740392ae0dcc802c95be7fbc0773d354c8420a8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680666418, "uuid": "c66c96c9-6891-4833-b66b-32db21eef5bc", "value": "T1D9762363E7671141E4FDC9BA4F13BED134F203199762247EA9D1AAC730E46E0B6D2983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680666418, "uuid": "018a2db7-e45e-481c-b537-b03d1f676fb7", "value": "1a1f490aec7b9e60556b1999b01c1689", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680666418, "uuid": "97f3968f-e401-4ebb-af3f-2946f4aa9fb8", "value": "196608:D7dphhwP1cb3d9R/eimoMn47+KNwn3Mdu5Dt:DZphhVx9RGimbnsWnaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680666418, "uuid": "14f3f803-843a-4891-a420-65779e3074c1", "value": 7638528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680666418, "uuid": "33a02039-a504-4591-ad3f-2384d51c5ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680666418, "uuid": "73b9f5d0-27a2-412c-8fb5-037a8d014841", "value": "rjABiZsq.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e75eae-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680700511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700511, "uuid": "805df4f7-6580-4e39-893a-c7c13134165c", "comment": "Malware payload (Loki)", "value": "ffc772d84e785f2837515d944f7ba2a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700511, "uuid": "a229e42f-8202-488f-a640-958c5a9a815d", "comment": "Malware payload (Loki)", "value": "88e7e6f23a45b8878b45a1beecb9152c88d715be23eb837f22ca8b5ca9a448b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700511, "uuid": "395ccb9d-88d0-4869-b9b5-1ade5908e5a7", "comment": "Malware payload (Loki)", "value": "3482f1dec371991c0ccd2acc5c093de0f24fa25a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700511, "uuid": "704379b3-5687-41a4-bd02-b0ef7598d5ae", "comment": "Malware payload (Loki)", "value": "2eb4495b13f2fd4c86300a45e853e21b3a6b584c9ec0f2c14b50f1c8a63b3b3510a094ebfe1520e84bd0c6a60d11d557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700511, "uuid": "60986b39-ad77-491a-acb5-4673845918d6", "value": "T171E46B2E8E14C1F5F6BC07B5D0D33F192EA40AA243E6855CB87761D63B81B8A5C1D98F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700511, "uuid": "10c8ba53-083b-4056-bfcb-3261ffe534f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700511, "uuid": "7e13921e-ee12-4af5-a994-85f47bb29367", "value": "12288:329B2iNSDE7HJlNBLjYkm0UEiRIr4otbyJRSAju:3s1ID8J3trZic8RS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700511, "uuid": "ecae27a9-b534-4666-8f8a-7fe8ecca7cd7", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700511, "uuid": "1c836ef5-6d84-459b-aba5-ff96b9dbb771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700511, "uuid": "fa648da2-d46b-468c-b83a-2305221c5619", "value": "ffc772d84e785f2837515d944f7ba2a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93bb8a5b-d3ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680711971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680711971, "uuid": "1930d294-d58e-463b-96e9-e53c18290051", "comment": "Malware payload (SnakeKeylogger)", "value": "6c03ef3cd789506ec6b5cfc2bc68ea50", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680711971, "uuid": "a823f4ae-6e94-42d4-9117-1d2ff786515d", "comment": "Malware payload (SnakeKeylogger)", "value": "895473992ee282f8611cba9edfd272bbd25476e3258529c1955180bffd7b37e4", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680711971, "uuid": "896f6685-016c-445a-ad7f-fdff59583cb5", "comment": "Malware payload (SnakeKeylogger)", "value": "0f35c14e957fca0aab5ce2eac7acbc7cfae6225f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680711971, "uuid": "4eaa1928-b19a-4dfc-b31d-08d8691edc6f", "comment": "Malware payload (SnakeKeylogger)", "value": "2fb50e36696026ea4c39f1572f6e8e25b76326e174d9654627f1d9b6c6b6b053c78c4828ffca7dc62eaea708ebb53995", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680711971, "uuid": "de4129dc-f22e-46bd-86d5-f55082d6668c", "value": "T1E03523937E8038B3D738DB8842EC71BE3766E9046B2F7E36EB4146994E2C0E751D4529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680711971, "uuid": "c5c713b3-a169-48f1-b5aa-a1398f61b755", "value": "24576:ylbs1LStC2QYQVbITo/nosERlbskCmBz2QC7DITP/J8rY:yhsc02Q7MTo/ntERhsyF2QdTP/J8rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680711971, "uuid": "e826b18d-eaa8-44b2-8919-d0d4931514b4", "value": 1098750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680711971, "uuid": "5eee2847-2988-436a-88ed-b1c4782d83aa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680711971, "uuid": "d4611043-0028-4e52-bb4f-3c2fa1144bb9", "value": "Maersk Shipping Docs.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c094a06e-d391-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680685847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680685847, "uuid": "b5a9edd6-df80-4ead-8f42-d2048ed9b7ff", "comment": "Malware payload (AgentTesla)", "value": "e7762a6f171896fccbdd881c6b637b25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680685847, "uuid": "a3bcd11e-a2d2-4915-955a-750f1caf0950", "comment": "Malware payload (AgentTesla)", "value": "89a1bcbf5cbf06ae932e2c7fe045436200ef03336d4df4202b359c477f08acab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680685847, "uuid": "2af5d22a-9173-4f01-8d38-17b4f9ab0ddf", "comment": "Malware payload (AgentTesla)", "value": "6a0d94e326f6ae861f208658052766cf7a20f88d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680685847, "uuid": "8b187d0d-3ce0-4fb7-a41c-3ca1cf049905", "comment": "Malware payload (AgentTesla)", "value": "9ace1915a3925e27f019017db88bf17d0b1c30e7ba32ecd3728d3512a2704c15629c436cba1f0d45a66c66aef3f3498f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680685847, "uuid": "e0931fa4-244a-42d0-8c47-298dcc5b40c0", "value": "T1CCE4222433E94F16D24E8BBADC9A310443F5F52AA8D6E71E5EC579E86DF3B40C5012A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680685847, "uuid": "d13829c2-b278-49db-ba9e-825b5536b573", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680685847, "uuid": "e5eb71c7-f557-4568-b153-137672d41580", "value": "12288:25jzgMLFriKrHuv3B81xc88oG4xoMU6d3XNTeFUjNcj7Ckwt:25LJ+KHuskormMJdHteFtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680685847, "uuid": "6a014f55-7393-49ec-a2df-04f6145bd352", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680685847, "uuid": "3acc0b4c-aec8-49ed-9dad-60ff6a7af4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680685847, "uuid": "5aa88d89-1489-4122-b7cc-fef99f651888", "value": "Catalogue-05042023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c25723e-d3a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680695879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695879, "uuid": "11008e59-d93d-47c6-96b9-a8c315169d4e", "comment": "Malware payload (SnakeKeylogger)", "value": "69f3b04d947ba270077da29af726f7d1", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695879, "uuid": "955ebc3b-f332-48e6-b8db-eb0bbb7b5716", "comment": "Malware payload (SnakeKeylogger)", "value": "89aad4e1d57a1f40b443d73b531ba7389b6967d98e2e5534a65bcba71e137c94", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695879, "uuid": "40f2fc23-3a1d-4d47-974c-85d03254e0cb", "comment": "Malware payload (SnakeKeylogger)", "value": "64b32d4657c3538a30981af3d553b8049d542ebe", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695879, "uuid": "bf6aed94-58b5-412b-9afc-4e73ffcac8a0", "comment": "Malware payload (SnakeKeylogger)", "value": "549a469976291e202994730b50eb64939b571613c7d19ac462af27b4fc1fc8051da5c83728c85921b8d84894d6f540be", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695879, "uuid": "164f544c-15a3-4df3-b0cc-ca8d072db556", "value": "T1BAE48C2E8E14C2F8F67C47B5D0D37F192DA409A247D2851CB97B61D63781B8A5C0EA8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695879, "uuid": "81111dd6-13df-4755-9f8c-63d1847a7101", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695879, "uuid": "378b89c5-419c-470b-9d1a-841d20657399", "value": "12288:vwFZ8uwN2iNopTHaMEeBOwZwCPV3Lyq2kIazNSaZ4:vwFZgN1+pTHaMlQwZwwlPNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695879, "uuid": "b1a00a07-5bf0-4d84-b3cd-dfac166f1eb0", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695879, "uuid": "3223a7a4-b7c6-4773-b679-28e8c88a1849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695879, "uuid": "3639a741-1047-48e0-bbd9-dad3fe1d6971", "value": "Confirmaci\u00f3n de recibo de transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e1d369-d3c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (FormBook)", "timestamp": 1680707003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707003, "uuid": "ff712327-85a3-4f2d-a428-b1916cbb9d9a", "comment": "Malware payload (FormBook)", "value": "c8d8e10babd50bf77d413e10e80660b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707003, "uuid": "660237c3-4a73-487f-be9f-15b9fcf409e4", "comment": "Malware payload (FormBook)", "value": "89c1b554990c167dfb297996db02c0f6ca7f32606d5249ee26942e3b09b2d766", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707003, "uuid": "ebf7334a-e40e-4a11-855c-04302f4f5bfc", "comment": "Malware payload (FormBook)", "value": "5563988ec13f9a85aac37649cf1f4f6ba40dfe17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707003, "uuid": "e7c9287d-551b-48e0-bf40-c5ebf263e7b4", "comment": "Malware payload (FormBook)", "value": "95cd7a3cf58dce635f75cd1acb1a9d9c9363940af73efbaa8b3e73d10d75ccfe66f78741d656485aadc48b6c8d6b3079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707003, "uuid": "9e79a482-ca6f-40ef-b540-0d563ae2b2b0", "value": "T13C451202BEC29832C1A31D326E7A6721757D79202F65CFDFA3C5462DEA225D0DA317B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707003, "uuid": "254e0fc6-3b7b-4635-bcaf-2c131eaf687a", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707003, "uuid": "0676bd56-7845-47b7-b691-466ce1405752", "value": "24576:NTbBv5rUanRE0g7R3IyTxxmm/FpXwF+XgOPo+0:HBjI4kV/FpW+XgOAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680707003, "uuid": "247f0a47-a15e-4273-8af3-7f81972e855e", "value": 1192090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680707003, "uuid": "ee575f63-d3bf-45e7-b1b6-b201eee7e007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707003, "uuid": "78813461-b11e-4206-aeef-ee8c3fca6f62", "value": "89c1b554990c167dfb297996db02c0f6ca7f32606d5249ee26942e3b09b2d766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5583690e-d402-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680734200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734200, "uuid": "0ba18d84-24f9-4541-8a8a-540f398b70bd", "comment": "Malware payload", "value": "4c64e9a16fbac9170fcc5c18a7dc94c2", "object_relation": "md5", "Tag": [ { "name": "binary", "colour": "#F3442E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734200, "uuid": "59897b7d-85b3-4bf9-9746-5d5d12c70793", "comment": "Malware payload", "value": "89c443d3ecdd923419be66119a486a0016c9812c022ad538a84c0f16bdff6ff0", "object_relation": "sha256", "Tag": [ { "name": "binary", "colour": "#F3442E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734200, "uuid": "cac2e3d5-ae1e-4f5c-8dbd-aead7da1967b", "comment": "Malware payload", "value": "5a86525e83d74d324266e44dc415f393c0d1a8df", "object_relation": "sha1", "Tag": [ { "name": "binary", "colour": "#F3442E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734200, "uuid": "3f96a2d9-7b42-4f77-b166-56d1f76affcb", "comment": "Malware payload", "value": "d3e57e4cdecee64c4ab0ac0cdf43cc72295e876ab8311d9b5e406cefa996997db62b32e02e4a3715b50ab8a5310aacf6", "object_relation": "sha3-384", "Tag": [ { "name": "binary", "colour": "#F3442E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680734200, "uuid": "bf6e1340-7e3b-4008-ac33-c6f8501048fd", "value": "T1A6073A47F89150E9C1EED1308A26D2A2BA703C455B3427D72B50FBB92B37FD4AA79350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680734200, "uuid": "1dcdcc2d-7566-4fae-8cbd-a9251915c4e7", "value": "98304:yv3umbcyOzMqjLoj1bbPpgISKhw/Om1Ac3ynITjcZyhRu45RNB2I7lzkczuEleZl:PQbb+ce//le1yvgA7Tdre+/xCkeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680734200, "uuid": "972d4e48-69a0-45e5-8b58-834d1d625ae9", "value": 18156144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680734200, "uuid": "a7f08079-d396-47b3-bc6e-8d5a303a226a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680734200, "uuid": "2fc101c3-0e20-48f3-bad8-d88973288216", "value": "rhadamanthys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6051383f-d352-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680658627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658627, "uuid": "40d46d8b-16e4-4bab-95bf-43e6228a63ad", "comment": "Malware payload (RedLineStealer)", "value": "6d26e2643528fd223b91dde3d935fcf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658627, "uuid": "d5cc6387-e49b-4e96-bcf4-9e58dcfe45b7", "comment": "Malware payload (RedLineStealer)", "value": "8a063362d9b9f9117c8a3cef81bee61620bab5e9c4b37f96bb9ea427412ebf68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658627, "uuid": "b1333c86-81c5-4f9a-a7ab-39a30caf3602", "comment": "Malware payload (RedLineStealer)", "value": "99beaa86c508e4dfef18e5b7bc73f657a5c873e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658627, "uuid": "9b900a97-0992-4a83-91a1-864c25b37aae", "comment": "Malware payload (RedLineStealer)", "value": "e3ebabbddbdde3680251c6c7be9797341b7f397e31defa2fe589d323508c14a69471fb31612ca9f5ee1dbca11ae62aa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658627, "uuid": "f50508f7-5de2-4b0b-9970-b43506c6244f", "value": "T138352323E7F45872DEB21BB418FB2AD317757CF48D34565B1B24A80E0CB2580A97672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658627, "uuid": "7db063c5-3554-465f-b28c-69bff721d207", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658627, "uuid": "332ed99d-0df7-4388-a9d7-3b9f52406562", "value": "24576:WyB3XDmdwWqqR4LpfEcxRRYNeJ1vbTyHcJaC7P9GBY:lhDmOPb9sQg6uIac9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680658627, "uuid": "bc744287-4b3a-47b6-bac7-fa0efd3696ca", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680658627, "uuid": "aba73a9e-199c-406f-97d7-e3a6304aa203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658627, "uuid": "79cfcd08-83fa-44e8-ab8a-6795b15b62f3", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e152255b-d39e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680691485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691485, "uuid": "64ff02b8-4ccb-4699-b98c-b6b954fa1a8d", "comment": "Malware payload (RedLineStealer)", "value": "1d064ce0fd9a013dd748f06cf91cf7d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691485, "uuid": "07f58ba7-d2ba-4445-bb96-84217a23d2d1", "comment": "Malware payload (RedLineStealer)", "value": "8a41678796c2d3fa178d85197ffb8c3daa88e07076c83a40a0126cdbf5ccdd97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691485, "uuid": "67503421-17d3-4d89-b566-d3b3f1008d81", "comment": "Malware payload (RedLineStealer)", "value": "477bc0f8aee3dd7d6450db3bd9b42576e6741801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691485, "uuid": "1274b435-19c5-47aa-9ec8-9668398903ae", "comment": "Malware payload (RedLineStealer)", "value": "84d35254828f2c629bda6505f4e94275fac257bc659952410fab81a043783c2442ad51dd5e70d38d641a3e91513b9b36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691485, "uuid": "e9065d72-a430-405e-8e78-6b9c8b1150d8", "value": "T1AA04B51437BCCD11E1BA2A3F6961A05147BF98026852F25B7AC367CD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691485, "uuid": "ebe6a972-2afa-4ba8-9f7c-a2669be2f2e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691485, "uuid": "90a19c6c-dca9-4f05-a5d8-2a427763a178", "value": "3072:yxqZW11a2kX8fqvPIeJBeGg9ShLrxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOJ:gqZkqvPZJ8Sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680691485, "uuid": "58c3501e-13b8-40bf-a544-c1933e3468c2", "value": 179251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680691485, "uuid": "5d2aa372-5f98-4f45-93b3-c0d168ef91f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691485, "uuid": "920573a4-fb2f-4f0c-9ed1-d5cff38d53db", "value": "8a41678796c2d3fa178d85197ffb8c3daa88e07076c83a40a0126cdbf5ccdd97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575aea79-d3a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680692113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692113, "uuid": "eeb6b703-312d-4645-878e-70ad8da8e473", "comment": "Malware payload (RedLineStealer)", "value": "5a4039c36c200e716a6d8f167a02f200", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692113, "uuid": "16c5722c-2f6e-461f-a964-1be00b3f89b6", "comment": "Malware payload (RedLineStealer)", "value": "8c4902519e7490acee349095e6edbae7215f3672ba0addb8ccbf21ec8afe673a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692113, "uuid": "64194d7c-df27-4f1b-9277-f23a0b4059a2", "comment": "Malware payload (RedLineStealer)", "value": "211e482a60f258e1f1bb8e06f7131850018faf89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692113, "uuid": "ca073497-d1df-49b0-91f4-bea95fe14b46", "comment": "Malware payload (RedLineStealer)", "value": "9b7706a39617086034e21bbce9210ed585b219ada1a8601c049e555a2058bafaa6a2c9b185873850c4560a100a14cd38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692113, "uuid": "8b7407cc-29ec-43f3-ad17-805f803ce6f5", "value": "T1B404C51437BCCD11E1BA2A3F6961A05187BFD8026852F25B76C367CD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692113, "uuid": "fc336935-d2ab-4529-bae9-16c2c6b80b42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692113, "uuid": "8b1f1b91-59c8-41aa-90ce-fbd434961602", "value": "3072:4xqZWZRanU2n0/Z62eJ5evJ9ih+PxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOm:mqZg/Z6XJIih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680692113, "uuid": "900c727f-15a7-43c6-aa83-57854bc39de2", "value": 179850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680692113, "uuid": "a02d961c-fd39-41e6-95d4-e508ae4a972c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692113, "uuid": "3b9ed606-0ae2-4dc0-b4b9-a0304638af12", "value": "8c4902519e7490acee349095e6edbae7215f3672ba0addb8ccbf21ec8afe673a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afbc8a6-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680718238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718238, "uuid": "8bd2faf8-12f2-4023-acbf-2b982063b32e", "comment": "Malware payload (AgentTesla)", "value": "8b007e78e69b057ef5a31e1c0a857e4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718238, "uuid": "c526de33-c078-4113-b19e-a2fc21f1f957", "comment": "Malware payload (AgentTesla)", "value": "8cc9c932696c4f17890b0e7e4fd3144f6dbfe16bf440de5018cc00de2dac0f2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718238, "uuid": "e22e3093-69c5-4ef0-89f4-7ec53c1d3d27", "comment": "Malware payload (AgentTesla)", "value": "bb5172e498011b8ca736f6863d6cb79216123c4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718238, "uuid": "b7d1ec2c-68b4-4bd6-9834-cd99255d362c", "comment": "Malware payload (AgentTesla)", "value": "2d44c22f60632014a80848464fd8d2ebc04aba00c09370f56446741b465c0c717b1fd10ad3d9d147a7f68e8ee3df4962", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718238, "uuid": "8ccf2aa2-986c-44bf-b880-c5a5fa0a6ebd", "value": "T11FE4221623F85F22E19E83B9D495315047F9BD6978A1F75E5ED0B0E91EB370089823E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718238, "uuid": "5529b67a-80ba-45e1-b367-a96fd0750455", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718238, "uuid": "e77150dd-4e6b-43f7-95fd-819407a293b5", "value": "12288:CfJ9l03hSUp6PB41O93nqW2HtSAgu7wqD491:CfNI5p6PB2kn2XxD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718238, "uuid": "7f82c7de-fa0e-4531-8417-799ff421c30e", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718238, "uuid": "1f22c1b1-7b4b-4ec8-8285-0c5bcc52ba31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718238, "uuid": "a0d9765b-f1af-408b-bdbe-60e98c3b3e25", "value": "NR. 04-045_PROFORMA INVOICE. pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f723e92f-d3a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1680696246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696246, "uuid": "54aa1ca2-f533-4782-a0dc-04acfe66729a", "comment": "Malware payload (GCleaner)", "value": "81a953d9ee346ef7115b1c34fcf387ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696246, "uuid": "93f15f20-b1c1-4733-a67a-ab0c9398cc89", "comment": "Malware payload (GCleaner)", "value": "8d373fe483977f095f6017d9d62190c73a48e75b55dbd81b933af93edb7de72b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696246, "uuid": "b1e117f9-50b2-482d-8724-24b815ce6ae6", "comment": "Malware payload (GCleaner)", "value": "27002576173bc56690b8ca08351d1d6e2941c92c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696246, "uuid": "dad279c9-5b98-485f-bd80-3c494f702889", "comment": "Malware payload (GCleaner)", "value": "b6204b1cc1b91edb9b46e57831ea395b929f8ece5f403c5e606b7c982dd485eba661fd8f14b72a1d254decae7eac04a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696246, "uuid": "2d5cb5cc-a773-475b-a3e3-44dff190e49b", "value": "T11E74C01163E06830E61B0B318E2EC7FD2A6EB860AD657E5E17B9497F1D303A1D27271D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696246, "uuid": "d3ef5371-ed78-43da-abb6-459204a42a2a", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696246, "uuid": "7c7227d4-3423-4246-b155-d8bba1b14a8c", "value": "6144:tjONygp6w335FFFu2/5OQ+KsPC1YB9vpDuxfPaW:tjONygww335FFFft+KKT8x3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696246, "uuid": "bfb460a1-a8b6-4423-91d3-e842b1cdc7d1", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696246, "uuid": "98b33656-78dc-4f4b-8bda-532722d8bb2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696246, "uuid": "22284427-8550-4c4e-a8fc-f8c29d99563a", "value": "81a953d9ee346ef7115b1c34fcf387ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4bf3d1-d3ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680697166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697166, "uuid": "74128d12-49f7-4042-83e6-ffd5b2e00d86", "comment": "Malware payload (GuLoader)", "value": "9bfcdeedbf4addecded8b18e4a147070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697166, "uuid": "0341cb12-bf21-4b5e-a17b-eb7672ef48db", "comment": "Malware payload (GuLoader)", "value": "8df331ee8fe72b0cb3841b608fe52f27f967a298337919bc83dc6b51bfe13ef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697166, "uuid": "43dff666-a64b-4c84-982f-d1f3f0158b7f", "comment": "Malware payload (GuLoader)", "value": "6726ccee53e496c5c51872c1049f33c1cf2be7ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697166, "uuid": "6474fe2d-ff83-4b0e-8528-2f1f4af55e10", "comment": "Malware payload (GuLoader)", "value": "829f7847f6b24dde2c6b9a2ed124853693c697a203805f22be6cb630c9d3090828ae4f11fc87d6facbc1168a15ce161d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697166, "uuid": "63df406b-c81f-4c94-bbb9-5c51ac7e7b64", "value": "T186E401412B7CD927E7A6797F2423B24C35AEAE509B55C52572633EFE9E783012E07203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697166, "uuid": "dd3129a9-1330-479e-88d3-c8e5cc7f3e0c", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697166, "uuid": "e4ec3080-8be3-45c8-a366-bafca665801e", "value": "12288:wMw4EAPcLqb0QPcsI9RLApGYNJpcJT3yZrn0aHDyq9DSXALFWn3JcaLUx:wMwtAPcLqbJPF4iP9cp3yBDyq0G6ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680697166, "uuid": "36c72b0e-3179-4360-bb58-740f0997cc25", "value": 697760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680697166, "uuid": "6ae84a74-01d9-48e7-bf87-d77c61ebf30e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697166, "uuid": "bae397ea-4f5c-4989-8827-0e2af9c8e962", "value": "8df331ee8fe72b0cb3841b608fe52f27f967a298337919bc83dc6b51bfe13ef5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52edf9cd-d39a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680689528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680689528, "uuid": "f1ce94c3-a2ef-470b-9d2f-0d778059e5ad", "comment": "Malware payload (Rhadamanthys)", "value": "91fcc079b33d90c504df8d935b46e8e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680689528, "uuid": "b3941c40-7125-4338-b46c-d00f8efa2b61", "comment": "Malware payload (Rhadamanthys)", "value": "8e05fe5a2271126b27ee3a7c2a6aa9e5e7e009efa4acfc29a688e3c2873110bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680689528, "uuid": "1bb2bf19-04bd-4e1f-be73-238fdeb48277", "comment": "Malware payload (Rhadamanthys)", "value": "d45849d356f6121e5ef1a3f13add2ab1ae7f81e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680689528, "uuid": "b1cabb3c-52a9-4652-a9ed-98f7fd98f476", "comment": "Malware payload (Rhadamanthys)", "value": "de3b345bc5bf4f5019368548a07f2503b2536f64362bf3c494df9d5971843072a49aadda829d756f6ba2ee4d6e78a3de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680689528, "uuid": "50360028-7eff-4fe9-86c7-e545a118ac35", "value": "T1FA54D011B650CB72C64385754835C3F4663AB8B2DAA686C3775A3F6E3C312C26B7B351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680689528, "uuid": "60e6d6c8-4292-4bc3-a421-1cc972004a84", "value": "7e3b1e18e4b8642ee42be6e8ca53a819", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680689528, "uuid": "5eceab80-70ac-4d8f-9d2c-8f4ac087d973", "value": "6144:F624jZbj24naPblybT4LhKTKeJbBGCsZI8f/T:FmjZbj24aPxETShKTTHsS8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680689528, "uuid": "b30b7ec3-ce2a-44b7-b21b-c54f42222a5a", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680689528, "uuid": "ebb96f35-2a0e-40aa-8aab-6361676a21ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680689528, "uuid": "4d02ecab-156d-4fd4-8ea0-cd074f285929", "value": "91fcc079b33d90c504df8d935b46e8e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2dd5ff2-d3e4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680721499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721499, "uuid": "b46f6f5d-aec7-4485-88db-efd904d4dcbf", "comment": "Malware payload", "value": "0320182e23b44126be5a144b7a8ff648", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721499, "uuid": "adb48a17-9a6f-4dbe-b5d2-50a379763c07", "comment": "Malware payload", "value": "8e57f4355c28fcb5fba9768415171d9499a24e960de241dedd246e8beb1f0d62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721499, "uuid": "c70eb4f6-51eb-49e6-b45c-b67a32f77b69", "comment": "Malware payload", "value": "cecdb64dfad0eae3a754c38bc5b19868f4300cdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721499, "uuid": "66d22509-1df1-4360-88fa-aec112e7511f", "comment": "Malware payload", "value": "4d108b13a6bd09fe8319410ff0edeba93190419071fac045acc1269ef69f3b1d7ceb4ccd7ab57988e54afbcdf357478b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721499, "uuid": "d5184562-9f8a-4d53-a36f-9e9807c2c44f", "value": "T1BDA6178BA991CE56C322B6336236CA0D96D6DB1165C7E32ACA3F13C72F43B7D61401D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721499, "uuid": "0efe245f-c569-4368-8a11-4120eaa86376", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721499, "uuid": "89419d47-cb4e-4260-a2b0-b59faf2d59e4", "value": "196608:TcCfF0HAyIORE0dX8PrelUrFCX1MTkmQ:TJNGAyvgCX82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680721499, "uuid": "5b0008a8-136d-4e8b-a7e6-dc582a5a677b", "value": 9718784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680721499, "uuid": "3b509edf-795b-42d6-b3f6-8e4efb38ce14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721499, "uuid": "f5ba78e5-4f7c-43b0-a358-ec16a634b791", "value": "New Kiddions V2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7be6b39-d3ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680726285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680726285, "uuid": "7af215fc-2a77-4d80-ad00-c09512fa0197", "comment": "Malware payload (AgentTesla)", "value": "7eb0a65653453e6a59beaa69ede2c65c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680726285, "uuid": "5d6df165-1bbc-4c79-a412-1a1a47ba5de3", "comment": "Malware payload (AgentTesla)", "value": "8ec8019892b2f4625446c785c98dce87ac6362cbbdef61f57c4787ec35bbb262", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680726285, "uuid": "67bd7812-8419-4797-acd5-0f39b9a1cafd", "comment": "Malware payload (AgentTesla)", "value": "e910dc2133f16ee511e8046fc219d0a7f63666a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680726285, "uuid": "dd75aa6c-0b73-45eb-a2e1-3747af300189", "comment": "Malware payload (AgentTesla)", "value": "b2e57b085ecc31f3f59e2bce468ccff9faa543a81ef02c08286d1a315192c1561414bbb0afa20e544d8515d8b19b8c14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680726285, "uuid": "b4acd17b-6739-4c6a-9986-70827ae39bf6", "value": "T10AE4129E774AE351C9A90B778C17289003B4EE37A196F7552CD9B1E70EB73880C90B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680726285, "uuid": "65319976-3591-4282-a635-319b0f72ce12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680726285, "uuid": "f44dddc4-589b-499d-8a9c-d18274982b60", "value": "12288:Crbf4lQKmr8AnGiWLHns/7AUiLweZuNd8l2f6+PXE9MzDrgzbE8eQU7:C37cLHns/IwMuNhf6lMzkbE8eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680726285, "uuid": "1182325c-f3c6-4a21-a30c-5861350ebea0", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680726285, "uuid": "6ef5f7a0-cde1-49da-93be-406b6228a905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680726285, "uuid": "010fb480-974c-4fe4-bd51-6b90309d7f69", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e1c54a-d3a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680692115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692115, "uuid": "f0d52054-8b40-41fa-b707-1ca965c3c28b", "comment": "Malware payload (AgentTesla)", "value": "e750cf387b132024ce150b7f671ebb9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692115, "uuid": "3db5877f-3141-40ba-88d8-f8b5173aadfb", "comment": "Malware payload (AgentTesla)", "value": "917ebf9da67173bd105c114545c9fac084c863a69cf3a9efab6591aaab00a6e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692115, "uuid": "fd0ad051-0196-4d4e-9baf-541f0c95d7ba", "comment": "Malware payload (AgentTesla)", "value": "cb272f2393468c0dab6b40f34c1a6aac8dbf43ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692115, "uuid": "506a4d07-e38e-4270-9829-6db66df5d5d3", "comment": "Malware payload (AgentTesla)", "value": "56536cda43e395f88435c49a6fcdba1135f14f43fb002347c70ad53cc528d67c8ddfd5a50c3e5c5c19287000c3706403", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692115, "uuid": "4082590d-f2f1-4172-a046-8e7f2cceec75", "value": "T1AB94123167F1D47BE1E325301AB9927279FFB42610A8824B1761CBDE7676483C31EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692115, "uuid": "096ea009-c06c-4947-9c3a-45e5760433f0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692115, "uuid": "8a072219-0c9a-4cd4-9383-e799a8f07b7b", "value": "12288:PYP57CynljcxSOjMVb/f8x36eO9dhOfWNY5:PYP5DljcxSuMVo6ee+x5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680692115, "uuid": "03626c4f-4bf4-4fff-9655-002f26144f3d", "value": 419958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680692115, "uuid": "00d08610-39d9-40b5-9c06-2acb954af6cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692115, "uuid": "4cd0a37e-d5d8-4b65-bee2-0545e774035c", "value": "wife.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702350fb-d401-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680733815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680733815, "uuid": "6527b153-ca54-447e-8503-fd5997838c4e", "comment": "Malware payload", "value": "7e3675f5627df661b166fc81745a3d0f", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680733815, "uuid": "6b4595cb-e913-4ec3-8fcc-755dbcc68398", "comment": "Malware payload", "value": "92063ff24b73592516e04428cb9c8c01f3718423f25d211bd4c5b37dcd8919f8", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680733815, "uuid": "c0012d5b-3cf7-4183-a1ac-1fcef849fb32", "comment": "Malware payload", "value": "289aebad3e3c429ba79ca3c9568a97365887e1e9", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680733815, "uuid": "240012cc-8f78-4393-8d3c-c143c18708ae", "comment": "Malware payload", "value": "34ea0e22d879fc7d193d65f896d922b032e723f7d9a4d23e7e76f2b11edf138d2b92caa3eef2766700d3b1cd4147e2a0", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680733815, "uuid": "619721ee-e145-4f5d-a660-661e3f3ca8b8", "value": "T18BF5333B2DE08A53D1140B182F2C29DD3FEF5C58E258FC3514794B476A24A9A6C7B393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680733815, "uuid": "69e3cc9c-abac-4430-9d32-7fc5225640ac", "value": "49152:d/mL2oHqqxJHNfUl6K25d0ZkMdWz8zScCJYE+he5xOF1Qdg2gT0wD7ewl5qNd1hj:o6oHqqfH6MdCkMWos5kM+J9vewlG3xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680733815, "uuid": "310a4e37-6dce-47f8-bccf-d3255383989d", "value": 3486190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680733815, "uuid": "9cc9efb5-35b2-479a-b8e5-607b513ec292", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680733815, "uuid": "f80754e5-1d11-4d91-9de9-ff57f6a9954b", "value": "KiddionsModMenu.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99787cb-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680700465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700465, "uuid": "89b343ea-9c1e-462f-9178-dc1bdfc366cd", "comment": "Malware payload", "value": "1ef6cc2abd6ca11e8fdc48a59f4efae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700465, "uuid": "5d540514-7eb2-47aa-8890-a979b2f6ce3c", "comment": "Malware payload", "value": "9219804b4d157f6f62ca584b2dc00189ad54ed74bff2689a36ac2b2b27b97db5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700465, "uuid": "4295ba44-907a-4343-91ae-118d0da6c3c0", "comment": "Malware payload", "value": "5a1e3711c9abe0005b7d9de9d0bee8f72c168f22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700465, "uuid": "203b285a-28ee-44ef-a0b1-020d090c7d43", "comment": "Malware payload", "value": "20c2050cd11c59f9358b6e99d97a3abe81c1f87e0fc3338796946f86ee501e6484695f29734e62301959027a3403f6df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700465, "uuid": "79cc37b5-1810-41b1-b5ca-af5ef1a10cfa", "value": "T13B16CF2A3EF35DAAC01251B8843A1C398A3D55377D02C5B62C52789EC675B3BD01B7EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700465, "uuid": "bb63b5c3-1ce9-4f80-babe-92a9e30077ed", "value": "49152:sOXy4LU/okY0LJV/n3haIzDSCwohcthM3tycrUvmBe33NLWWkP2sB5E/2m9uFf+X:sOyqLkY0txXcmtJkNLf8o9ZazlfFAv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700465, "uuid": "afbc6802-bf1a-4f16-8bf8-012469bed589", "value": 4311570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700465, "uuid": "84ad9cfe-3aaa-4c02-a7b1-0d2ad4e0c63f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700465, "uuid": "a3304949-e3a9-4d2f-95d4-8e7deefcbed4", "value": "1ef6cc2abd6ca11e8fdc48a59f4efae4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a08792-d39b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680690179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680690179, "uuid": "22c88d32-7f2e-4132-bd63-6f779b815901", "comment": "Malware payload (Formbook)", "value": "a1b76d5d8c07348844740e4b0435e041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680690179, "uuid": "95151fd7-9a28-4d53-bd2c-387659bef97c", "comment": "Malware payload (Formbook)", "value": "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680690179, "uuid": "c82e15ec-7e79-4e75-8f76-1f63debb528e", "comment": "Malware payload (Formbook)", "value": "8b03c20129d58ac90df387c1fa830f47ff23d7db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680690179, "uuid": "14fa385b-4d25-46b8-a047-9e5bea72af11", "comment": "Malware payload (Formbook)", "value": "6500a9c4d964e5634587bfeb8f71c48aaef81d89663edf715893675f325c3ca8515e453adeaf5a17e7f9eb501fbe1b7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680690179, "uuid": "0aefd06f-4183-4000-ac71-b9a725c50505", "value": "T151D4CF90D299FCE6D40B31B6BC3CE526291BEF1F9774092A232A7D1665733832466D0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680690179, "uuid": "f7fc43ce-c1e2-4d9d-ac43-17cc5c908ead", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680690179, "uuid": "5f094701-454a-447a-9f49-a0f2074d298a", "value": "12288:xrAE0M9a6pC19uE9NPUYNpPxXoJw8gTHz6:xrAE04a6s1MyPUYbPiZoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680690179, "uuid": "592df7c1-9b5c-41bb-8f47-e4d225d30438", "value": 632304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680690179, "uuid": "9d91433b-6621-4ffb-813a-8f537ee11af8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680690179, "uuid": "d20eb3d8-8dc9-41cb-80f1-161fe18b6559", "value": "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e7e518-d3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680719952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719952, "uuid": "0b8b0bc0-9766-49d8-9ea7-6b1a80cb51ee", "comment": "Malware payload (AgentTesla)", "value": "8afad51379e98b55eff7c86c9cf3ab3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719952, "uuid": "8c9f6454-ebeb-4edd-8c7f-b640ffb7db82", "comment": "Malware payload (AgentTesla)", "value": "9444f016cb591d48e1879adf897fe8289901c56cf3e9354da884bbf586089b2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719952, "uuid": "16f4c48c-163c-49d8-bffd-6828f04e74ce", "comment": "Malware payload (AgentTesla)", "value": "91103c5f1becf44e9ec3db8ac974727862c9bafa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719952, "uuid": "96740ae1-0a86-4ffe-b6f6-91291ca3670e", "comment": "Malware payload (AgentTesla)", "value": "3bd5601cf833f09021072f092c9733c8c8edbb1ce193134d667e654f4dc1360798ce71c9a4455171fb665bac0248bc4f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719952, "uuid": "1a9429bb-4ca9-4eea-b497-4038ac4958b9", "value": "T1BA75CF731672BFDDD6AE6DD4D55222440C8CD4ABB22892F8BCDC418EA1ADB5C8D71CB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719952, "uuid": "86d30794-c5b7-4cde-9a2c-eafefb8f5833", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719952, "uuid": "534772ca-2658-492f-b24f-6f2440c4ade2", "value": "24576:ca16Oc2fU3cwwJbUVGjATQYHNAz0obTL7MViS+36K29+PIlOByrQYKi0ZUQ:cDO23iGVGj+Quuv7e+qK2QgZra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719952, "uuid": "2dda1842-282e-446f-ae10-3f344a7ad91d", "value": 1585152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719952, "uuid": "5eebc724-1cc1-4d31-824f-141c349afd77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719952, "uuid": "4eb3026d-78b4-4874-aba7-4dcad447eab2", "value": "TT Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73a685c-d349-11ed-88f6-42010a9c006e", "comment": "Malware payload (Grandoreiro)", "timestamp": 1680654907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680654907, "uuid": "d83eefc6-c7ca-4fe1-8f30-c3fd78a2e8ac", "comment": "Malware payload (Grandoreiro)", "value": "78dd53127a04c5b115ea652f29762230", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680654907, "uuid": "af6de0ad-7832-45d7-aa37-540a9334b736", "comment": "Malware payload (Grandoreiro)", "value": "94abc5827826ccdfa32dee90ec4c7a7e5f0578b12defdd4d3afc0cc7218d5092", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680654907, "uuid": "4c7118fd-38f4-40bf-a915-ed7a999c6c76", "comment": "Malware payload (Grandoreiro)", "value": "3a273116e1bfea5decca4b2a60b31d1f32fdc93b", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680654907, "uuid": "1504768c-edc6-48ad-85af-047479153c41", "comment": "Malware payload (Grandoreiro)", "value": "5005cbcb3581ce5808f88154dfbbcf70ec776fd9775bfa9cb5ff558cbeb12c721b57648f1f5249ba49f46898b880c723", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680654907, "uuid": "1c55b046-617c-440a-a064-b8200d7eaa16", "value": "T1B0553387848829FD72D0DE39FB036E4E9972A4991E2E90D9A1530066EFC9FAD443F54C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680654907, "uuid": "25daafb5-5b5d-401d-bd6f-c018befe43a5", "value": "24576:MqQaUmBk1dgUtwh3z3fUCtFahzUnllvrHK0CtkAw7VkJ06Zef1227md1PxG:0aUzaUtWrUOFKQnl5W0Ct87x6ct2gmHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680654907, "uuid": "824ba994-61fb-4b90-a1f1-5139356ef781", "value": 1307104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680654907, "uuid": "67d0d255-afa7-4128-a457-eef1e873085c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680654907, "uuid": "96fe4cef-0e66-4021-aef0-261bd54e3fb8", "value": "Archivo.EndesaFactur-A4-SIMPLEX-TLLK_B23032023ES982499294942222422244454.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb627168-d3c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (a310Logger)", "timestamp": 1680709917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709917, "uuid": "d01bf1eb-ffb0-4d7a-b6e5-8e5a4042005d", "comment": "Malware payload (a310Logger)", "value": "96fe8d6e260227c0c4f6ed082a59212b", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709917, "uuid": "7aa0c0f8-4ea1-4f94-b472-a38abcdf8112", "comment": "Malware payload (a310Logger)", "value": "950cd4516e6bff899e1c4b28bda9867aa713e6818b28f36c7a613fcfeda6a53e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709917, "uuid": "1b2f5806-cbec-497d-9568-a42eed97da98", "comment": "Malware payload (a310Logger)", "value": "031b0930a59444204a672a99423a97bd7e02f83c", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709917, "uuid": "85258932-443a-4472-9182-cb564ea41257", "comment": "Malware payload (a310Logger)", "value": "d2e29a2293e19c3ed46a0c94251e9e9e014e7729f617eb209f77484fc8d43a37d23e56021dcca24a11523d018a0915ed", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709917, "uuid": "c381ff00-a5f3-455a-b25c-498152c306a3", "value": "T164A4F12167B5F21AD2188BB117FB83244064FB311AA35D1FB7096B5AB332C93D5B6327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709917, "uuid": "163f4bed-ee60-4315-a4b7-5309324b3254", "value": "ad800f126b9119e85b22d5a725a65e11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709917, "uuid": "3a5f2eb8-1e44-4601-94dd-1f6cfc3a5b47", "value": "12288:fWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmBC:YxgsRftD0C2nKGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680709917, "uuid": "2ecdbfd4-ee40-4301-a955-954db296c710", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680709917, "uuid": "94593df3-c00c-439a-a1bb-2c82cdef3928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709917, "uuid": "6f72bdbb-6898-4f9d-b95b-f424ea5bdfc2", "value": "950cd4516e6bff899e1c4b28bda9867aa713e6818b28f36c7a613fcfeda6a53e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7922226-d383-11ed-88f6-42010a9c006e", "comment": "Malware payload (BumbleBee)", "timestamp": 1680679819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680679819, "uuid": "26b6bd70-f641-4ae5-85b6-74efc5e5af47", "comment": "Malware payload (BumbleBee)", "value": "e8b42b455ad5c4d250dd4fd42b227fc4", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680679819, "uuid": "1d357db2-e1d7-4b36-a5e7-f10c38121d73", "comment": "Malware payload (BumbleBee)", "value": "9570591e6b867c4f84aa74812957f13bc648ba7d2f1cbff9545005ededcb45f9", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680679819, "uuid": "e3add814-1fe7-4a68-aba4-2ce32b4fb512", "comment": "Malware payload (BumbleBee)", "value": "b1407fe42481ab0a707bb2cb161ebdc00c55c513", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680679819, "uuid": "e0d2e138-732a-4a88-89a3-88e17b0eedb8", "comment": "Malware payload (BumbleBee)", "value": "725491d54cbc417032737c87edd3d94ff40c6df155d4c642b6d6d79c0003393d3861039ad30369134a51826deed92f07", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680679819, "uuid": "2de33eb5-ee62-4b62-ba12-517f1f9d7f93", "value": "T13E751A08DDC1AF0FCC21A4BA8A4798E675ABC8497302D75BE798D63335027294FC796D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680679819, "uuid": "bef0fda3-2ea2-4986-806b-3f6c1a5db589", "value": "5a83b775f11fca962faec5d7d036c1c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680679819, "uuid": "5cd8ce1a-7625-46f5-83d9-17c5ec960e69", "value": "24576:tCqGvilxnZNLziKkRvfGbc7UxlG5BhC526U2Lo+1f0EN:tCD4Zyxa9lrDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680679819, "uuid": "36742c05-e2fa-4f32-96f8-f14409a5edac", "value": 1631160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680679819, "uuid": "eae68d1f-d558-4557-97d0-4f01d3a05a54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680679819, "uuid": "a16e225c-081e-4f51-bdee-8e88c1eb48f2", "value": "inst5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b842a8c-d3ab-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680696871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696871, "uuid": "5b2ff111-4647-4c62-b28b-4a4bfa2056c5", "comment": "Malware payload", "value": "2209fe2099029c30f8b68f1064a2c88d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696871, "uuid": "91274f16-ad3d-4aa9-999c-5af700a7ef3d", "comment": "Malware payload", "value": "9735fc48261629279cefedacdf82f785f3a720d9239b51064d9f131ee47dbbe2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696871, "uuid": "e1211e8e-4c4b-48fd-a04c-114ff7b7b56b", "comment": "Malware payload", "value": "fb8102d407932cdcc8ae2e37df1304ff50192790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696871, "uuid": "f9d6f82b-afcc-4541-9c5e-09475c13020d", "comment": "Malware payload", "value": "b958594be6e9370df9ecf106385a3e8e3caec14a66eeceb0ce73cd8d3191b27b307ad90efcae90a06d271defaecfdac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696871, "uuid": "984ea4c7-5929-4d49-b18c-39652ecc9d78", "value": "T1CD351802B7FACA23E1AE0737D4F509180BF1F951E272E75F269662A90C437A34D42767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696871, "uuid": "5b09d665-c7fd-4f36-9357-ce5f21bc2d73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696871, "uuid": "19f6ab9b-25fa-4f2f-b374-bc09424f658c", "value": "12288:adpiJ2XalKWUwLC25RYDCqmSXvqvHl1UZHWxPXopOXQac7z9CHaq44FQzTxJWm:ak22UwL7CCqrfqHT4WxPxQxq44Wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696871, "uuid": "eb936cce-5cac-4d67-ab9e-5df9ce485298", "value": 1079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696871, "uuid": "0b262876-436d-4ab8-8121-d5ff6f5fe577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696871, "uuid": "1f7b2cb3-1057-4e2d-8773-d4c35b37844c", "value": "9735fc48261629279cefedacdf82f785f3a720d9239b51064d9f131ee47dbbe2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38759d54-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (DBatLoader)", "timestamp": 1680718260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718260, "uuid": "f657d7e9-90c6-4f59-9803-d676d71a8388", "comment": "Malware payload (DBatLoader)", "value": "efaacde46ab461bf5ad32e0a092c8152", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718260, "uuid": "a29f7a73-5447-4fe7-838c-727d6d8ef199", "comment": "Malware payload (DBatLoader)", "value": "981bd77a2a71c5cb06a8198347b8a49e8b207d8c0d532e80c405b018084181b9", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718260, "uuid": "793071a0-be83-4a92-b580-0815d94afa84", "comment": "Malware payload (DBatLoader)", "value": "4ebb99bb2171fb24c2801230b711e5634964589a", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718260, "uuid": "5b8cf22b-331c-4f9e-a8f0-33d69feab607", "comment": "Malware payload (DBatLoader)", "value": "7b44f695d2f73c80aad99ad853b0c96128c47cb0d8d0047394734b7915cfe2c6194b1e74d2f2a3fbb852bd255183023c", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718260, "uuid": "96110e4b-e657-47e5-9609-fd5f09b544dd", "value": "T137E4236B043C2D651BE7FB41D4D0A85656F9BA03C64A035A9233B9E7A3E3AF5C1C09F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718260, "uuid": "7d33bf08-89c3-47f7-a07e-30cd0d53a1e9", "value": "12288:s2MAR54NtnW46nT/fHGBd8HqFDG9O5rOaR8kbgzHmABkP79mTiO6M5KCke:s2Mu4NtnWtnHMjbNLR8kNUqqiO6M5Khe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718260, "uuid": "ed09582f-5483-436a-a6bb-b88b2d80b152", "value": 670965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718260, "uuid": "af2a4f38-f50e-4a01-bea4-6a77274d9797", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718260, "uuid": "34841465-7858-4c05-af6e-00f258c5deda", "value": "U prilogu je nova lista narudzbi.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f469d1e3-d3df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680719435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719435, "uuid": "7601bd19-83ef-4853-a3bf-04fd60cc2fcc", "comment": "Malware payload (Smoke Loader)", "value": "99dbbcd1d61f5fae5dd069a72bff5a4d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719435, "uuid": "1926ef6f-0477-4107-81a7-3a0d40f3bf74", "comment": "Malware payload (Smoke Loader)", "value": "9864be6c3f54efe0acdc888364cca3c6d48b84ed048b2b99c201e7738bd48556", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719435, "uuid": "5b24bb37-2e7a-444f-a973-d2245daeeda7", "comment": "Malware payload (Smoke Loader)", "value": "12169745ed1c6cc0f46e6b1de9f32a1b170b9d43", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719435, "uuid": "9d61b89f-f42e-4128-89e1-f66941dae9ac", "comment": "Malware payload (Smoke Loader)", "value": "2a89917f267d91896fc12700d7526a90fd5c660d9e0bd89987e617007a0efd57a31675e7feb0203c26975ecb6f97f578", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719435, "uuid": "ad67cd17-625b-4de3-a5e9-7cc967d01e53", "value": "T1D214BE0179E1C4B7E82784714874D6F466AEBC929B4281F733A82F6F2C313D16B7A365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719435, "uuid": "48d56762-4bcb-407a-9e77-33b926b075ca", "value": "75c9ce7658f5f9697d0dba7dc400340b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719435, "uuid": "67e6b8a3-563e-421a-b882-3e0f3c065c79", "value": "3072:lj0wpdP/jFLMWkpqh0LIa4NOQq/EFzI8HTg5+55rCMTIx:GwzZLMWb0z4NOQq8Sf6RT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719435, "uuid": "3ca69b71-6211-47b5-8bf6-b0628eef1d0e", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719435, "uuid": "98ebe98c-871c-496f-bd4c-d21f66cd4cf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719435, "uuid": "baeb95d1-40e2-4d7b-9bce-f6ef5e351f82", "value": "99dbbcd1d61f5fae5dd069a72bff5a4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59477e3-d3e4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680721530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721530, "uuid": "956f4359-684e-49fb-a7a1-a9847ecc79e4", "comment": "Malware payload", "value": "b972541399472ac9a0332921f883ebc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721530, "uuid": "bef49cc0-2b0e-4645-b52d-23e1317ebf02", "comment": "Malware payload", "value": "9895575b7f29abeddb92d3c078a06929876212e7980605727e46b2e88974a7ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721530, "uuid": "88ce1759-b609-4259-92f8-246e136b9e5a", "comment": "Malware payload", "value": "7fec157fd9493f1442d80e8f74edd4e360eeae4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721530, "uuid": "3afdccd7-4082-4def-9c9a-82b53e8787ee", "comment": "Malware payload", "value": "a20d9a433160e7bbb3a10bfa692836ca010a3fe84219e4cb3fa705c2dfca6938e6a8ca42cadf7186891eea928e714109", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721530, "uuid": "bb63a19f-a2f7-40c7-84cc-c13957f99d96", "value": "T1E4E42346338C552BCA6D88FE6025900A83B5A827BD17C3DD5DDCA8FD66F7B848402BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721530, "uuid": "f432ff21-3204-472e-b8dc-e9e89cdffda9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721530, "uuid": "ca758c4e-5313-4732-8fd4-7da819ae49d2", "value": "12288:/1otzLwr+MaMyTLPH0FWenuOQw9QicsaPqhhh1q8cV2kzoezfBt:lXaMyTLPUFLnuOQGQrDihhh1q8s2kzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680721530, "uuid": "2808af4d-d503-429c-8892-1365b58b0861", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680721530, "uuid": "0810e4ed-16c9-4aad-bb38-71c97c5fed7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721530, "uuid": "71bae76d-abbe-4192-8425-87def34de667", "value": "QUOTATION OP5000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d8bcbc-d3c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680708617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708617, "uuid": "15fab4e6-70ad-4f09-b4ff-27c6b81c1aad", "comment": "Malware payload (Formbook)", "value": "b4c0eb90bc2115f2040d4ede764e6494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708617, "uuid": "c41e617d-fb97-4693-ac22-2364010f0d04", "comment": "Malware payload (Formbook)", "value": "9966741e9699a05ccc468b304cba4a50b14e695d22e4ca01842b62eea92ec835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708617, "uuid": "d7d8c2ad-a6a6-43d0-a072-1d2e6056d122", "comment": "Malware payload (Formbook)", "value": "2ed55473998d4037ebd4cdb5768c4053b2117ab3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708617, "uuid": "eaa0ba3c-1160-4aae-8cf0-8cdaa5b992a4", "comment": "Malware payload (Formbook)", "value": "9c0f4eba7cc15607a02557249c499b846f5a1f63d919b49a9307a29d3344d233a7315e43b70d5de09e53092c37242c5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680708617, "uuid": "d041a138-0567-4cb7-92da-9ba7a96aa722", "value": "T12C041204CB53F61DE8AE58BAD75E87B7608C96B27930503EF13F0B54D650B8B7188A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680708617, "uuid": "fb922859-c3e5-4528-925c-39719eeee4a6", "value": "3072:1Ena9Qd21OO2Lh2ykkA07zzLNozjxKf5/hE0OydE+h8fDjf9qgjkfcxu0kmGfly6:6RoVUhXkN0XucBmz+h8fDj1qdMlkdflt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680708617, "uuid": "ee06271d-c6b1-461d-aadf-ed23041a0caf", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680708617, "uuid": "10636646-7dcd-41f0-82a3-e4f5b2294d45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680708617, "uuid": "2dc4a480-4bfb-456e-93ce-6e743863bbd2", "value": "9966741e9699a05ccc468b304cba4a50b14e695d22e4ca01842b62eea92ec835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24b1d3d-d396-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680687997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687997, "uuid": "458c4d03-f925-4c08-b9d2-dd12cff165f0", "comment": "Malware payload (Smoke Loader)", "value": "a592b37dcbb27306c93d8a33518a733d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687997, "uuid": "a812d4ee-97a2-4e10-afd7-99f56808e266", "comment": "Malware payload (Smoke Loader)", "value": "9a5dcd6da4e198f9c982d9693ba16a7fdf599f91de18b18053c164780cee0a3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687997, "uuid": "d4836004-8745-4c5a-8e00-8e6f215fd459", "comment": "Malware payload (Smoke Loader)", "value": "eb54154645cabf033d68844d19c882b74d92d58a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687997, "uuid": "6fc6fa01-8ffa-4afb-97d4-90a108c6ac6f", "comment": "Malware payload (Smoke Loader)", "value": "ea9d606226fe693358c284080e9bb8a351f17b0dcc8be7a05233269a030ffd1e09d23bfb9c3cdfaef0c3b8a8c1a015ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687997, "uuid": "b017a004-1519-46f4-a615-d2c7fc9a77fc", "value": "T1D444CF2277D3C873E96A42764535CBB56E2A7C708B6586C77B48073E1E203E29E37346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687997, "uuid": "ce811a14-5498-4822-ab38-699b9ca8d57c", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687997, "uuid": "b0ab46c7-6fc8-4bdb-bf4d-22abde037a4b", "value": "6144:AYbeIVi0kbLq0f3BA1RlQ+GrnzQyF2+q:AhX0kbu0vCQ+GLEc5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680687997, "uuid": "2b42d0ec-b39b-4420-8b48-c49ae5ed96fc", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680687997, "uuid": "ca8c141e-2862-440b-80c6-e858cebc721d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687997, "uuid": "ff870740-c16b-4185-8514-04fab94f4007", "value": "9a5dcd6da4e198f9c982d9693ba16a7fdf599f91de18b18053c164780cee0a3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c8605c-d3a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680695843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695843, "uuid": "d0e610c6-287c-435c-9ad1-9d4b5ab2b11b", "comment": "Malware payload (SnakeKeylogger)", "value": "f839e24363cc3f08a92048c2fcc47706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695843, "uuid": "7299b61b-b202-49bd-a8c9-c0ecc65ec122", "comment": "Malware payload (SnakeKeylogger)", "value": "9ac31ae0a27c73e4e7fb6bbe525d772f8a165853c5eeda99a0c0cfba280d2c14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695843, "uuid": "a66f230a-0da8-4983-9a96-61fd2263b355", "comment": "Malware payload (SnakeKeylogger)", "value": "47ab3ef971a1f7285a3736b6fd268d3259da03d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695843, "uuid": "980d883a-bf22-4ce1-8389-22d894a23ccc", "comment": "Malware payload (SnakeKeylogger)", "value": "bd52bec297c00487ea362772b7744a3b34bc9ff7cb9514ec77818d9cb2e40074b49b5594ced89560e95174ee50b41120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695843, "uuid": "b48e0a79-0175-40cf-9ae9-890f9a24eb6a", "value": "T1EBE48C2E8E54C2F4F67C47B5D0D37F192EA409A287E6851CB97760C63B81B8A5C0D98F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695843, "uuid": "b2f3868c-3065-4472-8bb8-427f0b3930fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695843, "uuid": "eaed6b98-a6c3-433d-9378-fe17f5653387", "value": "12288:DwFZmsN2iNIOsobHURfzbFS8f7Gk7Ao/wiLS6SRgD7r0VQPt:DwFZ5N1eXoIfzBffhE3inV3roQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695843, "uuid": "758ad9d5-09e3-48f8-b3e3-2e794e53d91e", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695843, "uuid": "2b6fe2f9-b980-4bff-9c81-354dd12fe617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695843, "uuid": "e541dd51-b25a-4b41-9bd0-d19c021857b1", "value": "INV-980185.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e30eca7-d3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1680697573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697573, "uuid": "cfeb5c3e-b095-4347-b325-df55b003a881", "comment": "Malware payload (Quakbot)", "value": "a9a100403a4d18239c2abb3949bd6c90", "object_relation": "md5", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697573, "uuid": "d838eda7-4408-4c3b-a3f2-c0dba3ceac9a", "comment": "Malware payload (Quakbot)", "value": "9bfcdb28009feeda218c4322dabcc1f6464ce64fdede12c988db36889e77fa2d", "object_relation": "sha256", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697573, "uuid": "daf9bbd5-0529-444e-badb-6374214b9693", "comment": "Malware payload (Quakbot)", "value": "6227adb5d7fd9f5d7b30b1ee51126e8c2af84f03", "object_relation": "sha1", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697573, "uuid": "5771f9ff-2772-44af-8f9f-6894fd5b6bdb", "comment": "Malware payload (Quakbot)", "value": "5255541a75f6d395b985f813b82f75d1b3d3b0f32503b89dd483e58ef2780301d235dad6ca1a363775eecf36aeb60bdd", "object_relation": "sha3-384", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697573, "uuid": "5742c22b-25ac-4e6c-bb36-efe80b46156e", "value": "T13B93F1CED486DC9CE844382AE1ECBF15825EE00F42DEE6F63B6E68CC905FD55905066D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697573, "uuid": "1dfbe4b2-2a2b-4564-8775-9667f74a4354", "value": "1536:8OG210Uv9PrGBML8UYY6ustjs/Om/AXJvk:tlJ9hYY6ums/x/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680697573, "uuid": "10e7e756-4998-4580-9e88-d915a9bc9c19", "value": 91326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680697573, "uuid": "92d6cd02-275e-4387-b968-6c8e9cbf7430", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697573, "uuid": "6691296e-dcbd-4d11-86b1-8e23b8a0cc89", "value": "Quia.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffb9bdc-d37a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680675726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675726, "uuid": "cfe2a12d-156a-43de-8184-05bbd91ecc8f", "comment": "Malware payload", "value": "74520a85da55dcc8c60f5bbf312261c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675726, "uuid": "444decbb-7d10-4b97-8b91-73cefbbd4a0e", "comment": "Malware payload", "value": "9c186b837c2bccd2fc41f849483ce1f6ab858c9d1ae1df29d2dbbda22496056c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675726, "uuid": "ad7b7968-8c60-4276-806b-08a1556c6e80", "comment": "Malware payload", "value": "b1076eca2f6e365490b9539a1ace7ac1b5093309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675726, "uuid": "17395d11-1eba-4174-a704-4ee946cad739", "comment": "Malware payload", "value": "469ebcc00b25e13b484825f7be3d267f8747e673793ab73880c256036e3c852fa4c5f93431276d1f24fe1710ac739477", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675726, "uuid": "a8794d88-8e32-475e-b745-b7b1ee8485fd", "value": "T19EF209169B58D627C35F9AB578E3031607B0C24E6503F7CBEED824A45A173B64E122EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675726, "uuid": "ee2d3b55-bb5d-45e8-ac00-c249303adb96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675726, "uuid": "99115fb1-4098-4ac1-8bab-4145ee0dacec", "value": "768:iZPP55vvFl+VmmMMmmwh0OlV5bLLllLLZAnJdQOWxNmX8NOBd2f9KtevN/Lb/oCY:6PP55vvFl+VmmMMmmwFxLLllLLZ/M8NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680675726, "uuid": "dd8e7744-5d4e-4102-89e5-12a343abe08a", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680675726, "uuid": "f9c1e0cb-fdaf-46e3-9209-1ec4ba2a7b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675726, "uuid": "126d4556-6333-4a45-bbd3-889386acf053", "value": "retiro n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620a271e-d360-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680664643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664643, "uuid": "8667015c-1a2b-4359-a042-161fc47e7054", "comment": "Malware payload (Rhadamanthys)", "value": "dfed337acd0fe7960dd1a8e2ccf77f53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664643, "uuid": "09d5f414-29fa-447f-b57a-47153a067930", "comment": "Malware payload (Rhadamanthys)", "value": "9c6db3fe215b51656e4bdcba96197c7912106ad7cedcb2f856b227fedda86c37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664643, "uuid": "b908ca27-da53-4dc1-a2b0-4c1392f40092", "comment": "Malware payload (Rhadamanthys)", "value": "94eef69118bcbd0ba1073b9b3bbc0e45dea356a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664643, "uuid": "804f82e3-f745-4004-875d-33b2248083b8", "comment": "Malware payload (Rhadamanthys)", "value": "47d84bf426095890bfd5fb1d94da1bc3a3434a682613b23c5e5fee97bb64962eaf857a048a3307098f0fda20e59d0ab2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664643, "uuid": "64f857cb-dfbf-4005-bcd6-4fb922c45f90", "value": "T18074BE5163E06820D51B4A318E2EC7BD2A6EB461ADA57F9E17B84A7F1D303E1D23370D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664643, "uuid": "8caf43dd-d3cd-4010-a4e0-47fb5f659ef5", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664643, "uuid": "ce182bf2-de21-463b-898d-752d481b2bbc", "value": "6144:l3x7ZeqgDb/A2ourig5s/xi4Dcj6Yc8WnaW:l3x7Ze5Db/uuriX/xi4wjfc9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680664643, "uuid": "7283c2d1-2808-4f70-b65f-2aecc90a1da1", "value": 340480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680664643, "uuid": "fedc1ba5-d459-444a-9a96-d94ed7e9550a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664643, "uuid": "41b75af3-18b2-4a34-8641-29e3cc3b55fc", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9003084-d397-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680688384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688384, "uuid": "5be84840-1c66-41c5-9f71-47c5c85623b9", "comment": "Malware payload (Loki)", "value": "7207a2d6f9ea6038d5341dc3dce621b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688384, "uuid": "67721e8f-6a80-4498-a3c1-d0fbb2658975", "comment": "Malware payload (Loki)", "value": "9c9f18ea63037d0eedabba89626fef34946df41219c3f7ff9669b8bef92ab879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688384, "uuid": "f9a994bb-b139-4b80-8f28-64a914c2e2ea", "comment": "Malware payload (Loki)", "value": "cad3052edc78dc138d42cba2a8b0e5456dce03e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688384, "uuid": "ce0218ba-1efa-42ec-a9f7-287a002b18f9", "comment": "Malware payload (Loki)", "value": "0fac597637a066f2d1e569aa892cf722aca084f58823fa34d73ab4142f0a2d17c13d6296093f0886e99c66fb2e35bc8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680688384, "uuid": "4e16ded2-08cd-4aae-864b-17e385cfa2fa", "value": "T169C4125573F84B30DE9E0B7AECA6308603F4F93A6553EB4E5CD068DA5CD770089902AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680688384, "uuid": "e7f8f95d-5897-4112-8df9-e9209f0ecd04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680688384, "uuid": "3930c1cc-8766-42ad-8e43-9c1727f7d881", "value": "12288:dFfY/nCeQQb2+FxfxMVKj7WndlP4bPVogUlrCk3LWPs:dFfQCeQ42SLHSdl4kOKLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680688384, "uuid": "f40c9546-eb4b-4863-abc1-33cc8743f302", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680688384, "uuid": "a62ccb15-509c-4d4d-a50c-06cda13e671b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680688384, "uuid": "3f470482-573f-4b3c-859e-5ae45ecfbe69", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d0637d-d3a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680693796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680693796, "uuid": "cbdbdd31-aa21-4da9-bc4e-905f962ec65a", "comment": "Malware payload (AsyncRAT)", "value": "307b9e496bf44c89f29d6673d5e92f57", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680693796, "uuid": "a43c88d1-a2d9-44b4-a1e7-c3d3dc995e72", "comment": "Malware payload (AsyncRAT)", "value": "9d5972659a12d93f0d7b05042c552e47be07967eff52d61f5ea06e5734f9d6bc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680693796, "uuid": "b8c2542d-d18d-4205-88ec-92c4976e2726", "comment": "Malware payload (AsyncRAT)", "value": "f2804bfda1cd5f2ed839b63cb1378c28bd2aae95", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680693796, "uuid": "6d6901c4-989e-40b0-84ca-b06c3eb8b47d", "comment": "Malware payload (AsyncRAT)", "value": "f8393d05da31bfc7af9e6463567cc7c0c71cce674b7f6f2a86dbff359be32df1f71091fd76c714065a45c3d4f7778e1f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680693796, "uuid": "c54e6167-b8ef-4cf2-a386-370fc0612565", "value": "T12ED4F152B7D284B2E6731A324934BA11757DBD211E34DB1FA3D8796DCE31182A231BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680693796, "uuid": "69370eb8-81c1-4376-b932-16d1680a9b34", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680693796, "uuid": "41fb2baa-a971-4e65-8380-1977c8fa3868", "value": "12288:NcrNS33L10QdrXjzDnFnmfoa2e/WzM4acijRwvvE9So+VZ2V:wNA3R5drX3DFnbe/X4acGRwNf2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680693796, "uuid": "dd860a48-6c8a-4398-ba75-dda38ab1cddb", "value": 638045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680693796, "uuid": "2e0843d2-f304-4666-be8f-f7a960f3f3c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680693796, "uuid": "71de4ac3-b21a-4198-b682-04f78852a969", "value": "9d5972659a12d93f0d7b05042c552e47be07967eff52d61f5ea06e5734f9d6bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f279fa5c-d3a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680695809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695809, "uuid": "4431fda4-1177-4f34-93c8-f6dbe979096b", "comment": "Malware payload (SnakeKeylogger)", "value": "34011554570dea2efa7a103fdf3fc1a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695809, "uuid": "da82f6f1-1959-4d46-8793-99309be9dde8", "comment": "Malware payload (SnakeKeylogger)", "value": "9d9bfc4da819b3ea290f62b6c1d104a4bd61503d2a7f6951389e5b8047dc08b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695809, "uuid": "5b6ac3fe-b2c4-4cb8-9336-65cf0608b2ab", "comment": "Malware payload (SnakeKeylogger)", "value": "76125a4a42dbd293cba01e932cb06c4ca1dac2e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695809, "uuid": "6dc07fd0-0a93-4ab2-a5ff-b82cbdefeebb", "comment": "Malware payload (SnakeKeylogger)", "value": "a6d5d5b28c5bcc86af08ab67edd9938c7666484d9e141ee54095fd5de809fb6bc4f85a4e1a676b356804e94c88b5e614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695809, "uuid": "d16e5ccc-fef7-41b3-bad2-b5ff6bb83e2f", "value": "T1B3C4129F3BF99735C6AC43F6D842210103F4E52992B2F7162CD324E85DE37998D82993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695809, "uuid": "9796d93d-3f78-4084-bccf-9584479ec62a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695809, "uuid": "bfa89c26-adfb-46a2-b59f-ee8f93b85950", "value": "12288:2rhN/1V+qW9sl6lzme49l8bgz3eGdEc8ujyLCIuV+AFR:2P9V+qpl6lzmTl9zeUrjyCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695809, "uuid": "364898c6-5027-42bf-92ae-0959607a3920", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695809, "uuid": "612885f5-9a0b-44a0-b6e0-c6431cdcbc79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695809, "uuid": "653635b1-09eb-455c-ac53-1e1ae5e1e60c", "value": "ANnaWIr4oZ5AwqH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3460d87-d3ff-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680733150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680733150, "uuid": "e04838f5-6f10-4550-a51f-8092bc9d53c3", "comment": "Malware payload", "value": "034828b725ae8224daada8e14d8f9167", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680733150, "uuid": "6c117638-7cfc-4f65-97f8-ad3abda7104c", "comment": "Malware payload", "value": "9e4bd21915358667004d90ac2d979d54d1b469332d4596082954e9e8d95d5bd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680733150, "uuid": "219d7fb6-2695-4bf5-b648-f76a5b9825d6", "comment": "Malware payload", "value": "2e81c8f032110720eff770dfbf03c4173268aabb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680733150, "uuid": "38835618-d9a0-4edb-bb60-2fe1bba8988b", "comment": "Malware payload", "value": "9dbd67890ed83b429440a2e15c0ff11a5f34b765986e248a3658602aef591beaaad9819add450002dd62a54017ac7db9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680733150, "uuid": "93583759-783d-4e9a-8f0a-4a7879135ac5", "value": "T17125121433EDCA15E423A7BD44F0D2B42336CCC6A962C72B4FC9BDCBB29D716952215A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680733150, "uuid": "6397c9fc-db0c-40b0-b0cb-644af68d0180", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680733150, "uuid": "7c277c4d-8896-45ff-a509-db3e6c565a68", "value": "24576:pxAqHaY3imXQ8PcHY2ZF2VkUBKknlXEHPUQAuNtGtl3tBMLj:pxAqHadpYVTVruNwtlbMLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680733150, "uuid": "11185bbf-100a-4c51-a211-0d2790c8e1a5", "value": 1052160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680733150, "uuid": "5d689778-590b-405f-ad9c-c08043394ec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680733150, "uuid": "0ef6664f-bab3-4f42-b3b1-93cfd9bf48de", "value": "Signed po_000165.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c4b63a-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680718231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718231, "uuid": "900d6175-b4d1-4f12-8ad9-90fbbc3e92ce", "comment": "Malware payload (GuLoader)", "value": "5aad44c8c52b9d67f828c2dea7d5694f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718231, "uuid": "8469e4ac-9a40-4973-8f6a-5b7a90cc50ed", "comment": "Malware payload (GuLoader)", "value": "9eec4f60bc749e8da207b3f591c5f0d9847a852c3e18ab196776eb79385a05e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718231, "uuid": "0cf42a54-50a8-48c1-b789-e45f04db60b3", "comment": "Malware payload (GuLoader)", "value": "4f509c73da00ba4fd4dc727131d9944754840268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718231, "uuid": "2dfcbe65-a989-4531-9d60-80a7c8ff49e6", "comment": "Malware payload (GuLoader)", "value": "6d62f0b2fe1081d50ddd89303d3404aee2cd60e71528449e75fb5fed30006d5e64b94f01bc0b42c068d871595f083880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718231, "uuid": "aec309ec-5215-43a3-a40e-df38ba24aa2d", "value": "T1FB2412213650A877EBD32F704EB55FF2DAB6860117A0664B37104FED348A7818F6E25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718231, "uuid": "26a6e9cb-c095-416a-8dfb-d6bf44e22d1e", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718231, "uuid": "01bd0dfe-d959-4710-bd3e-20cf28f1a451", "value": "6144:+DfeDj88Yb9KyXGLJKBXNfY2PkR3QRHLhCz5N:+IALzWwXNf1cR3Qh8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718231, "uuid": "5c633702-65b4-4454-9c8b-888dd2ffe8c9", "value": 226096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718231, "uuid": "db9192fc-3879-4138-b468-87aa46dcd7c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718231, "uuid": "6e73116c-4d0d-499e-b816-8b89ee5afea7", "value": "JUSTIFICANTE DE TRANSFERENCIA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c6a95b-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680718232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718232, "uuid": "d4964a0b-6714-49c9-8594-c5174b651f91", "comment": "Malware payload (GuLoader)", "value": "f1768ae9e19e3c6b51899d8ae1f67f74", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718232, "uuid": "3279968f-2c61-4bd0-882c-4333df7eb803", "comment": "Malware payload (GuLoader)", "value": "a0418e8dba90cea13543fabd76ff7ae70eeb5e6ad6b2d56068404d4dc460a285", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718232, "uuid": "31170da5-9817-407a-a137-f21f40475fa9", "comment": "Malware payload (GuLoader)", "value": "253a0a81cf138a36999280958b58257937f45b0d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718232, "uuid": "f783ddfb-a1ab-4b0d-a96d-8473f7a4d330", "comment": "Malware payload (GuLoader)", "value": "f6e3536206ecc1c8462dd5ab78e9edff331cec02c554f0ec303a36f91ac9e2967fa292aff9503a18591ebd02c0c4de6e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718232, "uuid": "7c686f8d-487a-4271-b1c9-6df4e5c3e2c1", "value": "T10F1422D6AC2C038F93E8CC69701FC09934A99A3541EAFAC0D429C2D7DD57E5996B036B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718232, "uuid": "2537c045-4488-40e5-8814-d797c496aa7e", "value": "6144:EbAj2cGxkuSMdTHamG0/P5g9EpwsIzbGcXZEc:EUf5gHjJpKZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718232, "uuid": "383eda13-0097-4cfb-b763-55994d097c89", "value": 207908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718232, "uuid": "617ccf31-673c-4191-b484-7771a4641e71", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718232, "uuid": "8fbb3e98-150f-4137-bd03-c58a8a0967cb", "value": "JUSTIFICANTE DE TRANSFERENCIA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ba9c96-d3f3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680727864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680727864, "uuid": "47c7caa4-c196-462a-a274-595eed4b5028", "comment": "Malware payload", "value": "5117d2d9b4cbeaff0905702cf5bbadb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680727864, "uuid": "7719bcf2-c9fe-42a1-a08a-438b5401aad5", "comment": "Malware payload", "value": "a053e5534cb527c7e0f777cd22b931287496c4ba88cea0e2014c68af5f4e83ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680727864, "uuid": "7dab06c8-4b73-4176-b3fa-338e145cbade", "comment": "Malware payload", "value": "13deea95e12c44a808b21be66575d5a2fb99e056", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680727864, "uuid": "c4931294-486f-4f55-b604-47c5b4a2747d", "comment": "Malware payload", "value": "46de2a0203dd60575bd312604e82cf49697a7e0c655b9ee03ff0153dfd1ac2114736fb9163ef701eaa5f7950a5cafb9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680727864, "uuid": "ea4a0e47-001b-4258-a749-f1119c83c799", "value": "T176B52367D31D890AD82F5BB4B82A0B4E5F7402E0E621A3AD26216FCB7D543160C5B7F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680727864, "uuid": "8e1978d4-986f-445e-a10b-90f60b679bee", "value": "49152:q5+MZQCBJ7y2C0FPq1kvuICeptMkjNnHR7HTwGC:pCeAqoOQHN6GC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680727864, "uuid": "d682eacd-1437-4560-a546-52a2852045d0", "value": 2373632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680727864, "uuid": "dda10712-a92a-4544-877b-0fd96635714c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680727864, "uuid": "21e5772a-9891-4a6a-abd5-c2ac4baafef8", "value": "101GB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bddb5ab-d34b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680655559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655559, "uuid": "13ca978c-c53f-4ba8-b4e1-12859ab5dbc7", "comment": "Malware payload (RedLineStealer)", "value": "c4fede9c9fb95e048d596ec1664627c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655559, "uuid": "aae5e881-0ffc-4d59-aad6-d61f1aa8e460", "comment": "Malware payload (RedLineStealer)", "value": "a0a48b8083583769d311eb42956aff60b190b758040e4dd34356dd643a37caaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655559, "uuid": "871c0133-de84-40ab-b323-7de588ac30cf", "comment": "Malware payload (RedLineStealer)", "value": "9561c4a024bf0b2dea915d6ca0f4ecf3887d3d80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655559, "uuid": "6813d5ec-9795-47b1-8e80-d6f424add251", "comment": "Malware payload (RedLineStealer)", "value": "44c1c2909ceef6aa174f1d4efddfb5e1d99e2aa132e503c65b5fba2c6ed752dabb706ad80b02a3bafad9a3ed13cceacb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655559, "uuid": "1d2adbd9-dc14-431a-b846-9ed9ac963fc7", "value": "T1143523427BF8805ACAB667B05DF2069316397D631D3887A536874C5F4A73285B823B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655559, "uuid": "866ce64b-ae9a-4e13-a5d3-eb163a6f4508", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655559, "uuid": "93215aa8-9ab8-4123-83ef-dfd78fcc3ed5", "value": "24576:hye2XCGJmQEORj3+eI1e5DoViGvpcKtR62LiYD0V:U7XzJCORjcwQLvpcK767q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680655559, "uuid": "2e7bc614-a2ad-4441-a543-4116c5ec2b07", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680655559, "uuid": "8c45702e-11f2-4cc3-a9e7-3dfa6f5f6ca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655559, "uuid": "3b64a94f-2158-44b0-bb95-019c5ebdf347", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749a9a6d-d3a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680695598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695598, "uuid": "a7dcb0ba-3aaf-4d7d-ad1f-8c6a43dbf112", "comment": "Malware payload (Formbook)", "value": "47df161e1176d3bf5dfcf7a56047dabb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695598, "uuid": "12fefc36-4fb4-40e4-b55d-5dff4cbc6639", "comment": "Malware payload (Formbook)", "value": "a1896f4eab7631eb5e0daa3a5a9a9787cbb5ebc2324f4823f96e3d565b4875e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695598, "uuid": "09c5b083-7277-4405-84c8-1c5f947faecd", "comment": "Malware payload (Formbook)", "value": "8d197928da75aa8d0764e01f36cb459c3e1eadb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695598, "uuid": "15f59713-e46c-4a2c-b720-9112d77a17bd", "comment": "Malware payload (Formbook)", "value": "6eb558ab5cadcb79aa041f9d48ceaad1aae7ecfa71360b1e75222f5496655bba922b0a3dd8acf7f2e6d0c4045375f624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695598, "uuid": "c6f8f602-5603-4bfd-92d2-1f60c0f77e1a", "value": "T117E4134433F44B35C9AE0BBED897220D43F0B95A3853F60E5DC2B6E41DE7B408995AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695598, "uuid": "631db894-8b13-469a-a602-bc66331e8041", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695598, "uuid": "01d63e34-4857-431c-a20a-61c04a09321a", "value": "12288:kARyvAgEok3Cg7cR7LS9ftAZ5bMvvB/19C+bg1eBm86iKe77lj0:kARyvXM9cRfS9UbMvJ6+bg1n5U7t0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695598, "uuid": "acdb9c9f-1c0c-4e5a-84d3-c3c9d296ab05", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695598, "uuid": "fefbb50c-91df-42ac-9663-b96f8bdb536b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695598, "uuid": "be9d0a64-499a-4670-a7a6-4aac59d61a04", "value": "Cease and Desist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909c5282-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680700369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700369, "uuid": "1eeb328a-f1f3-4d53-ac7e-42bdf8c7ea32", "comment": "Malware payload", "value": "ea4e3e87f5cf484dd0264e8fbb6d68b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700369, "uuid": "e75dc4bd-8143-403a-bf7e-77e2550ff66c", "comment": "Malware payload", "value": "a1ad4f1cbaef3f0853c343b3732c60ac2c60bb00ee97c2ea11ed735956333b7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700369, "uuid": "09269ae4-c56f-45b5-96ff-811f82e7d569", "comment": "Malware payload", "value": "201db4e81f9792d705cce81e7105a61a76711ac4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700369, "uuid": "f1a4fbdc-d2d3-4cb6-9d7b-08da3ce60427", "comment": "Malware payload", "value": "0cfde432648285f095c4e3b965ca82f90ca3c4eb309ac5ee478adff2a5425c4320181a8126769a236fb0a71aaa363004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700369, "uuid": "16b8ac5b-03bc-43dc-a8c6-09ff46d93e7a", "value": "T106D54B03777389A3D2592737C1E601140761EAB1AA23DA8E756B23DE1A03BF65F4472F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700369, "uuid": "6e3ccf30-99fd-4cc0-adf5-ce5fb9991335", "value": "24576:ZHgQPxfQJySWpRWKVhzL5xhQUmQmSjGSu92lbaNhGqbu70GhYnrXfuvLC1LvNS2/:ZHVpQMSWLLKUmQUSgYaNrb5c90DNQdjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700369, "uuid": "c929bcd5-fa7f-4683-8e4f-679996b2510b", "value": 2777577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700369, "uuid": "58ce9a34-5bfa-4ee4-8606-2cb158231157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700369, "uuid": "e0df054c-fb05-4bc8-af5e-6298bbd7e553", "value": "ea4e3e87f5cf484dd0264e8fbb6d68b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ba0609-d35e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680663889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680663889, "uuid": "bae08d05-da78-4e05-a137-8d8af9e00178", "comment": "Malware payload (Stop)", "value": "630839d7df7c7b0d053c4012428791c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680663889, "uuid": "2b7f4c2f-fd3e-4c69-9e36-b0ce8e0a98bf", "comment": "Malware payload (Stop)", "value": "a1c6427f640608775017cc88760a42478398c23d038c1c3edb96a2ea48dfe47a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680663889, "uuid": "f9453f08-7583-4ba0-abdc-92ee37b59e1a", "comment": "Malware payload (Stop)", "value": "756696871ae50383a61c59e190ef93c7042e45ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680663889, "uuid": "0a2b7cc5-deda-4499-a9aa-1ca14bc0b508", "comment": "Malware payload (Stop)", "value": "8a0d1fbbe38c7697bc1d05cbef97bb102694afc18535d2ffc08cb8cda4f6068535473104ab1a02b99deb730df8e96f52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680663889, "uuid": "e736e26a-338a-4005-bfe7-d8dd36a48f17", "value": "T15FF4020223E0A464D45B03328D5ECABD2A7EF4616E257ADF17B5897F2A343E1D27271C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680663889, "uuid": "16416935-5b61-44a6-9e13-261127db04ad", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680663889, "uuid": "2853d717-2934-4d2a-8192-7cefcbc9a598", "value": "24576:reY5znLJOMhkoGKRsq+XFxRviKJ+q0hkeYKj:reYRBsDdv1RGkeYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680663889, "uuid": "14a855db-95b3-4195-a970-cb90f5af882d", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680663889, "uuid": "bdc5365e-9e3d-45d9-982c-faeb6e405f64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680663889, "uuid": "c05be042-574b-49ae-8690-d9c480a53dab", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893b776a-d3e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1680721832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721832, "uuid": "5b348e25-7e2f-41db-ada8-6a575385552f", "comment": "Malware payload (SystemBC)", "value": "489e088030eae6acf86c690cb42352b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721832, "uuid": "96534180-c89e-4c07-9227-efce30f87a86", "comment": "Malware payload (SystemBC)", "value": "a21619b981f4e2b4a1858f0457b42491ef99688278816a66e0652d745e110bb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721832, "uuid": "d73104fc-3a71-47d8-9db9-12e392fbbf18", "comment": "Malware payload (SystemBC)", "value": "943a6abb8d2ff25ae6b54c953b211879328a5123", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721832, "uuid": "537b3cc6-6e9d-47b3-ae71-e6f22363bb78", "comment": "Malware payload (SystemBC)", "value": "8943d154bab75fa02f5b78399ef549bd35b2a5d84a60ad11c0d79bd8874c440b9e8a7a70ec9c2c926a60f6e41f8a05c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721832, "uuid": "09fd3bea-64fe-4e52-a4c3-56cc780b7cc9", "value": "T15D52F8D735218D65C016C6B03EAFA721D4BE61B5153A9038EFE04E28773EA53DB2271A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721832, "uuid": "aca12231-89ed-4346-b740-a6255ea28c23", "value": "801793b2be29822524e8824fc3c47535", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721832, "uuid": "3f944b9d-42fe-4a1b-8109-eb4be66e5f70", "value": "192:C2WjQTbZ1eBppvfj/j2+cPM3P+Q/tCvwSw3uM76V9bhHOkrUN9:C2jTbZ0pj/vcqP+ctCYSw3GV9bhrUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680721832, "uuid": "f140c689-0f28-42cb-b648-c50d46d1bdf5", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680721832, "uuid": "a1e4f6e3-ec95-4d81-992a-532ef935d1a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721832, "uuid": "a9b7cf92-471a-4c56-9968-21f5c3d93e87", "value": "A21619B981F4E2B4A1858F0457B42491EF99688278816.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f683ffb7-d3d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680713425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713425, "uuid": "76275bf3-1537-4dbb-89aa-d5648468ad89", "comment": "Malware payload (RedLineStealer)", "value": "a58fbfd98a0c00e316915758189b5dc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713425, "uuid": "594e70a1-e6a4-4ef2-9317-e0f893a71b94", "comment": "Malware payload (RedLineStealer)", "value": "a27c505fe1e8f8963bfeecc29d84387dc4ffda7067cb8633af15a7126faf7c52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713425, "uuid": "49463dcd-fc81-4418-b1fa-899d35f56633", "comment": "Malware payload (RedLineStealer)", "value": "d38320df1eb9cfdf7ec2bfd30229d7c64c1ffa78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713425, "uuid": "6342bcfb-6ca1-4c8d-90f1-e5528872e554", "comment": "Malware payload (RedLineStealer)", "value": "d4e9d9a09661c5e74828bf95026eda66bbe8a96019689c7430faebf1b23e537afa6c7db59f98941d927e8f0c006c2436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680713425, "uuid": "83ddaff3-e1a0-4dd7-9218-e6fbe087be9f", "value": "T1ADE41222A7E98232D9F427B00CF903470B3EBCE51D7843AB1796995A1D727C1A53637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680713425, "uuid": "57251dbe-913a-4f35-8c3c-e1040dadb7ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680713425, "uuid": "35eb5542-72ba-4fc8-b111-e256f248178a", "value": "12288:gMrxy90V0l6DhhN6+po7gE7MAmgZ4lSv8QcYIkuvklX:ByU5hN6+pon/m8jUQYkRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680713425, "uuid": "1df2c1cc-1e8f-4867-a731-6935681d046b", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680713425, "uuid": "de3673ee-d329-4a8f-84a4-b6cb078c54d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680713425, "uuid": "df0d8fff-fedc-480d-b408-c2b91438d50b", "value": "a58fbfd98a0c00e316915758189b5dc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1896264b-d3b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RevengeRAT)", "timestamp": 1680699738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699738, "uuid": "6458219b-c848-4ddd-acda-2f47c2269e48", "comment": "Malware payload (RevengeRAT)", "value": "e7585212ec8add6edfa1b18d5cd1a0fb", "object_relation": "md5", "Tag": [ { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699738, "uuid": "f99c37dd-456a-4806-a2e8-61c50255ec90", "comment": "Malware payload (RevengeRAT)", "value": "a329cfce33b6cadbac42ef31b7d894a4349173075fe6f216965dba2e69ee625b", "object_relation": "sha256", "Tag": [ { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699738, "uuid": "010e3153-e882-48d1-9fdd-34fa7045d992", "comment": "Malware payload (RevengeRAT)", "value": "1c20255b64c1677194c989159cf2225597bfd606", "object_relation": "sha1", "Tag": [ { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699738, "uuid": "81f7980f-86fa-47dc-a7c6-afcb98da06e9", "comment": "Malware payload (RevengeRAT)", "value": "87e3db443a42bb186d40a00700c282b466592519fc8cdd0fc3d7cab095fdd0bb98794ebf658f8aab2990e2efee2c08cf", "object_relation": "sha3-384", "Tag": [ { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699738, "uuid": "b4e712f3-f412-4409-a1f9-7f858f591392", "value": "T10364F85035E904861BE22E538F87FF6D177FB9DA94389E5A8BEC09AC17DDD0188027E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699738, "uuid": "bb34a9a1-0db5-4a5a-b1c7-d4ee82f89d08", "value": "768:gpfzNfPBedPiGe6wb0pCwXUS6s4g6zcaEe16DbcjDc84n+0Mo:EfzVPBedPk6a0pCQ4xEsofvMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699738, "uuid": "621c1804-001f-4086-bc39-c7df995358e8", "value": 314460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699738, "uuid": "de104f6b-6d6c-4007-9e41-45e7223f5b1c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699738, "uuid": "55f25ee1-47d5-47b0-9a6f-8cf4d86a8bc4", "value": "Ativador Key Authy .vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87018e85-d352-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680658692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658692, "uuid": "caa752cd-64cb-47d5-bca2-14443baa0ead", "comment": "Malware payload (Amadey)", "value": "cb1ef7cf12fac9b41667d1af1e665108", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658692, "uuid": "fb08042d-0a8a-45ce-b156-167ab99f0938", "comment": "Malware payload (Amadey)", "value": "a356c7b58cdc33b8f5887534e69de418e041d1da8764637da0c92d4c208dcc6b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658692, "uuid": "2bbb5b31-ddd5-4a4e-a004-1969227110d1", "comment": "Malware payload (Amadey)", "value": "3fc132161c46ba75e5b99bcf8a9766cc5f00c1a8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680658692, "uuid": "97a37b36-ace2-4975-a301-1bbba3a27233", "comment": "Malware payload (Amadey)", "value": "f4a4885d06a5657bb647e5faa645e86bef9ce206f5e4585ce5158dc404ac52b524cf8df5a14c465a5c920256338959a3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658692, "uuid": "b950f180-c8dc-4d67-ac4d-ae3cffec100a", "value": "T1E544AE1123E06860E53B0B318E2EC7FD2A6EB8619D667B6E17B5497F1D343A1D23271C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658692, "uuid": "8db36f03-43f2-48a9-871a-70a7ca7f175f", "value": "347f2e8ea0dc4c8c2fb93a44134e1752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658692, "uuid": "64b38883-4d39-4e5a-8710-9d4b17a1869d", "value": "3072:jVoSkUjx1dhxvU5U6lySSdcRFamc7gwmLa3b3vo8cAM1lytkPrPqoRqaJSNn:HvXdwFgSSijemLEbAPllyWUaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680658692, "uuid": "110d6a5d-b019-4f3d-8dc8-28484f077599", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680658692, "uuid": "8a30441b-2d18-4ff7-ae99-a2b8699d312c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680658692, "uuid": "cc93eb8c-f13e-4864-9912-70e9eb791796", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a32c460-d379-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680675448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675448, "uuid": "0438d9fa-6e5e-4a50-a725-36b6373fa185", "comment": "Malware payload (Mirai)", "value": "55cae95d528487f3f11cd331c0e7334d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675448, "uuid": "d32c3ff3-7e23-4e94-846b-088aeb55bdca", "comment": "Malware payload (Mirai)", "value": "a3af788876631f51e35eada5a617a1abe7263956354921f84fe6741d60c5ecf9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675448, "uuid": "c545da34-c80e-4acf-a666-d9bd8d08826a", "comment": "Malware payload (Mirai)", "value": "24b08d9fd4bbced554c0bbf8d49f7cb5c9257fc8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675448, "uuid": "21c2fda9-c22e-44ad-b68c-1870ccc66733", "comment": "Malware payload (Mirai)", "value": "8612f26b697b6d5a640c7e5897749ce8a4b1fc7e2f4ca7f12ba316494d051ecc0d962829ca25a1d60852afb91be89bd6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675448, "uuid": "1812c101-caf3-4848-a75b-e29e10c059bb", "value": "T145E2E1738637B73DC0B691F4597F2796AED288A57347521F00AE01F8E82696B2551FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675448, "uuid": "d7b03dc1-619d-4640-81ef-f08bfac0b6c0", "value": "768:OgEINmx07GwbvDnLYIvXzC8ndZQ4fbFvuNx09K:P1N2rwbvRPzCqQ4p+cK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680675448, "uuid": "87fceae6-1e3f-4f91-ac42-5e3e1294c8e3", "value": 32560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680675448, "uuid": "bcf44c54-7573-44f9-99b7-9b9d4aed6f7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675448, "uuid": "718d4c8f-3131-4647-bcc7-c5b985aa91a6", "value": "55cae95d528487f3f11cd331c0e7334d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdb79b7-d3b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680699746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699746, "uuid": "159cf2d4-6ddf-4820-adbe-f3adaac8b4ef", "comment": "Malware payload (Formbook)", "value": "5187c06ca968411e249402ac5340da8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699746, "uuid": "f870f53a-7b3f-467f-9ecf-41c71fb37bb5", "comment": "Malware payload (Formbook)", "value": "a6cc6af418510edc207b3468d29e80afecce2aa47a683b02bc0da39c60505801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699746, "uuid": "7c65cc17-a389-4e74-979d-2c40f2e3e484", "comment": "Malware payload (Formbook)", "value": "ed941f029055524b3062fc3b8c6a9f1931fbe805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699746, "uuid": "b9535c5a-8d17-41ae-94b4-a9a04dd97e05", "comment": "Malware payload (Formbook)", "value": "47f584a337f887845c63291d45c332a89e992be61a5ee85d27c5c2c62879ddbe5c83c1f7019a90b3bac7fb380c61e7a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699746, "uuid": "451e20a4-9c96-4bb5-9d8c-88a864c4c61b", "value": "T1BC059D33B1F10833E173263E9C1B6A99D42ABE002978E98237E5ED4D5E377917D25293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699746, "uuid": "6825151b-2220-4895-93df-b8c17388546e", "value": "7a1f03aec8b2c813fb23d7a97335ae88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699746, "uuid": "559755b9-9e74-406e-8101-28d97bdad0ed", "value": "12288:AkqyglaEq3vgPIzZpurCqayn2zetLP+L2/WXwCuiYlvLFB7u/GFI3dSq0j:AkCAYIzZpurCqaZ8/EwC/YFJgdS/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699746, "uuid": "cc5d3db8-5b06-4c8a-83d9-d7014f8fe0cd", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699746, "uuid": "00af3796-e70f-45e0-8b1f-e8c0e7742f76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699746, "uuid": "b59f56c3-8731-4188-a880-af14d2b8eb36", "value": "U prilogu je nova narudzba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779e8840-d349-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680654801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680654801, "uuid": "64e84881-f907-4f30-871b-ad77dba871b3", "comment": "Malware payload (RemcosRAT)", "value": "288554293c54d5da83a2110619d996a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680654801, "uuid": "548061f6-e645-4e61-bd0b-5ac29ed08aa1", "comment": "Malware payload (RemcosRAT)", "value": "a767b580fa20f007fcac6ef48b4fc9e7397a47c00feed0334ecfb6d118f2da9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680654801, "uuid": "e2b62827-052e-4f68-bf62-48c5b488905c", "comment": "Malware payload (RemcosRAT)", "value": "41daaaae5e15cb3480f43fb62f0d674dd51404a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680654801, "uuid": "350632f0-d6f8-44b1-b808-719bc1cbe57d", "comment": "Malware payload (RemcosRAT)", "value": "bcff7e4c2ef26ff4b1ffc837460db28761df33110447c0e16b92e99394de98486cd9c37f3d8bfb1dc24cb01647f95397", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680654801, "uuid": "337d1e45-28d3-4ee9-bf2b-db2971b698ab", "value": "T142A5D0B25AC9FE96DFE57A70FC2111880CA8ACFB6398DA59B48C54CF0D64A14DC46DF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680654801, "uuid": "5c9e70a0-bbb7-493b-a87f-c05d74603692", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680654801, "uuid": "e13a07aa-664c-4494-9b63-bda40e9d38b4", "value": "24576:nj/JOSfbOOZQTRU4CNVpSaPfj5cHmC0U3E3Eqvv6F9J6CIDtGyXXY4vkhg00BZtf:luGQTG4kVkya30UUwkVnDkhgjVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680654801, "uuid": "c2dd5a94-9810-489c-8d0e-8b43f7d64140", "value": 2109952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680654801, "uuid": "8cc813c3-a28b-48c3-83cd-eef25d4b5494", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680654801, "uuid": "e5727bbf-6bbe-4bbb-a6ad-1c3991a6899a", "value": "288554293c54d5da83a2110619d996a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c015fad-d39e-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1680691235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691235, "uuid": "8b75795d-75e5-49ba-93fd-ea08b8fb97a5", "comment": "Malware payload (QuasarRAT)", "value": "97e1ab5655e615da64f51cc7a2f2ee29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691235, "uuid": "78d7b63c-e458-48bc-a01f-039d6d8f898c", "comment": "Malware payload (QuasarRAT)", "value": "a7e66b6ddf1a8ab53336ba305e92d1170925f233bed4608c84b731d6c06b90be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691235, "uuid": "043ede4f-fca1-436a-b7df-524508183e64", "comment": "Malware payload (QuasarRAT)", "value": "36adfd573e8d02e21d4df661128b4598c6b66976", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691235, "uuid": "b55ee29a-9a97-486f-b734-2f318b2ecdb9", "comment": "Malware payload (QuasarRAT)", "value": "31446b613d6f1f927c481d0739a465aaa2b4fdf94bace2b338978cd739bad46df37306d40f3af680e3aacb9393832ae6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691235, "uuid": "d2b9b77d-fd26-44ee-a42d-1246c43b7c55", "value": "T1C4E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691235, "uuid": "e4ac65b8-a992-441b-bd1c-115413d54427", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691235, "uuid": "95fd9f2f-cb4a-4d5e-ba2b-9c5bd7c858cd", "value": "49152:HvyhBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkaqqRJ6EbR3LoGdKFTHHB72eh2NT:Hvst2d5aKCuVPzlEmVQ0wvwfqqRJ6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680691235, "uuid": "33247bad-2070-4202-a780-19cee54d7515", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680691235, "uuid": "c6898708-23cf-4224-bd87-07d5f0ace7fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691235, "uuid": "480388de-c8d9-4310-817d-396a017e1283", "value": "a7e66b6ddf1a8ab53336ba305e92d1170925f233bed4608c84b731d6c06b90be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e78ddf4-d35f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680664127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664127, "uuid": "2f28f9ae-5e92-4139-bd1c-bb0943db3eda", "comment": "Malware payload (Stop)", "value": "7dd7e617b35865ae4077679f926daa0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664127, "uuid": "de98295e-a8a7-460e-9b9a-bc1681f441b2", "comment": "Malware payload (Stop)", "value": "a98710cd8cde15d01f6d09c85700514483274b5ffad119506d032e62b8f72bfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664127, "uuid": "9880d69f-ddfe-47a6-9748-81fbb714b755", "comment": "Malware payload (Stop)", "value": "2c92a40fdabc0f100bd2bf850b81a77f20269561", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664127, "uuid": "d891c7a4-613c-4808-8609-39dcdcd5b094", "comment": "Malware payload (Stop)", "value": "881a01e5ff03bd2f443c8b4294e3414b144f97c36ba39f1f14c783462668cd7aa131da3244301654b2ca7093f1f6a2ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664127, "uuid": "40b4e508-bf91-4052-b42e-4c33171d0f9b", "value": "T19EF4020163E06460D65B4B31CE2AC7FE2AEDB8619E617E5E17750A7F1E343A1E23270D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664127, "uuid": "774bd884-a8ac-44b7-957d-390abbc7374a", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664127, "uuid": "49b342c9-440d-4177-bc19-114feeee86d7", "value": "12288:aLDb66WcHPCRm8Rbd78MNAOKii1LO7VageqLek4axzsBmePQBMZs77:aXb2cvCw8RB7r3v7gg3L34kzkPQGy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680664127, "uuid": "d863d2e8-3d7b-4596-aae8-b59c641c80ae", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680664127, "uuid": "70edeee8-a76c-4fec-a1d0-537626c8c886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664127, "uuid": "e7214eb2-ade0-42ed-a3ad-ef5db3de0109", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f40087-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680718256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718256, "uuid": "00ed4091-9794-4309-8f4c-133d4d436f8e", "comment": "Malware payload (RemcosRAT)", "value": "e240ce4108f8b9c610c74542caeae55d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718256, "uuid": "638cddc1-e543-4d04-bcc7-b7bd829191bb", "comment": "Malware payload (RemcosRAT)", "value": "aaf4c948ee7361a417abb7cf9db87110723a6892797b40d851064e8b8e385861", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718256, "uuid": "cc4abf1d-730d-4857-9c76-22413716f075", "comment": "Malware payload (RemcosRAT)", "value": "4c8f528d04cce7c254f880ac75c75eb90ad1c1f3", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718256, "uuid": "d8945d11-7dc8-458b-b2a1-b472c544a374", "comment": "Malware payload (RemcosRAT)", "value": "18c0fdc177d4856417de56e4b10e09cad28b367fac57067dabbe29108ab166d6dfa42eb39b75459df65d00631718c1f3", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718256, "uuid": "d2b7184d-be1c-4298-b091-3489227d1f00", "value": "T15E542366AAD4AD3C6FE06098FA0671A84BDBAC84D46E5D8734F14DD2160FB38117E18F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718256, "uuid": "9fc74cdc-68b9-49fb-b6b4-67735232b9a2", "value": "6144:MVEsfMY40/4nW8NSn19YP6ORtAOmAB2gdBzDWnbEQmx75VMmwpY91DVbA4Mj:M0Y4AcW8NSn1WCBOmp6Wb27brwpY91Di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718256, "uuid": "2f786172-c0fe-4f01-96c3-57e3693124c4", "value": 286416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718256, "uuid": "d5863e4d-8742-4fb8-b8fa-361860e24702", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718256, "uuid": "ff67f747-c0b8-4a8e-8332-ced70dd92dc9", "value": "Request for Quote.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628d21fa-d3f1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680726921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680726921, "uuid": "0f43f15c-16ee-4c96-8a20-5e4933d7380e", "comment": "Malware payload", "value": "49bd26069b81ae1b42b91810094083c3", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1313", "colour": "#7A6BFD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680726921, "uuid": "5668e821-6f26-40df-8233-84884508f64a", "comment": "Malware payload", "value": "ab9f40293eb3b92e5e3851534dea8f2edf831ecef03f227054da6a184e411a3e", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1313", "colour": "#7A6BFD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680726921, "uuid": "2727e4f1-bf72-4d77-9b54-22cdbfb6805b", "comment": "Malware payload", "value": "62844d95d0dd02d6169981d42db2cfb829f72ff1", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1313", "colour": "#7A6BFD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680726921, "uuid": "24fa2a1d-3c09-4af4-86ad-850705ac69d4", "comment": "Malware payload", "value": "e710025638fa16947d8ed6ddbb9c934a04c63f59864891b812badbf56d26bebe48473776462e8f711da85304c1b4e8ee", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1313", "colour": "#7A6BFD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680726921, "uuid": "dd02f66c-c0b0-472b-ab86-b90e724aa91e", "value": "T13BA633802466E6AD4FB5C340C4D536DBB53FB4F70842F7C946AB66CF8E6AFC084A6251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680726921, "uuid": "5d4216ae-5931-4e84-92d9-90a515a2ac4d", "value": "196608:qcpKVYrpGu0iuWM6rVjzrIlRb+H2z4alJ3fNIGCR8FeFULi:zpB/0f6RzrIlV0a73fQod+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680726921, "uuid": "1eb5612c-c601-4187-8e55-9c638139004a", "value": 10070446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680726921, "uuid": "394c4291-7736-4f9b-aaa9-2cf8f3b64010", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680726921, "uuid": "89289eb8-8868-4546-895a-e13cbbc28d96", "value": "Install.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab73f35-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680699420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699420, "uuid": "f80f3262-546c-4add-be46-aacc89fc63d9", "comment": "Malware payload (GuLoader)", "value": "a84344bafe3cc4a9ddc0eb51c25e99c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699420, "uuid": "d83e375b-73ec-4ba2-bab7-a50fdd930a27", "comment": "Malware payload (GuLoader)", "value": "abb75e66ee83ac1c6c680292e35c0fbc2c40020661da883a3787767e87739127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699420, "uuid": "ae2d533f-c305-4e88-a2f6-ddf498715b2e", "comment": "Malware payload (GuLoader)", "value": "6af7e29ac76f266c5f6ab36aa76270b9117795a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699420, "uuid": "2d16a149-2366-4587-9625-da4c27ae7127", "comment": "Malware payload (GuLoader)", "value": "5e48bbb6cc3fbb528414b3951e041a49a06fd8ad8e36a05064996876b4f749bc16db7d84886c5762c70a9faf0b108049", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699420, "uuid": "76b2546a-25b0-48c2-8e83-f75b969a3534", "value": "T11DD4F10ABD10510BCD65593788735EE31EB36D3D8DF41A2103BEFA5F8936285BAAD183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699420, "uuid": "8af0acf8-89cb-4e41-88e8-b81ffa41693e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699420, "uuid": "818c6cec-dae1-4655-aa68-cbe03b15836a", "value": "12288:Qh+G1bV22TXGHe0SMUE8uYY+S2IkTLfRChEa+CeKde:Qh+G1bV2GGHe0SMH8uZVWYhEjsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699420, "uuid": "ea9113f1-2ad2-4a30-8065-f209adae65e3", "value": 629824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699420, "uuid": "c42cd511-5672-4939-a95a-cd70ea0b6fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699420, "uuid": "ff57b02f-b8f5-4f7c-8908-a400e1bbd916", "value": "Halkbank_Ekstre_20191415_081738_949589.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477d932a-d3c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680707977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707977, "uuid": "cfc717c0-b2be-4d13-aec2-1b7426dc36dd", "comment": "Malware payload (AgentTesla)", "value": "d5b6793b9f94a1d76fb7cfd1b49225a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707977, "uuid": "3be3c8aa-5b1e-4b3c-832d-2df44074aceb", "comment": "Malware payload (AgentTesla)", "value": "ac04a80c6d90cf074b4f01b44b1927707e5f7a3b27e4039d93163c8ecf4f9419", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707977, "uuid": "d18b0454-75b4-4080-9c9b-c6b205dd336a", "comment": "Malware payload (AgentTesla)", "value": "82a46d04718ab836d612ec9d9e41e11023a47075", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707977, "uuid": "c4483d01-68e3-4058-bc53-448b30df3824", "comment": "Malware payload (AgentTesla)", "value": "f52f0021b5449562122ff4997c81c0619230b2efb37afd2d41e330457971964407c3b50eb7ecb817fc345d866617c311", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707977, "uuid": "65a899ec-42d3-451a-8ebb-8e3415259f4e", "value": "T16B85632039F5D019F1379F724BD474B2BDAAB2FEEECA5A490C4107860612A07ED6D53E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707977, "uuid": "c29a7628-b29f-4c55-8b1b-b58f692c05ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707977, "uuid": "3ae89ad7-cdb0-4452-85f3-2fba644e3646", "value": "12288:w4juJtDw/3fRZPvyJnnRDBJRhwhJq6D4Cu2K2onoWv/oQT/GZAO11/9FH6cAequr:2DA34g7jsjTr1Y4hTFpb3Fn9kKo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680707977, "uuid": "cecab2ab-cdf4-45df-8339-65d8b625b6e0", "value": 1778688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680707977, "uuid": "978f20f0-ad4f-41c1-b62a-f2c2c7315504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707977, "uuid": "9c276d91-824e-421c-9941-9313e42fd43c", "value": "ac04a80c6d90cf074b4f01b44b1927707e5f7a3b27e4039d93163c8ecf4f9419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a7027b-d3b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Meterpreter)", "timestamp": 1680702329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702329, "uuid": "9d913e34-b8a1-4df5-8059-f5124ef36030", "comment": "Malware payload (Meterpreter)", "value": "254467349295bbb12619a54628a0ae1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702329, "uuid": "22f1be77-d71c-4793-82a2-6c417be7a55a", "comment": "Malware payload (Meterpreter)", "value": "acfdf4c05f952edaa7302ff0a6f4e241758777f6971dc575b3a06a3e2a3d2249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702329, "uuid": "5d3e5049-0ce1-4c8e-b49c-8c5425332e39", "comment": "Malware payload (Meterpreter)", "value": "55595b6aca4cf4945d5beffdddc21c483b787fd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702329, "uuid": "1509f043-efc6-4615-a1d9-18b962312475", "comment": "Malware payload (Meterpreter)", "value": "b0030e27f7e1333986d2171f9533c8f6a9b7c7f8b556cb072f3bcda167bac8775bcf37f112df2d37cd35df1b8c1a2184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702329, "uuid": "3cfb6171-e261-43dc-8593-e51fb26d19ba", "value": "T17E73B082D5C05476C1A2223D27B53BB59571E4BB2216C1CE7B8CCDE5EBC19B0E2663C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702329, "uuid": "0fcf8ce9-2e5a-470c-a375-6413adddad14", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702329, "uuid": "f1f50b64-a9ae-47bd-9f92-4b864c5e5aeb", "value": "1536:IGGU7klX/PtLMnZz3HzozdyIMb+KR0Nc8QsJq39:jGvPPtc3Hzo5he0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680702329, "uuid": "22a4150f-7ce4-42bd-b1a5-3639ab6e651c", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680702329, "uuid": "8a9baa4c-a1c2-4404-b6f4-d6a4ce404f63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702329, "uuid": "543bf70e-165f-4398-8cca-eeeab7fd5de9", "value": "254467349295bbb12619a54628a0ae1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4096cfb-d40a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680737822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680737822, "uuid": "00641800-f7a1-4a0b-be72-aba3459f4ac0", "comment": "Malware payload", "value": "0180ba97610078bef52617de56802601", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680737822, "uuid": "a27974bf-48b7-416a-97f7-1e9a1f3f50df", "comment": "Malware payload", "value": "ad2243b4d087e657fdf71507bb708c0fc2175b4826bb6ca1d3f9294af387359d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680737822, "uuid": "89b2cf54-becc-402a-ae0d-c53917b7fca4", "comment": "Malware payload", "value": "aa72e663d25e38c3742413a7441e32087228248b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680737822, "uuid": "76f1d8dc-0c5f-42c3-92d5-4a46123f8a3a", "comment": "Malware payload", "value": "dbafe73c58b20b6f0d5d696a8510281b33130d0b956dbdd5365e9e013b28c9103184310dea954ffd7952e76fd0e8b739", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680737822, "uuid": "8d370dab-ca65-4e2f-90c6-d82d8a696ade", "value": "T19372C746A64D6737E1C9B2FC4C2F4E61FC211D6285029AA22BB3D51DCE8B7E4D7007B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680737822, "uuid": "fb8005a1-ceb0-448f-83c1-d50f3974000e", "value": "192:oPViktpIRXgPyyWS9szWnNSufWPpAZqT4/cewYajU+tNjX:oPWgPV99szWsufWPpAws/cjFjxHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680737822, "uuid": "89673175-fc59-4578-a6de-3ee6083ca769", "value": 16224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680737822, "uuid": "35ebaef6-b02e-4aff-8b79-a6e938b9d43e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680737822, "uuid": "a103ef7b-8b60-425d-9711-7b4aabd9dee6", "value": "VirusShare_0180ba97610078bef52617de56802601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e784ed5-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680718243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718243, "uuid": "d09a17dd-6b2b-4cf0-b342-2f35d474f6b6", "comment": "Malware payload (Formbook)", "value": "c98d1bb6ff229e580a3e7f80717600e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718243, "uuid": "41662a39-f7ed-4a4d-9947-c10fbb550151", "comment": "Malware payload (Formbook)", "value": "ae2f07cd525c3e542b16caa6fbabf8e97b57eb4cd73a333d018fc4d15b5c1c26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718243, "uuid": "de0fe800-f9e5-4a4e-ae50-fe87d9d10286", "comment": "Malware payload (Formbook)", "value": "8ee77eb7d3b4a9abecc6f614453f16b4ab0db8a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718243, "uuid": "13cf8582-f3de-437c-9627-adde4701eeb0", "comment": "Malware payload (Formbook)", "value": "69945d16b34cb0dd2899c3e6796930e31a2fc780653fcd54ec37a253864b8970fe62284729a0a376fbeb394ff568cf51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718243, "uuid": "c9cce414-88f6-425a-82b3-7d1950891aaf", "value": "T153D302006FE5D4B7F2924B310B766BF6F3B6BA241934125F2FE41F6A6D20381DA15392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718243, "uuid": "78412f84-4810-431e-a6a4-7279fb9caafa", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718243, "uuid": "09328e47-e54a-4d8c-8e08-854aac4ffe93", "value": "3072:tqTUdySBaLvYzIf/MJ2sVNESfwu/WW2lI3euxPFD9j98CLfByg1xEjRWYG:tkyacbJl7ES9/B2lweuxjfsgsdWYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718243, "uuid": "ccea03c7-3cf3-44c3-ae0a-c56cbd3b7a9b", "value": 141160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718243, "uuid": "92b0416c-da67-4046-9ba5-4a08d1d1ca7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718243, "uuid": "da6e2a47-4333-4f02-a86d-68a9bb1898f2", "value": "Poniarding.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a670822-d3ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680710130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710130, "uuid": "fdabb9ad-b500-43c2-94af-ec1d955ae7d3", "comment": "Malware payload (GuLoader)", "value": "77827fe811299d60a1746c62976c2215", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710130, "uuid": "80838d77-2778-40a6-82e7-d082b18b053c", "comment": "Malware payload (GuLoader)", "value": "ae40d89b95e9bb9432b002efa85faa423670e5fa79354e299098fd1a3d3f06fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710130, "uuid": "8128d3f8-7b92-4907-a432-73ad41ccb999", "comment": "Malware payload (GuLoader)", "value": "1da0ad0ec934ed2ffcc695f579e32c84fbf283ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710130, "uuid": "a334e4a5-e2e4-488d-9f1c-05c9943148ae", "comment": "Malware payload (GuLoader)", "value": "26dcc146b5a86aee65606fbab4b5f85ac950d2c981d05194056fd0a7869166ce4ad5b8955265f9a609175ace4bc09bae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710130, "uuid": "5a917734-fe2d-4068-acf7-a426c4e6b6fe", "value": "T1955412151635E053F9E5AB351CE3DA768EF5AD3224A8522723C07E5EBD32350EE1F222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710130, "uuid": "af16f188-489f-4b15-900f-067a392af55b", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710130, "uuid": "a7fd301a-ee05-4559-941a-50e38a13bf1b", "value": "6144:rLsBN8xoIOKPsJ0r+C6x/A3VWCGiNT2NZuHGO84:0BRCsJ0riW3wCpeujD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680710130, "uuid": "1eec605f-3582-47f2-b80c-8f85968a1f93", "value": 296768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680710130, "uuid": "9b9b2ca7-dcdd-4c2a-bf23-53f854022ee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710130, "uuid": "b8ae0eb7-1408-4bb8-83b5-596391faa8d0", "value": "ae40d89b95e9bb9432b002efa85faa423670e5fa79354e299098fd1a3d3f06fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104e448e-d3a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680695859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695859, "uuid": "33883736-0f5d-460c-a78d-767bf171e32f", "comment": "Malware payload (SnakeKeylogger)", "value": "b7b27373526166e5e3d2c53f31efc474", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695859, "uuid": "39d22f2c-dcfe-47e4-9574-c53feb006a4a", "comment": "Malware payload (SnakeKeylogger)", "value": "aec9db4b3d08cfbfb3731dd3ad74d19678393c35ce00655ad99ee7a2e8f0d447", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695859, "uuid": "1a0db45c-9e8a-4793-82b2-ea3e2ea98f44", "comment": "Malware payload (SnakeKeylogger)", "value": "17b5d23ae0637e7cd59f264e2b39810aa8c80e2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695859, "uuid": "f119a03a-c71d-43b2-9c3f-9f41d5de4700", "comment": "Malware payload (SnakeKeylogger)", "value": "249dbc2da7c1e248a1f278690d7656964c8de28a53693198a0df6a3020738611536e236ec6e01c02e6237491952a940a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695859, "uuid": "756f5307-b2b0-4f4a-b322-30915cb2f814", "value": "T1F3155DD1F190889AED6B06F1BD2BA53024E7BE9D54A4810C569DBB1736F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695859, "uuid": "c585d287-fa69-47d5-9c6e-d14e56a3234a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695859, "uuid": "a2119fab-78a1-4285-a3f4-73f84833cfca", "value": "12288:uOMBubDdCZrBX6hUb5+lt7QPkmDhSFHQI+UocKm6lO8EOQQcx0:uOMky1qu9DhSKmkO6Zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695859, "uuid": "619ef294-68f6-4983-84e5-0050c52e178f", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695859, "uuid": "4d02ea25-7f8e-4c1f-932f-10f8c3eb711f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695859, "uuid": "4b0f988d-7955-4c13-b83b-817e9eb8a210", "value": "product specifications.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fb6525-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1680718248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718248, "uuid": "36d13954-9d78-491a-8c8c-c746acc0680c", "comment": "Malware payload (WSHRAT)", "value": "bc2464749b8b8ea9eb7c4b22b17c4b47", "object_relation": "md5", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718248, "uuid": "f330fd84-e70b-4037-a962-4507a48acba2", "comment": "Malware payload (WSHRAT)", "value": "af2a4f793c6f71b5781207a719b7e2ddbf47d85036a1fa53ffdac1ce3688729b", "object_relation": "sha256", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718248, "uuid": "f2fa7f98-ceb4-456d-b3a9-f2e27d3a1534", "comment": "Malware payload (WSHRAT)", "value": "92f013c4a5d36e2f5bc5a4d494f80a6087b561df", "object_relation": "sha1", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718248, "uuid": "24bd0e88-552b-4c29-a4b0-b7d801eca9b7", "comment": "Malware payload (WSHRAT)", "value": "3e372146a82a0ee3a0e74abe9cbddcce8df45840007e57e709a288ba3405b04ac0bb0a591e288e4238ef0a1127d3a1e0", "object_relation": "sha3-384", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718248, "uuid": "0fb2feef-3246-46d6-b4de-9263ad0c01d8", "value": "T1D902AE27F052944BD8096BFDADDEA2964AFDB8DFB5901BD808A5C0380630370D15CD6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718248, "uuid": "78a7e699-f4cb-4d9d-bbab-dd8853594d2c", "value": "192:364CDWdUmkClqFXwmXUKeLqGjOVrEWA01qDi2aLHlAcQ:364ySsXvXUK7VrLLT2SKcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718248, "uuid": "311f5e6a-49f3-4e43-8f52-77a467b178fb", "value": 8319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718248, "uuid": "e7d43b6b-5934-49b0-adb6-ad7776894e29", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718248, "uuid": "17a84d58-cc8c-4fdb-aa3d-4fbe3e16a688", "value": "Purcahse_Order_30032023..xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f14a97-d360-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1680664755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664755, "uuid": "e3fa2e1a-e5b7-49ad-8d23-d3d5db5208f8", "comment": "Malware payload (DCRat)", "value": "a597b8cd4fa90cda0c3ebf5b4e3cc8c7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664755, "uuid": "c107a52a-57ce-4950-92f3-44015516deb3", "comment": "Malware payload (DCRat)", "value": "af415839e1a054b1f89049aef9b737a9a9d851e61a08a178cd479489459e7b37", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664755, "uuid": "e74946be-e5f8-494b-a9fd-b9b716b859d0", "comment": "Malware payload (DCRat)", "value": "cb86b23ab1d9c6e20ea15ef511636e07c134fc56", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664755, "uuid": "414fa33e-39e0-4703-be33-e4baf6122401", "comment": "Malware payload (DCRat)", "value": "ccdb2e8596d602e9d9b2dd303faee3cf60cbc96ba1557b2546b4768e81718e7df2e92168e6de11d978de712bed1d7bc9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664755, "uuid": "35248ef0-8008-4bb2-8371-daf87ad0b8b6", "value": "T16FB51207775ADF85E6C8657150DBDD2C4BB2EBA23733B3FA6E3861497A1117688033A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664755, "uuid": "eff331c7-3741-4660-8ef6-5a88ebc53507", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664755, "uuid": "584bd484-e58e-43f8-98d8-859a73e78680", "value": "49152:ivZPKsFFGMYvhVGvRTFruc3clFxBtu8zEhJ1jKc2pHjq1aBC:ivZPKsmMYvhVgJjg5uzhTjEDUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680664755, "uuid": "e8874b3a-0815-495c-9669-c96cb7386063", "value": 2345472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680664755, "uuid": "0c79b886-038f-4118-a3a2-83957c23e63e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664755, "uuid": "e819206b-ba91-458c-9751-b51c8d3c93d8", "value": "aeolus2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa35cdb7-d3ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680724893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724893, "uuid": "1463fbec-fdcf-4c86-9ef5-eb06cdd0dac7", "comment": "Malware payload", "value": "aa3d7ddfa0d29fd93ae972c9eec37ffe", "object_relation": "md5", "Tag": [ { "name": "dangeroussig", "colour": "#482BE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724893, "uuid": "d6df2594-6710-4f56-ad42-4a42b8b907f3", "comment": "Malware payload", "value": "af7d9d69a2dfbcedc5d2e94cdb681a8ac5356131486129a4ba505a3dc6f2411e", "object_relation": "sha256", "Tag": [ { "name": "dangeroussig", "colour": "#482BE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724893, "uuid": "5cdb222a-9aa6-48ed-9a78-8ac8dba9286f", "comment": "Malware payload", "value": "5bb5ef0064577988743d9d41692a717bd1d3f7bd", "object_relation": "sha1", "Tag": [ { "name": "dangeroussig", "colour": "#482BE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724893, "uuid": "fde189ee-dd2b-42c1-a601-50d15e61909a", "comment": "Malware payload", "value": "0445875d934955fc9897b8749af0629bcc27f4136aef7578497520f4e1365d15e55afdeaf9ee9c6109c7f9dfac83cd5b", "object_relation": "sha3-384", "Tag": [ { "name": "dangeroussig", "colour": "#482BE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724893, "uuid": "784b04a4-8db4-4a85-a037-ef5d51110ed5", "value": "T1BB27333FF2A8A13EC66A1B31457392508837AB51691B8C1E47FC344DCF3AAA11D3F656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724893, "uuid": "a6c327ea-29ba-4fd0-86e1-032526035a00", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724893, "uuid": "673f6687-8c1d-4951-a805-5531a4023a74", "value": "393216:BCJk+GFAibECL4ISLuaX2IFu8pjZG/Z92+z3b3Wa4zroQAnnV+hhbwBLgewvXFhH:Dr+iaX2Io8pj4/Z92+z3b3P4AZnV8SoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680724893, "uuid": "716fea09-9cbc-49d5-871c-381e3dec52a8", "value": 20842040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680724893, "uuid": "9cdd4f07-2f7c-4bb5-bcc3-7fc4d3ed66bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724893, "uuid": "ab105d62-4643-4916-ba01-3b141dd0af3d", "value": "yspx-v3.2.24-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be30b307-d372-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680672528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680672528, "uuid": "8955f327-b13c-4d75-872b-e94f871c6d83", "comment": "Malware payload", "value": "90163e536e36257ebeac623c49e73b0f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680672528, "uuid": "a44df8c1-6862-4476-84fb-2cad20dc0575", "comment": "Malware payload", "value": "b0cdea52b864dd19803916989c79def604057a84ad7d35bba19dd92ec7976fc3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680672528, "uuid": "08e31d3c-dce9-4718-865b-cd1cdfceb9e3", "comment": "Malware payload", "value": "4b8f56469c585cf79d7a1974767e778a1327fdf4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680672528, "uuid": "9a2ef7ef-1c04-4231-85ea-0179f7c0cb0f", "comment": "Malware payload", "value": "70bcb7382f83589c6d587246dacc9f1f4eb5ac9a666b212569f958459de8a41eb9a7f9c43afc3810b6b01539a4c16bea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680672528, "uuid": "a5bf2a39-ffc0-495b-8da2-2d138c0cfdd3", "value": "T130B4239EE7964624DE421B33EC9331CB07B8FD79979BEE5B10E00DA6ADC711E5C81098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680672528, "uuid": "309273a0-1742-42b5-ac16-0982013b4268", "value": "12288:6fY/nCeQQb2+FxfxMVKj7WndlP4bPVogUlrCk3LWPs:6fQCeQ42SLHSdl4kOKLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680672528, "uuid": "6382b4db-7403-41e7-a98b-84e22eabe04f", "value": 517858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680672528, "uuid": "f0f124c4-c54d-4ad9-a602-47b217b2642f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680672528, "uuid": "3a561e8f-5b76-40a1-8b58-8933fa905717", "value": "SecuriteInfo.com.Heur.15571.32002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546d1a1d-d3b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1680701127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701127, "uuid": "dec7f7da-d3db-492e-8425-1042f1909a7a", "comment": "Malware payload (DCRat)", "value": "1fc4c7e9d6b2c285467b081a3ba2c8e7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701127, "uuid": "884c9247-21d2-4461-bb08-7cf221e9478a", "comment": "Malware payload (DCRat)", "value": "b1088573c2e783e97fb07ccf1d8d8e9372ccd8983cc07c7ee9c6989a3844b334", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701127, "uuid": "e3f6d242-72bb-4a4c-994b-adf22135ee5a", "comment": "Malware payload (DCRat)", "value": "af9127d982484f3e286b0dab304659fab5c828a2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701127, "uuid": "ca2c338e-de2a-4fe3-9d91-a06c6bf1c0e7", "comment": "Malware payload (DCRat)", "value": "bf1aeb21bae2310d1a78cc69e527e584c341f72159310b75b88b1c72ceee8620e835d73a5915074ef03810adb6f13e23", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701127, "uuid": "be500008-9963-4776-b551-ef092ef9fc31", "value": "T1B2263387A14CA37BD316A9BC922E1DCF7B0C223A5833C9CE4B6505FDD67362611E91B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701127, "uuid": "714fb3be-f5c4-4268-bc19-c4728f487bfa", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701127, "uuid": "b57e0976-9eba-49a3-bf09-88fe6472f994", "value": "98304:BIMBQvHvNNMq+mX/PI0wW8uZNLbjraHrsRkT3FRFH:BITvPNXX/bwzuZZPaHr+kTVvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680701127, "uuid": "b5e72c76-613f-4a00-aeae-c93c90ee9660", "value": 4725248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680701127, "uuid": "eaa122be-efd7-40d3-83af-31a237b78d43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701127, "uuid": "a1558504-0709-49f8-a90e-9426d30641bc", "value": "1fc4c7e9d6b2c285467b081a3ba2c8e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6986ee8e-d3b7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680702022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702022, "uuid": "4e4040d6-99ab-4a97-9e8a-d8d938c7cd20", "comment": "Malware payload", "value": "dfff102b87186676e0aca147af365fd7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702022, "uuid": "d7b5923e-dddb-4418-84fe-bb8cfbae5135", "comment": "Malware payload", "value": "b12bd8ef14e184a9f2d2294dd6eabe561cedf4faed072006b0518b234658df5c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702022, "uuid": "f00ad503-dafc-4daa-81e6-359a756dfee7", "comment": "Malware payload", "value": "b6046e6aa1f6963fb41b249e5b5f5eb1d1b27eaf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702022, "uuid": "797cf1d9-6e2a-49d0-9fdb-0e1dccdd2780", "comment": "Malware payload", "value": "25619d36cf7b07760a3a25b80475ea57ba58c314a03e7e91de8da0d7d4598bae2ee6af7274ca2002f0ba294b90b7c026", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702022, "uuid": "40f979ad-2fc6-4e6b-8c67-64224511cefe", "value": "T10FE57D23B385A43EC0AF1635596BE725993B7AA127268CCB57F40C5CCE755C02F3AA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702022, "uuid": "0632dd6a-dc0f-4d92-abe6-59972c3a2adf", "value": "e58a4956081d3743d1b2a41b659f2b69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702022, "uuid": "4483b5cd-df37-4562-ae39-a5f25a92eba2", "value": "49152:1afBZfn6JDi5FQ5dtSdgIH/5roi5VzQ78r6F5mCmR+CYuNA:YfPf/BoEzMo6cYIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680702022, "uuid": "3fc60f49-ef92-4731-8152-ccdc02372ab8", "value": 3076096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680702022, "uuid": "5066c695-c9d0-4477-b5b6-0cdd65738468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702022, "uuid": "20b41485-faf5-4069-906c-76230f040ec5", "value": "SecuriteInfo.com.Win32.Evo-gen.12769.8436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3c4f6e-d397-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680688257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688257, "uuid": "e07a436e-88c8-4cea-9aad-40ba581e86e8", "comment": "Malware payload (Smoke Loader)", "value": "34cfd7c9b4cdea963219864ff8444adf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688257, "uuid": "dfbb8862-8048-4b3d-98ab-b0a8c29c9a8b", "comment": "Malware payload (Smoke Loader)", "value": "b13bcab04e00fae390680716d53c96c7d5bad10482d070f477c59af4a06de372", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688257, "uuid": "88f58c83-c8ad-4a61-9b04-b71c251bc3dc", "comment": "Malware payload (Smoke Loader)", "value": "1d7b7fba6de2af7584f53bbbd90050551fe02494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688257, "uuid": "d6c36066-c08b-46b4-a309-eefce95376ef", "comment": "Malware payload (Smoke Loader)", "value": "0fb559138b925dadc5e899d633b0bb2a1971277b5639ccd81c6ed252349e8e9a0f062708ddd754cb115247c670bc956f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680688257, "uuid": "c8284913-4c1c-4e38-83d0-10a88e7d7d23", "value": "T1FC34CF217A90C472E4ABC0344930F7F5BA7EBC719B55858B33583B6E2D317E1976A322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680688257, "uuid": "d94aa8ac-5b21-4b6d-87c3-3b0fec9c8d63", "value": "b4caf46136c63a95a01f90b173e613db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680688257, "uuid": "7f82c664-4ef6-460b-ad94-cc255eeff43d", "value": "3072:XidWHL3j0Q1Xa0MJEpeYn8SYzGD7tH1/+h55jd:ydWHLTxHMJExn8SYzGd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680688257, "uuid": "f5950f24-5565-4e35-84a9-02aaf2466ff2", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680688257, "uuid": "b6365363-7658-47f5-9282-ffe0a99062db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680688257, "uuid": "264f620c-83b0-4134-a35c-03458548aafc", "value": "b13bcab04e00fae390680716d53c96c7d5bad10482d070f477c59af4a06de372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d81710c-d3a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680692150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692150, "uuid": "335d76b4-66eb-40db-8565-50db66fce1aa", "comment": "Malware payload (RedLineStealer)", "value": "eb69b7cb438913118a2be950334b1f76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692150, "uuid": "03771b36-68b0-4e41-a57d-6949cc6883d4", "comment": "Malware payload (RedLineStealer)", "value": "b154d62f97d3f36ca4d4bcc700f82bd647fb9089c48ee301b34190af7344e5f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692150, "uuid": "17d0e032-a886-4afc-b3fc-360df5ac7419", "comment": "Malware payload (RedLineStealer)", "value": "8f0a29e4d3b252293949920820075a4d9a88454b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692150, "uuid": "57d96a58-296c-4068-988b-5324c042879c", "comment": "Malware payload (RedLineStealer)", "value": "a4f3f53362277e6d43065c7e766813c06cafcd87da7c5f850ba9e2387badadb81a0828afb4472e864c300a7fa4d09d75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692150, "uuid": "fe6c28e2-c18f-4567-acae-2ebfac13499c", "value": "T1D904C51437FCCD11E0BA5A3F6961A05086BF9802A852F75B76C367CD0E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692150, "uuid": "93b2c374-cffd-449a-a87d-f84b9b071567", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692150, "uuid": "4f31964b-669d-4f42-be64-b141eb3b256e", "value": "3072:kxqZWZRanU2n0YLxE3I4Ge/N9PhhPxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jr:6qZgYLx+r5Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680692150, "uuid": "f5c0401a-daf7-45fe-ae14-b622dd5db7ab", "value": 179242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680692150, "uuid": "8f4fc1cd-65f1-4cda-9cef-d6d9a1cc4816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692150, "uuid": "7c68aa43-30b8-433c-9c9e-d92fa8d014bb", "value": "b154d62f97d3f36ca4d4bcc700f82bd647fb9089c48ee301b34190af7344e5f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49574062-d39c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680690371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680690371, "uuid": "26767ee2-203f-4d75-bc01-01ab9ba94af3", "comment": "Malware payload (Formbook)", "value": "bf34a70ab9b8687307a5006bdd3345e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680690371, "uuid": "af2ead71-94ca-4dc3-a64f-0ae1b864ef6e", "comment": "Malware payload (Formbook)", "value": "b15e94a6fde3f1813f38baeb354ff8a63a0bf47cadcf3b988595df6667747f07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680690371, "uuid": "5273a88d-15f1-4d52-aa21-2850ab37ff45", "comment": "Malware payload (Formbook)", "value": "f508a9024b6e80f8fbb51db4fb9ade4a3d8c40aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680690371, "uuid": "1d68a968-0e84-449a-b177-1768e330598a", "comment": "Malware payload (Formbook)", "value": "d5b6dfec104e0c764066420ec3e28fe7cbf1139f20df551f9513625cb985dd6f2fc1e75ff60ad5b4b6b048d795e61bc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680690371, "uuid": "34ad0779-2b8b-4176-84ef-afc5f97d88ab", "value": "T1A445238174726376EE84D53B665992BACC316FB9473EC0BC2C61BFB925F0744389A930", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680690371, "uuid": "d3344630-3879-4589-a098-2cdf5bffe195", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680690371, "uuid": "713465eb-3897-48db-bc46-9c75f4f1ffa4", "value": "24576:kF9BP6OML0JRHt5k8/d2gs5yzGC1lOFsFRvQoeueKl:kFfVMLR8/mwzP1zLNeBKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680690371, "uuid": "a3a72dd9-aa79-40d6-9421-de7bcb2dc64b", "value": 1190912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680690371, "uuid": "64bfc02f-575f-4ae7-8126-a58968a651c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680690371, "uuid": "8c109896-c336-4f44-9a98-fbc1b579f7d0", "value": "b15e94a6fde3f1813f38baeb354ff8a63a0bf47cadcf3b988595df6667747f07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7461f2f6-d3c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680706764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706764, "uuid": "4dfeb7f4-8815-4c49-ac7d-35c2df771ebc", "comment": "Malware payload (RedLineStealer)", "value": "dbec94988373788339d35821a564ab4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706764, "uuid": "f3687f31-fec6-4af5-b4ef-81c123580c3e", "comment": "Malware payload (RedLineStealer)", "value": "b1dea2ce60b69675255eed5e916bdb8362c900cef76673e6e359bdd5723bcf9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706764, "uuid": "ae5cd8ff-a23a-4857-a291-1643fb8eb275", "comment": "Malware payload (RedLineStealer)", "value": "77d168f4e39fe6bb40c641fa6ea5da6c578a0839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706764, "uuid": "3ee544d2-17f7-4fa7-9f33-71f32a43d8d6", "comment": "Malware payload (RedLineStealer)", "value": "c0e28dfccdba744425cf034a38fee8a5dc349ea551a2af261adc8074ea4d34c71e5f60a334e86de7338164781959bdd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706764, "uuid": "7076a696-94ab-4033-83e8-d4eb179e940f", "value": "T1A6556A257C8184E6C63217B045A4B77CA67DFEA25E20B9EB3FBD8B3D0FA4D00B225515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706764, "uuid": "0e470416-3436-48b3-97ef-c765de74c86f", "value": "5131925e2a63e384d473ce1212d177ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706764, "uuid": "d5f09ed6-6497-4bdb-9582-86ac4b486739", "value": "6144:fabzQlv3Q4sM6u43YLQ0h2DBAOD4CANwSGRG5qtt0j+kXW8dw4/CZOFEv38:fabzQlv3Q4f6uyBt+6SuupaB8rzivM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680706764, "uuid": "aa7696da-7eac-44bc-b834-447b4452adc0", "value": 1288192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680706764, "uuid": "63dd11c4-896a-436e-bd93-3b945a8c7e25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706764, "uuid": "c36087e8-eaca-4061-8b50-2b4052cecdc6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ada669-d3ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680732932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680732932, "uuid": "03e3609b-79c1-455d-8e06-bd56afc5f542", "comment": "Malware payload (RecordBreaker)", "value": "b8406c0265685a3472517f1b8b5d514b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680732932, "uuid": "ba0abaa1-2433-49c0-b69d-6f6dc5da3ec8", "comment": "Malware payload (RecordBreaker)", "value": "b242612fab32f3a2bc44033c804e586a12fd450795ba68510a32c67059b6d7b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680732932, "uuid": "d604e549-226f-4652-a361-795ac243b7ab", "comment": "Malware payload (RecordBreaker)", "value": "1c94df97a4580e48860b5d8b543f3ef5b6f5c0d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680732932, "uuid": "3208c6c2-4233-478a-96af-cee3954c1a24", "comment": "Malware payload (RecordBreaker)", "value": "85b6000200802f5193aaee7353eef0b09d1cdfe4f3581353d2178027ab80334af5f11ca905e29773c0ff1f5ec1c3dc2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680732932, "uuid": "ec02fff1-af6d-4b2b-b5fc-77d2276598a3", "value": "T1A8A5235E7DB0C432C57215390ABDA720372D3C23FAE3CA9F6FD5B91969A0D8152226D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680732932, "uuid": "09299e23-a217-4a9e-ba46-a4a7fe49d382", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680732932, "uuid": "4512e093-03e2-4c80-acb4-c456bf348164", "value": "49152:NJ4HLiAIg8bZGZLggVaa6acVbId2cD/ki+aHT+:NJ4HWBXALg+56pkd2+/kl4T+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680732932, "uuid": "59081054-b8bd-4890-a455-4cae21cff3ea", "value": 2225936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680732932, "uuid": "2d1763e6-7e06-4890-8dcd-6760d474be45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680732932, "uuid": "a140c39a-a076-41da-a940-58624324fd75", "value": "b8406c0265685a3472517f1b8b5d514b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce698e4f-d375-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680673844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680673844, "uuid": "7232ea72-1d6c-4c3d-b5c2-d05b7413ba60", "comment": "Malware payload (RedLineStealer)", "value": "0eb47635d997f848f52b57738cbc02fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680673844, "uuid": "2d0dca72-4914-4586-9ec8-0c906cfc5df0", "comment": "Malware payload (RedLineStealer)", "value": "b3363dfa7a54e375c98d4934c85bf995738822c8c3899280c3076876fca74db3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680673844, "uuid": "35ee9766-2ccb-4c32-8223-aa5d728790db", "comment": "Malware payload (RedLineStealer)", "value": "7161c1a7f3ed3f72074b4a4a533cd8dfff1d1116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680673844, "uuid": "0e9074ee-da1d-4af4-9a59-69ef26345a76", "comment": "Malware payload (RedLineStealer)", "value": "4848fb8da24bf61e1ab3315d8f1d51a8fa1c7d35a53a45846bde753607c69806c20f20bad8d89488a7c805ffe9eac74f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680673844, "uuid": "6a9f76b4-c197-4438-b543-9630c7c8ddad", "value": "T119852202BAC558B2D4721D3346399B11A97D7D203F7ACEDBA3E05A5DEA205C0DB327B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680673844, "uuid": "72f3b39d-fce8-4a61-b8a4-42dc4f66359c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680673844, "uuid": "8ef71847-1fe7-4214-a92a-1f7d3429d7bf", "value": "24576:2TbBv5rUyXV8zVlvNK7J2DLXVikKyPsHNdtwWosAga9buFM0cvcTysPEuxWGrfVD:IBJ4pNKFgFY0gDIgaOSEBlxWQVJp7mM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680673844, "uuid": "4aca3086-add5-4e32-bf6b-da06f353906d", "value": 1773225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680673844, "uuid": "14f5c7db-454f-4093-89d0-1c0dda19a51a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680673844, "uuid": "d1475f31-0c5a-4830-950f-60d2be8fb717", "value": "0eb47635d997f848f52b57738cbc02fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b47529-d3e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680719490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719490, "uuid": "6d22a0cf-4e90-4567-8ed5-a03e6708ef88", "comment": "Malware payload (RecordBreaker)", "value": "3c15362311fdbc1ee774c80e2f541b4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719490, "uuid": "1dae835b-c77e-430a-bccb-f9c3e9db8bb9", "comment": "Malware payload (RecordBreaker)", "value": "b3779eff9ed2b1a0b2a980e760ce677e9fc158876691ba72da0a809bb73b51f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719490, "uuid": "fd53c18a-b45f-4683-ad69-fac4a9021d20", "comment": "Malware payload (RecordBreaker)", "value": "97b5368937d88a052a37164ceed6c4d2c456cb47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719490, "uuid": "20e9ed46-e8f2-47b6-a2e9-b0d76c98fbe5", "comment": "Malware payload (RecordBreaker)", "value": "15492a4ced19031053e01994ed13a1f4e756cd76966b807319072e682e7603800e6c96a530fa3d0f14b43bff2bf532ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719490, "uuid": "921413d4-c94a-4762-a14e-72ef0406c52d", "value": "T18405AF33B1B10833E0331579AC2B665DD83A7E202C78E9062BE5ED4D9F3BA517925397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719490, "uuid": "022c052c-ca8a-496a-a50a-c00f6d460f13", "value": "7a1f03aec8b2c813fb23d7a97335ae88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719490, "uuid": "6635ae62-80de-498b-a991-313c8025fce6", "value": "12288:AkqyglaEq3vgPIzZpurCqayn2zetLP+L2/WXwCuiWlvLFB7u/GFI3dSq0j:AkCAYIzZpurCqaZ8/EwC/WFJgdS/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719490, "uuid": "2b29473b-f254-483d-9bae-ee082a3a579f", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719490, "uuid": "c79e07c4-cf62-4abb-9024-d0138483c587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719490, "uuid": "ea5fd1de-1a94-411c-a0a8-61fe88c646ba", "value": "U prilogu je nova lista narudzbi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34654694-d3b9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680702791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702791, "uuid": "522b039b-df35-4d4d-aeab-30c6cdc55b67", "comment": "Malware payload (Loki)", "value": "78d36c3687ba558615c3de6e80392c59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702791, "uuid": "3b5d4f54-3314-4e99-9a3d-fe2e39449646", "comment": "Malware payload (Loki)", "value": "b3a40483ab494f036bce8494672fcabc9719ac985979446135ca2625de80056d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702791, "uuid": "0af03634-da3d-4e68-ae3a-6b365c421c41", "comment": "Malware payload (Loki)", "value": "9be9de899e2817069e8a9968bea8eae5c95b2add", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680702791, "uuid": "0570ffc4-159f-4d62-b962-2b348ca8df69", "comment": "Malware payload (Loki)", "value": "6b3344430f79175e512d88aef053db88843fab7798f82240505b1819648e749a5cf67325779a4e0c0200a27bd0aa05bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702791, "uuid": "b302262e-cca0-4f39-a860-49a9dd90a6e3", "value": "T15ED4F12037ED9619C53783BD80E0D2B06771DCDAE562CB6B0FC9BDCBB29DB460626152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702791, "uuid": "e5ec56fe-edd2-4fa6-9b18-d3620e6dcadb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702791, "uuid": "975b35f1-5601-4392-80fd-006ea59a3070", "value": "12288:xxSqHpYCPmimOMt+d8w6gV6VzKFQNz//oUynzLhaEvItoZppMAX9Ep:xxSqHpY7imX+8wxAz7V//opvha+ImZpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680702791, "uuid": "5be3cb2a-9c30-421c-8675-3b752db4899d", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680702791, "uuid": "e1b50be9-a8a7-484c-a40d-3c151043420e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680702791, "uuid": "8a154f77-5c5b-40f0-98e2-6b3842ff031b", "value": "Awb# 8457108962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f3c8bb-d377-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1680674471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674471, "uuid": "8fd4ef3e-fa9c-4dee-8fd9-0aa90e451a79", "comment": "Malware payload (DCRat)", "value": "0410ad8c8b8ec6b2ee2b706c6a0acbf6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674471, "uuid": "01b35e6e-50b9-49ae-9238-9d7586748a57", "comment": "Malware payload (DCRat)", "value": "b47a509e9b36ea110a2f9c8a092dd3b2ae1cb3cc559cad17ff21e5e17b533b56", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674471, "uuid": "4bf7c3a4-7551-44e1-81eb-bf73689d3f51", "comment": "Malware payload (DCRat)", "value": "547b1610e0db662cbff6df7bf058ee035a0e1d55", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674471, "uuid": "8be65f38-b2b9-4a86-9c1e-c0b605eb27d4", "comment": "Malware payload (DCRat)", "value": "7fcd3650f1659c47808486842da3ae4ae555af5dd61d1c4d4ecda87aef447c5353c2ba9fbd223a8d97646075db2c62c0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674471, "uuid": "1e0917bc-1061-4668-ab61-61c7a143f25d", "value": "T1903507123A4ADD12D069163BC9DF447A07ACAD01BBB6DB1A7E9F335D71123A70D0E1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674471, "uuid": "607d6e69-c413-4e92-9cee-ea98afba0cc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674471, "uuid": "24b966f1-cf09-4b7e-976f-d28882e73199", "value": "12288:Iykxb3vSqOTmRBqDDMAyD4fqbBVUWpzg5p4O3YQbISMo9pqn4:IxDSqOTyoDr05bBVXBoxoP9oH+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680674471, "uuid": "30aea847-7dff-4dda-af3f-16e9b50655bb", "value": 1119744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680674471, "uuid": "f53acbb1-c473-4a90-bee3-8c38e065c776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674471, "uuid": "a082dc12-7c13-480e-a789-6215c329e8a3", "value": "0410ad8c8b8ec6b2ee2b706c6a0acbf6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe8993a-d3c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680706757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706757, "uuid": "f6384f43-421d-49ed-80bd-38fa0ba6f977", "comment": "Malware payload (RedLineStealer)", "value": "5976440f692469e4cd54b31e796e0a67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706757, "uuid": "76b0d5b1-e06a-4931-ba18-4ed374c6dcf1", "comment": "Malware payload (RedLineStealer)", "value": "b5028a7de35a26caa8ae47fa3bac912dd72a94c36a56dd17be659658bceef2f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706757, "uuid": "5708d725-cbfe-43cb-bbe2-0c19a9ed0a86", "comment": "Malware payload (RedLineStealer)", "value": "08ced2e83e478197636726e33d71fb06dab6001e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706757, "uuid": "9548fcf7-06f3-4297-bda3-7922e74cd910", "comment": "Malware payload (RedLineStealer)", "value": "d54ebc99c9e2c3275e5770da2be46c8678a66291ddb07403598acab6f2603f2b5e831c2e2017317e8d1bde20a5fdb511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706757, "uuid": "957dc2de-6a9b-4574-bea3-5132e4fe3f93", "value": "T18A35231672DC8072E8B027789DF212930E35FD906978563B2B4AF40A5DF39D5A132B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706757, "uuid": "ad1094ca-c43f-4969-864c-70d8d4db4c78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706757, "uuid": "3c132a7b-32e3-4f0e-908b-21376fcd013e", "value": "24576:tyjdQIoy9aVfhX9k8CuiDsJg00I/pICDAeX3GJm9:I2Ty0DAvsJg00I/LAue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680706757, "uuid": "5b651036-fa91-40a4-aa29-96bdbd9eed66", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680706757, "uuid": "a3ede1ef-ad88-4877-b78b-b2a987a58eea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706757, "uuid": "b5d8122f-119f-40d5-9250-c90178e925d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc0dd05-d377-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680674598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674598, "uuid": "647cb81a-5101-4eaa-b9d4-4cd37139090d", "comment": "Malware payload (Mirai)", "value": "a308ed2299d3d3ea3ad07ea0f46c69f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674598, "uuid": "548b1b45-21ba-49c1-948b-70a122810dfb", "comment": "Malware payload (Mirai)", "value": "b5ba4371a6da501c26234c3453eb6493ac10beb85105f382df37bfc05afbc738", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674598, "uuid": "c88a2ba1-d665-4931-b10a-d3377fb36c25", "comment": "Malware payload (Mirai)", "value": "bc040046d332670ecbcae8b8a142998de6e98f41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674598, "uuid": "030d09c6-852b-4966-8fa6-681c4df19680", "comment": "Malware payload (Mirai)", "value": "56d7cc618389d99137dbc129a90e8f513914a53f79f0acda2d81d3d6d6d5d33effb2a0797725000a39ce4eaa36571907", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674598, "uuid": "fc609385-5671-42f0-8052-8aa162febdfd", "value": "T16D03F20AC53F7923C6B10B3973259ACE6F0D0B9BD29E333718A1D46A79F60851961A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674598, "uuid": "ab6798ee-86ad-4fe4-a869-d5eebaeb74cd", "value": "768:vEKTB1L6yeH28yWN1gF20jONGOgklHZ44r4htFOmWH9UsJts3UozT:lPLLiyWN1gF20aGOgkl54Ol+sJwzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680674598, "uuid": "3d2ca376-71c6-41b1-9c2a-3c8df4e854e7", "value": 39924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680674598, "uuid": "1f338928-d42a-408d-9fa9-1e2372211cdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674598, "uuid": "d860a1c6-8420-45a1-9c48-0c1e531dbfbe", "value": "a308ed2299d3d3ea3ad07ea0f46c69f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18dc1b1b-d395-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680687283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687283, "uuid": "281ce4fc-7d14-49b7-b36c-2bfbfce4b61d", "comment": "Malware payload", "value": "0b2a10c2bd959d326d321816e650b64c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687283, "uuid": "3589a07f-2164-4170-b9a1-7683e2c0cd3e", "comment": "Malware payload", "value": "b69b56937410a11e071ff03e8cc329345e9ca0c06a3445da35a66045b70cde7c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687283, "uuid": "4444ca06-44ec-45a4-a649-0f71a4d13666", "comment": "Malware payload", "value": "32d885d52dd5bf6b4463763b798677fffcb2292d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680687283, "uuid": "83be4c40-fce2-4031-806b-9365b038a882", "comment": "Malware payload", "value": "9bbfc38a56c316ce06687fee5e6af98bb69674692a2d3044a9dadabd016436fc7e131162f95df258c4b860b3058ead83", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687283, "uuid": "4b8460c0-e742-45af-86d6-f8d2b916135f", "value": "T12D0412347D4DE0ADC64CB92697FC46C8E85D7AF21B3A46989914B0390DE711CEE7A28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687283, "uuid": "600c95c4-dfa9-407e-b695-4ef90d65293a", "value": "3072:lneSM3cW4yBnHAEJ+3/ON4wr9SaSf4EU3q4lvkE3DdIc58yBuTjegDq0uK5C:BlEHAFqSWja4lB358yBuPegDHuuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680687283, "uuid": "58fb8416-064e-4cdc-bbbc-01d30665bda2", "value": 181078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680687283, "uuid": "d2bb4e7d-c68f-4dd1-91b0-3fac68f8fad7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680687283, "uuid": "7937707c-5fd1-48fa-852a-b59a13e8fb1b", "value": "b69b56937410a11e071ff03e8cc329345e9ca0c06a3445da35a66045b70cde7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5553ba-d37d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680677174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677174, "uuid": "f0be03be-7a7c-4b0a-a95b-1a9a6e2ac761", "comment": "Malware payload (Mirai)", "value": "557aea81bf34f94a483c48ff5881e2bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677174, "uuid": "596d4053-827b-4cec-9d03-1eed9185ecfc", "comment": "Malware payload (Mirai)", "value": "b6f78f055bfaeb09deedf5365399c0f3ea03c0231d2dc0bfd5f36d55512716c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677174, "uuid": "dc573724-de53-4dd5-9e3f-980161933845", "comment": "Malware payload (Mirai)", "value": "45f87c7b1eed6d78fa72897af14ce5f852f074f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677174, "uuid": "57be530c-a8cf-4f87-92cf-e3c6bc060b94", "comment": "Malware payload (Mirai)", "value": "f83f680163489eeb828752aa98ed3825093b7119525ffc6f8314a50821b6314a4ed71288dcf10839399c32c29b12ad12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680677174, "uuid": "a552c192-af0c-47ff-993c-e46486ecf297", "value": "T11503F12191ECDF92F03981354A8F7F996CA1D14586D05D26F2D0387AC3A1B9E28BEDCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680677174, "uuid": "21525287-69c0-433f-bdc6-759899ed8f00", "value": "768:zGfar+t3YUWnwwFI0W4isDmegev2acP+Wma4GapXrqanbcuyD7UHQRjy:6fW6CPssHd2a1dWHanouy8Hyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680677174, "uuid": "04bb0c26-557f-494b-a32e-8b9a69be2bff", "value": 39884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680677174, "uuid": "26bf5ff6-4aed-43fc-9f4a-f4f668e5d413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680677174, "uuid": "cfb1c6fe-e125-4016-a382-26aa0df97d03", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c61ef8-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1680700485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700485, "uuid": "8aece598-c92b-42ea-b244-adc4bb399a2a", "comment": "Malware payload (Gh0stRAT)", "value": "25321a8e3ee7f0708b0ebb7c8c4c41df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700485, "uuid": "67045dee-7853-4a05-8bb2-8f46803a0e95", "comment": "Malware payload (Gh0stRAT)", "value": "b79c01219efbda91eed6eed68b95ed727dce909b848fff8339c5420285d2721d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700485, "uuid": "a0bedc68-5af8-4e2e-b914-44a3a5e4572c", "comment": "Malware payload (Gh0stRAT)", "value": "e4ad32e1a27748372f8084a6a6cc89bb475b8171", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700485, "uuid": "9a6a5b40-e06f-44b1-82f4-7977a6775c46", "comment": "Malware payload (Gh0stRAT)", "value": "2edd56c3d17e024424a66d6d9aebd938ee7ee47ae03a321c13079e2a3e7c34a3f063e91eaee3497aa3e5c665426d2e38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700485, "uuid": "96773494-4858-4e6e-b786-e7b2479794c7", "value": "T114D59E323BC180BAC3233631864EE3B9AAADEA711D71524766501F3D3F345D2692D66F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700485, "uuid": "f31d3524-1b38-4d26-aa8c-9a64908d17f1", "value": "d2a593b16a5df5a4c58d7ca47caf8dcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700485, "uuid": "25af084a-d5b0-49f8-aeec-0c5de335ff89", "value": "49152:fWnAteSAYvPsqD2AQLRgcTPC4YEeZB92k0Z/6b9HC8ds1mqklFC76g4WRA0DayzV:7teSAYvPt2AQRTPCKez970Z/6b9HC8dE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700485, "uuid": "080cabf5-456b-4b8d-9fe3-1fbcc822645e", "value": 3015168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700485, "uuid": "f95e089a-e3e7-427a-999e-9f83c6333386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700485, "uuid": "5c8d98bf-feec-4c15-a09b-8fe70fbe2762", "value": "25321a8e3ee7f0708b0ebb7c8c4c41df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962f22ea-d379-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680675468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675468, "uuid": "327a2d1c-961f-4227-a7e7-444ca47ae03d", "comment": "Malware payload (Mirai)", "value": "a696ba8943006a94df380676cdbebcd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675468, "uuid": "55aee3a0-af86-4da6-a8ba-51ae1cb18592", "comment": "Malware payload (Mirai)", "value": "b82aad60c6f0d446f9c3708965c2cb5bb0e55e35173f1b0c775b86c9e29abf57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675468, "uuid": "177fb4d6-01b9-42f3-8acc-c0e9a673d125", "comment": "Malware payload (Mirai)", "value": "7f4a8930f35cf55899b2954050ab6bec477a685e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675468, "uuid": "4e7e2685-46f3-4f6d-b898-1e5718b67893", "comment": "Malware payload (Mirai)", "value": "64aae43e56f3c165d4397a98dc4c067c52e6fc5e78dd4ed097fcee66f67e45ad6813fade7241450d07a40decee84f3cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675468, "uuid": "6cb71a5e-77a2-418e-901e-68e7b23c9e85", "value": "T1BBF2F195F1C6CC30D58652B3A1172CBE463C9C6A510BE52137DD4BE8EBC378985A83BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675468, "uuid": "33f9c133-23e1-45a7-b89f-90115f86e03e", "value": "768:d2harKiKGXF2DTW8bxsmLEOd5v0oBcfYKy/bvpRIhU6:d2hSKi3McyEOd1dKyjRWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680675468, "uuid": "798323d9-572e-41bb-a2c7-affdfcfefb85", "value": 36492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680675468, "uuid": "db0541f5-ab53-4f1d-b6fb-2cb4af6c2a9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675468, "uuid": "9205c804-4e90-4c4d-8c68-900524355776", "value": "a696ba8943006a94df380676cdbebcd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591dbf6a-d3ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680724757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724757, "uuid": "325c6952-998a-4c36-80ff-a7152b4deb88", "comment": "Malware payload", "value": "e1625dbc1f61e1e2a91d876c7217f0e9", "object_relation": "md5", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vsntai23", "colour": "#5BD47C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724757, "uuid": "f9f2557d-200a-46cb-8995-18bccde2f3cb", "comment": "Malware payload", "value": "ba8e9358ed6bf5b3f2a976850ed3fdccd00ceee0f50a09008b7a957c7c8e2415", "object_relation": "sha256", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vsntai23", "colour": "#5BD47C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724757, "uuid": "673abc55-ecae-4571-8a1a-a7e2b05ab006", "comment": "Malware payload", "value": "0338bea6fc05b36e42cc509d18f955c2636c4214", "object_relation": "sha1", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vsntai23", "colour": "#5BD47C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680724757, "uuid": "4c15141f-0c1a-4367-a0c3-d08a09d428f8", "comment": "Malware payload", "value": "4a47ce6b9f35c13828c4b2355b90b00aee26131567f0ce3aaddacf94a69844d54689e3797b2fb6a7bf720f1cfe7fec82", "object_relation": "sha3-384", "Tag": [ { "name": "agentb", "colour": "#C3F1B0", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vsntai23", "colour": "#5BD47C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724757, "uuid": "ed8fe720-49c2-417f-839e-352265ea8332", "value": "T1C6E5F13FF268A53EC5AA1B3145738210997BBA61781A8C1E47FC384DCF729601F3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724757, "uuid": "92cac5c9-9cba-4b24-ae1b-225bdaef5aae", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724757, "uuid": "5dd079f6-8d57-45ed-95e7-97051a7e59fa", "value": "49152:cBuZrEUK79XySTSMa+nLb7hr+UpMhd55DdN7POGjS:ikLUXySTLa+n37hqEMhd55ljS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680724757, "uuid": "12266f3f-52d0-4c81-ac75-ad8d9b12f7e2", "value": 3072792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680724757, "uuid": "689a0ba4-57fa-4869-a65e-420bdfedcf63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680724757, "uuid": "2434bae7-588c-4f90-a2b0-0f22deb0059e", "value": "updx-v2.5.23-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a5d14f-d367-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetSupport)", "timestamp": 1680667551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680667551, "uuid": "855a7489-c939-41d0-8de8-22e6ce03529f", "comment": "Malware payload (NetSupport)", "value": "961fff30db007ce156a52898aa5eabd8", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tumnt.top", "colour": "#DD4702", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680667551, "uuid": "85164552-9dff-46fb-8dd2-c6e082f1f2ca", "comment": "Malware payload (NetSupport)", "value": "bb2187dd4edfbedebbfc502dc42fff4ff291d657932e6bca4997edd64fc0ec15", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tumnt.top", "colour": "#DD4702", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680667551, "uuid": "a5706dbf-75a7-4151-99ab-ed9920dba2d6", "comment": "Malware payload (NetSupport)", "value": "75bd15aafeb316575ee2bf309d84ae41a1879bff", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tumnt.top", "colour": "#DD4702", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680667551, "uuid": "c80d4b65-49ac-4c7a-accd-c9f89494d926", "comment": "Malware payload (NetSupport)", "value": "54bbbfe1b7aa928fd56eb1bad9103a27485da96f96381bcc9110cff1543c2e2fcaa919473a66315ab942fa5693ffc1c0", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "tumnt.top", "colour": "#DD4702", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680667551, "uuid": "5f8d7047-a12c-4d4f-80f9-7288d6149a05", "value": "T1A7A533122594CA73FC72723FD1F3801CB95F78F0B9946D8B8110CA1AD732EB4AA5656B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680667551, "uuid": "500f2ebd-17a6-4419-916e-5b266e56a814", "value": "49152:slQ/lEDThXBJOhHM2p2Ppe6gLQx/3ef0iG3FH58QNI+pl0g/P8H:sqaFXaW2Axe6neMiYA23plPP8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680667551, "uuid": "b600fe20-c412-4de5-849c-80fd1e238513", "value": 2229302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680667551, "uuid": "efeb2c79-1481-46d5-8482-c4118397097b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680667551, "uuid": "e613c675-f39b-4e5a-bcee-551b1767cc82", "value": "tmpih_gh6gv.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a82c84-d40b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680738086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680738086, "uuid": "9aefe38a-731a-449a-ae7a-97fbeb4c8c9c", "comment": "Malware payload", "value": "9785bf942f902929de1e45a48709e1ac", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680738086, "uuid": "f3490109-d6c0-402e-a5b0-791c543439d5", "comment": "Malware payload", "value": "bbdde10ca28507f0ba7c2859874c3d295a63421d1c49dd16ec4118d51ed170e5", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680738086, "uuid": "9ee0eaa6-5cf7-4637-b5cd-a47cc7a2f64f", "comment": "Malware payload", "value": "574c3aed0d994c2a000ef8a844fb2b9dbaf4f35a", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680738086, "uuid": "f91ff8d5-e487-4ce8-a2d4-76766a684a40", "comment": "Malware payload", "value": "7682a8007b032cfa0b86787cb16fbf923e74103af8376773c8031dd1e71d099a0aa87f27cf74be9777f1d75a72ce814b", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680738086, "uuid": "caf708c0-b308-4a21-9ef4-9ef138241da9", "value": "T13E35D05386A92C17D777E737BF654640CB280A1A960171C7F07E2385FFDE44CC2A8AA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680738086, "uuid": "aa6c2f19-5a56-419f-9391-8f94651f9adc", "value": "24576:KwfkK79Av4AFKmT0GWj6I9QM88RRwvXofWUUcNaw4:KpSH1mTE2sQ+PDOU5Naw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680738086, "uuid": "16d84736-1110-49a2-be48-1a9803cb195e", "value": 1109595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680738086, "uuid": "9fbc1f2b-eb76-49ac-87c4-44b7472049ed", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680738086, "uuid": "db9eed7c-1ad4-411c-8d8b-7d8c538c32c1", "value": "Qui.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e45d6b-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680700516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700516, "uuid": "bfecb2b8-81f2-44e6-9802-77d8930a16f9", "comment": "Malware payload (Formbook)", "value": "344ba820334ebda5eec8c7a701b3cfed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700516, "uuid": "1cae2952-73df-46bd-b683-2ded74937bcf", "comment": "Malware payload (Formbook)", "value": "be4f36ad29a948638afbfb9434ace62dc1d9cd3fcfee3aff3d5da5fe687b6e31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700516, "uuid": "5a5d77ba-30c7-4686-994b-dc9ec8d53940", "comment": "Malware payload (Formbook)", "value": "8297e28f07a44ac7ea675ee3410776483fa0469e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700516, "uuid": "e3361fea-b9e4-4c27-afbf-e5ae0d0efb2c", "comment": "Malware payload (Formbook)", "value": "4cd71ed6a123b28a0cb4070acd2d875de9504bbbbeae1a940f8ddf75c8be936849251275ee8b5d8b58b6f136761a76a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700516, "uuid": "4efd8548-eb1c-4e53-b101-ad2f1f95c2c7", "value": "T16D462801BFE4491BE6F71BB8742512C8D9B4E56A76D3A706300FB4690F293492EDF362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700516, "uuid": "fc135d11-d812-416b-b750-c42d4eec2474", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700516, "uuid": "735f3688-4dbe-4f42-b282-82994646b497", "value": "49152:Be62YWtmy49HANqG2Ae4AJywA6QZYy9kr9Tr+F3EDUyTrMCr:8iWt8AMBlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700516, "uuid": "b54d6e66-3277-452f-a6e4-cafc6dcabe14", "value": 5393920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700516, "uuid": "61c27093-94d8-4939-9f3c-78b1b350efe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700516, "uuid": "ba295320-0f0c-4a99-b1ca-9c629473b91e", "value": "344ba820334ebda5eec8c7a701b3cfed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5af8a7-d34b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680655854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655854, "uuid": "ace84ad4-26f3-4222-ba11-ea1a5a8fd33b", "comment": "Malware payload (Amadey)", "value": "52b788e17d043802e90e89c9cf4daf2b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655854, "uuid": "06785195-e246-4042-b355-518b49d28774", "comment": "Malware payload (Amadey)", "value": "bfc65ea9d0d7a7963bb33a240e39298e4b8a5c66f3bd9bcf04f49e49833363e8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655854, "uuid": "fa86f454-f0ee-4f9f-831d-9e1a801399b7", "comment": "Malware payload (Amadey)", "value": "96c9e7884bb5dbff8763cf923a867795a7de8aab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655854, "uuid": "9eab8b67-bd21-47e7-8777-1f9b4217a506", "comment": "Malware payload (Amadey)", "value": "9988da73fbf926e8940f992ed1f320eebc679591147ade8dd6a2760f6d4a6bf9440b3b774c571e118803b19cd0127a65", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655854, "uuid": "d68db9c0-368c-4be9-805d-e3f9b6f7c13d", "value": "T1FF352262B6E81032D9A01BB00CF706DB2734BC629DB9871F27D99C1608B36D5797672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655854, "uuid": "1c786628-50d0-49c3-a348-bd97a3377187", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655854, "uuid": "5435ce78-9663-4c74-8432-c98c0c30846d", "value": "24576:0yWLkjAexjAzoUOaFxuXlbOEqXqJT03h/2qeGwTnO:DXM2lbO9qT0352qef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680655854, "uuid": "c90be57d-5076-49d8-9568-57a9f40c3852", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680655854, "uuid": "db60bbad-c323-4364-8179-a8159228c336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655854, "uuid": "6634f229-2456-49ec-9f4b-28f4adba68e8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bcbc6a-d3aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680696412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696412, "uuid": "1aaf0c10-52ce-4fad-abfc-067825e55868", "comment": "Malware payload (RedLineStealer)", "value": "6ef30c9d5d3e48a6f1c9e08b43d22b68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696412, "uuid": "a78af5e9-0c4d-414e-af0a-43395b21b3d0", "comment": "Malware payload (RedLineStealer)", "value": "c14a47f25e4a3f032e061a6c9286833c39707fcd05cdcd9cf79903842d069aeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696412, "uuid": "5bdebda5-fc84-4b09-bee8-613a2b1c3374", "comment": "Malware payload (RedLineStealer)", "value": "d6999ce60158f048df94fedcdb01e2b591848fda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696412, "uuid": "d0cf50c5-41ec-4bd2-8557-ba37cc577edf", "comment": "Malware payload (RedLineStealer)", "value": "92d5bf96df517e192a8905bcb0b67a724e85d92cf87c472b5eb298fe3ff3eb8520a20c2118b899060c97cdcdc3cc1087", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696412, "uuid": "b0557c9c-344a-4c91-a396-7b56caf03e24", "value": "T1EDE41202A2F99573D8F417B098F902C30F3ABC76A978922F23525C5A0CB35D5A4757BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696412, "uuid": "7ba5b455-fd26-4fc4-9032-d54655bdcee4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696412, "uuid": "8ed19919-1a1c-433a-9a0c-0b03bb1ad1a0", "value": "12288:JMrEy90/TI19mPvxD03PMPu42X8gmNe8vwg8IXgePYM4rEpAxtH3:dy/19mPB+MGdUY8vwKgePjVA7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696412, "uuid": "c27a2efa-13c1-41af-bef6-f2d23d12f470", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696412, "uuid": "0f000b1b-8a4e-4ae9-a316-a50efb74bf58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696412, "uuid": "31cc9a1e-ca3f-4530-b7aa-ae51647c7a81", "value": "6ef30c9d5d3e48a6f1c9e08b43d22b68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d158d81-d3a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1680694619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694619, "uuid": "9b332b71-f614-45d2-9ab3-5a62bc85da76", "comment": "Malware payload (zgRAT)", "value": "f993a82ed57c34128415ee831d9114af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694619, "uuid": "f043a28c-d9bb-41b9-9265-6fd491b6f1cb", "comment": "Malware payload (zgRAT)", "value": "c224affb5f6f936e8177fde1d1d4fbc065db25c0f326f38af5a68224847c8a22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694619, "uuid": "13784e84-bbed-4d8e-b911-1f1fdfc6d918", "comment": "Malware payload (zgRAT)", "value": "877247ffe7e494772a18b9bc26aae60a5ed82dfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694619, "uuid": "c088dc1c-10e3-40b7-98a9-4bad72a4d85c", "comment": "Malware payload (zgRAT)", "value": "c4ef8641c30c305681b1d6744bc75dd1e701f07168e6398505801b24d6c769b89c6f4d9764ede278f634727f41aec0cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694619, "uuid": "de880e95-cdea-4f1f-9770-eb159a05c03d", "value": "T15405CF1B7E8B5D30C6994332C5DBC50897A4CD857297E74AF89813C60D433BAEE4BA93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694619, "uuid": "9dbaa975-655b-4939-a926-2a0c34842579", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694619, "uuid": "adff6b66-ea07-46e0-b477-57d9f7fc18bc", "value": "24576:sidD0fc2/MU0GaxRo+DsEVD74zPY1Wn2HVju:sTcK9vaLDse34jY1A21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680694619, "uuid": "fc770c8a-6426-43a2-a235-ef1b7f098df7", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680694619, "uuid": "cc3bb2db-bf75-4ac9-a8d3-0abef1a82987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694619, "uuid": "c6b98626-0c31-4531-9117-1c1dcc452bf5", "value": "c224affb5f6f936e8177fde1d1d4fbc065db25c0f326f38af5a68224847c8a22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f31beb-d3ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680697003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697003, "uuid": "7fd40b20-68b8-483c-a14e-9bc694fd7ea4", "comment": "Malware payload (GuLoader)", "value": "3ff1150364277dceb7047b6e2e0d00d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697003, "uuid": "d0b7df8d-210d-44ed-b3ae-84864ebbd947", "comment": "Malware payload (GuLoader)", "value": "c3108377ae1619d8bda54869024bd8d1d03c62d5c7b4fe9ab25d5cd6447288d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697003, "uuid": "409e0c36-9d67-47de-b684-d44b56026ccc", "comment": "Malware payload (GuLoader)", "value": "fbd2b6a74e6ab75850d7a23033cc74284c8a3948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697003, "uuid": "ad5317c6-7b4b-4cca-9005-ef1e5a0151ee", "comment": "Malware payload (GuLoader)", "value": "95a40d3195eb86e9836f0536e7de5a30e8856a4af16458b9a3abed16607232e3a89730b86dd1aa6a566c4d14eef0b914", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697003, "uuid": "bb19f7a7-81e6-4e3e-b569-9bd9801965b7", "value": "T1B3E401413BBCDA27D6A67C7F6423B20C34BAAE50AA46C52577673AFD5DB83411E07203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697003, "uuid": "da2e8d2a-cf2c-4897-90b5-df79cfdb0745", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697003, "uuid": "07d1fe4b-bce1-4e98-b181-f5db60d65f00", "value": "12288:dMw4EAPcLqk7JVRRrCo/xT3yZrn0aHDyq9DSXALFWJ8caLUv:dMwtAPcLqkJVRRrC+3yBDyq0GOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680697003, "uuid": "6968f181-cb5b-45f3-8c85-3ae38a490f4e", "value": 677808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680697003, "uuid": "7a4b410c-0946-4ea5-abdb-6b50084c6f8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697003, "uuid": "a2ad88e8-26dd-4f7c-84ef-ff74e6e6c124", "value": "c3108377ae1619d8bda54869024bd8d1d03c62d5c7b4fe9ab25d5cd6447288d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2404d5-d3bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680703823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703823, "uuid": "9cb4a7ab-3db7-4032-a251-2a66b9f09efd", "comment": "Malware payload (RedLineStealer)", "value": "1ed8575ada9794bf9e8dc02aeb88a35f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703823, "uuid": "29e9de79-b236-4183-9cc0-34cb8e390ce4", "comment": "Malware payload (RedLineStealer)", "value": "c380765a7160e51acaebd5ec431f170cc289b20e25e2632a447aac404c614d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703823, "uuid": "0786f9f9-b5b1-4b67-951d-922dff473739", "comment": "Malware payload (RedLineStealer)", "value": "cdc694329737d37fba512340d009bffeeb7a86a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703823, "uuid": "c73646cd-aadc-41cb-bc1f-9fc94d27ff97", "comment": "Malware payload (RedLineStealer)", "value": "234e3e6ba20c67c2708693dee0d07f3db956de93822d0737996e9be19c97268525031d9f67892d07ffcad8efb0b5646d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703823, "uuid": "0a426a95-d458-4c70-92c3-08330a2e4340", "value": "T1A3E41253F7E9C032DDF26BB05AF612831F32BCB2697443576A099D192DB2594A4B033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703823, "uuid": "d50f04d9-b9bb-4495-9ca6-5c9100603b21", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703823, "uuid": "075d7cde-8591-49d6-acca-461dcb1401fd", "value": "12288:SMrLy90rvEz4UYCAZVEL9gpAHr89cSCuVwdLwT/NI2Zd4ShQPtik7WN:hyI+YNZVEJKkr8miwdL6/NfZd5QPjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680703823, "uuid": "d7b6c561-dd33-4ec4-8de8-abf2edfb605d", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680703823, "uuid": "1f185bed-3030-464e-bf99-541ac7e4b427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703823, "uuid": "91dd35ac-d6a9-4a4f-97c5-809b92d54d34", "value": "1ed8575ada9794bf9e8dc02aeb88a35f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8abe17-d365-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680666863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680666863, "uuid": "ea815ebe-ea7e-424c-80be-50090efe9c74", "comment": "Malware payload (AgentTesla)", "value": "e9e27d455a8ac62a62334c6dec6eaa2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680666863, "uuid": "22d07cad-f065-4211-b5aa-c3d68461c253", "comment": "Malware payload (AgentTesla)", "value": "c500a942eb4151e5f94aee13d6633a91796e68e50e7dfb52da6a8c3787f71a79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680666863, "uuid": "bc24984b-db22-4d51-b276-78bb820c5306", "comment": "Malware payload (AgentTesla)", "value": "c81fd6d74a222eb6e97a0f6a10785f13013685bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680666863, "uuid": "4ee1cec3-deee-478c-be82-219b46e1cf96", "comment": "Malware payload (AgentTesla)", "value": "21492c6f11a77657ff6c25ab492bbf7301a6fe1a3031588411688b571cb7a3da35f53dfe2006eb3115c2349f3077f6f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680666863, "uuid": "58a1636d-2b02-4fae-bf3a-1bf3afa0644a", "value": "T137C42393B102DE09E280AE2E61F8EEC7511999B09C5DC713EDD93B867B9674FC384934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680666863, "uuid": "f6b44d5f-e6ff-4e67-aeb9-08bb302311b8", "value": "12288:SLwZ0W1KrttH7yAN1EiRHDz3sweKfbJbFu9JHJ1L35rDgRkHLo:nZ0WYttH7yAjEitzcwdBUr1L3pDDLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680666863, "uuid": "9721e6f4-1ac2-497f-ab27-c671b471211a", "value": 557722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680666863, "uuid": "9c4cc130-c7be-4dde-a7c4-14b6efed1190", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680666863, "uuid": "30af7f02-7b92-4750-9750-149ee57444b4", "value": "Curriculum Vitae Adriana Silva.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca31450-d3a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1680692229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692229, "uuid": "9a61e633-1380-41c5-afe1-51732222645d", "comment": "Malware payload (AZORult)", "value": "1af3636daffb82a5aa101ab132a08eaa", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692229, "uuid": "3d2c1930-4c07-4548-97b0-c79390a5b156", "comment": "Malware payload (AZORult)", "value": "c5b1a84308686f8d0009dc18291bb28be36ea5863180cfcf5fa5206e0daa7df5", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692229, "uuid": "45047990-39b7-4836-98d4-8bde4cc15df7", "comment": "Malware payload (AZORult)", "value": "3e99f0a8848bc8c0a24c70111329b5b1e6bec7d8", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692229, "uuid": "8fc1c751-ee28-4393-8991-6b72a46383fa", "comment": "Malware payload (AZORult)", "value": "76a0a98e3d1d117f5bb91fff6203cb3bdefb8c75d13dc1dac9ac8dad139b11fb4f151b9fad5c3bd082b2e88ca61f1998", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692229, "uuid": "cb90eb12-06fe-48f1-b33b-2024a69baa89", "value": "T1E7A5BE41A3DC82A1CE6A4372BA36DB219B777C692634F70E1ED83D7A3E723521518353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692229, "uuid": "6f6ede7e-cd2c-455e-827f-d759774cd6b0", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692229, "uuid": "efd67364-af2b-49bd-ba22-f95fe83593fe", "value": "24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYh:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680692229, "uuid": "416756be-9256-4cf3-953f-3469593e3945", "value": 2111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680692229, "uuid": "4367fae5-c191-4936-8874-4997fa2b15f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692229, "uuid": "349280ff-6f59-4a6d-b00f-7344559d356d", "value": "c5b1a84308686f8d0009dc18291bb28be36ea5863180cfcf5fa5206e0daa7df5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527e5203-d3b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680701124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701124, "uuid": "c3240296-d7ac-4fdc-b9c3-45cdfdaab22e", "comment": "Malware payload (Amadey)", "value": "258782ae25ddd1c96bd2495a62b31054", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701124, "uuid": "dbc84878-b27f-4553-9b6d-66c03766d210", "comment": "Malware payload (Amadey)", "value": "c603126b26d1b75c07323739db5f0b7f7d56776d6e208c9cedf48a8e9593cef5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701124, "uuid": "5f894bd5-cc34-4a1e-88f1-6584961d282e", "comment": "Malware payload (Amadey)", "value": "6dd73c89471c0121d3e6047535fbaad8ddfee151", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701124, "uuid": "1a57009e-f807-4afd-992e-f16086a069f5", "comment": "Malware payload (Amadey)", "value": "15c305471c307e2a92c29e4a62a2354e2036b9768dbac474b8b0f409d3be4619482dc0e07d4015acb4fd11fd895994af", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701124, "uuid": "d1d323d4-7b0f-49c4-9457-d324b2a4a665", "value": "T14F352302ABD89073DCB2273069FB06970736BD929D78067F27D6646F0E721D8943276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701124, "uuid": "cf50ab63-30e4-4169-b949-78ccff007af3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701124, "uuid": "d9b0520e-4673-4989-8771-c390070a0beb", "value": "24576:8y8QIeUKGWFi30EJllPvqXYtEHnYosYPYZFLkPg/JZyHnGcWx9CT9u:rQtB+e0E9vqXR/0ug/JZ0Gfs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680701124, "uuid": "51017681-105c-49e6-9307-85d2bfb6ddfa", "value": 1134080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680701124, "uuid": "d9e2b109-3f89-4d16-b500-38d88c6c0708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701124, "uuid": "26aa8156-b369-49c7-bd8d-4f0559a06983", "value": "258782ae25ddd1c96bd2495a62b31054.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91e8dbc-d34c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680656253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680656253, "uuid": "28131ebd-1acd-481e-b658-bb5983c3682c", "comment": "Malware payload (RedLineStealer)", "value": "323d8f1f20955f7e3dd3314d105c1be8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680656253, "uuid": "58fe161d-8ad3-47b8-ad53-644cbb093237", "comment": "Malware payload (RedLineStealer)", "value": "c63096dbd2e1d31f74706fe5c6becf63f95b87d901f1c0f953ff14de7001c515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680656253, "uuid": "4d118291-0ed5-4fc1-9531-bf95d1e78828", "comment": "Malware payload (RedLineStealer)", "value": "db2a07837e60fd29bc4764b97608b731bdd5fda6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680656253, "uuid": "a73ccd30-14a0-4ecc-9edb-b265cb2de4c2", "comment": "Malware payload (RedLineStealer)", "value": "ab5687833ad39ae3106f5d9bf98e74a33443dd2204b12fb85ce27359670dcd1735a1bd540bd7f4183a993b9818bfb108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680656253, "uuid": "e257db1d-01b9-44a3-a34e-999e171a53d5", "value": "T1C7352353B7E58537EA65673028F602C30B77BDF60C3C86771A45659B0872A84EEB132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680656253, "uuid": "25c6726b-dd9e-4553-b12d-726d6cba0c2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680656253, "uuid": "d8253dbf-913e-4419-988b-f77df3e7811c", "value": "24576:dyrOP0c71HX1y+6/yTPwMWFu2NZtQC+cQD:4rsHlc67wXbNdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680656253, "uuid": "fb48f95b-079b-4a35-9b55-49e6bb3edede", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680656253, "uuid": "b2e99ec2-0e1f-4f37-95e9-2ad934f44c13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680656253, "uuid": "b1185421-2527-459a-a974-d831ea46a053", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a87965e-d3b2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680699849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699849, "uuid": "f07312ad-ddb5-4707-bc7c-211c29fe8e78", "comment": "Malware payload", "value": "838ed0c6c432ab9868f97f5244655387", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699849, "uuid": "faf0025b-2b62-446c-8acd-4ecb2a71a361", "comment": "Malware payload", "value": "c63fb9dcc59191f33cba3ebae0c3bcb7f8b05fe4a719fb891c61144a640effc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699849, "uuid": "d453b81b-7e3f-43e8-9071-a4a5226847e3", "comment": "Malware payload", "value": "075a81393b6841b6906dfc0134cac1996f8d2d26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699849, "uuid": "12c5991d-5703-4521-9812-aba31851ac09", "comment": "Malware payload", "value": "1f40e56e58964a38d3d9a8d40913d750406c25faddcb440e160dd0ce225892f54e3749005525e9eb4103adca1da51937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699849, "uuid": "1f33fcfb-065e-4ba2-9339-4e7d2839a6de", "value": "T18425AE2E8E14C2F4F67C07B5D0D37F296EA40AA647D2851CB87761C63B85B8A5C0E94F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699849, "uuid": "32e71002-72f6-4c9d-a294-8272aa728d10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699849, "uuid": "b0e42f6e-f905-4f3a-88cd-3913bb5eb683", "value": "24576:awFZPN1Nw2zbxJtWz+S9+Q8SfOzebYtq/wDTffwu3Un99:dfw2vAaSjlfBbiDjrUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699849, "uuid": "a2cbce38-9986-43d8-86c9-fd7e384eda6c", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699849, "uuid": "8c672f3a-c77a-4f8a-a6bc-87bcf2c05d0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699849, "uuid": "eccd5b6c-f786-45fa-8890-d159c80c13f0", "value": "cotizaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a03a5b-d3e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680719566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719566, "uuid": "fa16cba4-a711-449a-80ac-fe62b74706c8", "comment": "Malware payload (Formbook)", "value": "8532bd3de99a6a70c19aa6bd007d5faa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719566, "uuid": "cf965407-cb2e-4507-b3b0-3de1bef89c08", "comment": "Malware payload (Formbook)", "value": "c7b18628cd2f25508290da77b3ad685ecc1d0e80edc5940dd4773b8dbe037209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719566, "uuid": "91715c0e-6c66-4d8d-b34a-18eb45056e43", "comment": "Malware payload (Formbook)", "value": "1ceaa61430265756c400dbf2200a2afc27621ec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719566, "uuid": "43c092e5-42ff-42ca-84c5-d0d448dd5469", "comment": "Malware payload (Formbook)", "value": "22f02318f4b741490f9bfcdf72a5f30111a4794dd464ea75e4edb6a4e1c0084c55ae1f3c04c61fdacf035a5bc4d91576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719566, "uuid": "1d6c62f8-5fe2-48ff-b7a6-f8613615e42b", "value": "T1C3D412057BA8D73BC93C4BF5D863304993F1E62A7066E79A8DC064F50E3776488A19E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719566, "uuid": "a95edd8b-0515-470d-8ecb-0f41c2aef05c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719566, "uuid": "89f7cf73-7cd3-49c1-9e98-3b590db61a08", "value": "12288:p17XXh/IFO9BWAdnsHkpb/7UXZN95A+2CkM/kh7m6n0RJICxG:f7nh/0ahdQkpbQNHAQk1y6g2kG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719566, "uuid": "f7487552-c3e7-4347-afa1-cde19c0e6b05", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719566, "uuid": "335f6c81-a7c5-41aa-9c05-ef18aa0ddf26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719566, "uuid": "3feedc4a-08b8-460e-8156-27d4e3120d4a", "value": "04042023_dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78cf80d-d34c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680656304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680656304, "uuid": "6d01056f-008d-4b11-b98c-12941f659d43", "comment": "Malware payload (Amadey)", "value": "cb58c072754703300e6b98f1ecd266e8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680656304, "uuid": "d1fa222c-4181-4855-a2a3-dce8ad5e66ee", "comment": "Malware payload (Amadey)", "value": "c7b810593960bd1952de7e39da27e4bccad8f70b98acfbc4a9b371cc32f630e8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680656304, "uuid": "55503d9a-ed08-4fa9-b918-0f019beef6ae", "comment": "Malware payload (Amadey)", "value": "c1d7eb2299efcaac3ef1e5492bbb3569598d0696", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680656304, "uuid": "44de9603-29ac-4b25-b30d-9d2e5afa3e04", "comment": "Malware payload (Amadey)", "value": "1769d8ffd72471d509f7d56975a34a853819721cec35bd891b70de3e4a2ea8c6e628d7ff2af754f5d88c52ef83f77a6c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680656304, "uuid": "dacb5545-1837-45f4-9a83-6c760ab17e5f", "value": "T195448D1163E06471D51B0B318E2AC7FD2A6EB861AEE57A5E17B5493F1E343A1F23270C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680656304, "uuid": "7bb2ffa2-4e7e-4cd1-9584-94a7c44b8f3e", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680656304, "uuid": "76a836c0-4318-4355-a3bf-f26d13d5ab03", "value": "6144:HjK4Tmr2L/awfTv2l0LpIObJICEJ5FaW:HjK4Tmr2LywfTvq0L7+9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680656304, "uuid": "4e40e76b-14ca-4f5b-b423-f134e64d0bc1", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680656304, "uuid": "722323f9-1751-4e70-944a-8b8bdced9763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680656304, "uuid": "ef8713ad-de05-4b6d-a5c7-a9f610576533", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffd32c4-d39f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680691966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691966, "uuid": "657a6b5e-3c1b-4047-be59-a6ea1c0d152a", "comment": "Malware payload (RedLineStealer)", "value": "4032bb4bd49d98e27cdcd96814921525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691966, "uuid": "c4e4183e-710a-484d-960f-5b93e0e6c954", "comment": "Malware payload (RedLineStealer)", "value": "c7de0ae3a0a65e637376b534b625a398a21a7eb1d0f5ed41d329f03ab3f93d48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691966, "uuid": "2ee66caa-7af7-4555-8b73-c1b104efbb49", "comment": "Malware payload (RedLineStealer)", "value": "e8a19d3a9336bc2aee32879bab1c40651a13bdb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691966, "uuid": "38fa8404-7990-40e3-aeba-2eb96d698ce3", "comment": "Malware payload (RedLineStealer)", "value": "c001e0f43761108d0a2d4c7e7b464e32f2a431e9fdf259970e43f86c133e09de4dc27449952bcef60e38fc6071aa3aac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691966, "uuid": "2f741ee6-1235-431c-a68a-d3b9552cbef1", "value": "T17244F70527B9CD10D3AA163FD1E2541006BBAA02AA22F34B39C717ED0E71714BA577EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691966, "uuid": "e1a99c37-3ffb-478a-b193-c90de88af25f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691966, "uuid": "b17485ac-553d-4a2b-99a5-76b0bbb718b6", "value": "3072:/z6jYELL6VXXCG/SyVXtwkw/em3EvLc9Cao40VBaw8hUJnSVJBb7xNn2pU9f2MKm:/z6jU1KyZtwLe2EvLcSJ8hinSVJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680691966, "uuid": "e1cf3b42-a7f8-4d47-af4c-5d3da407af2f", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680691966, "uuid": "407259b0-dd13-4911-b089-751f834a8dcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691966, "uuid": "6fc40009-c6d2-478d-b1b1-3c9e58e8e012", "value": "c7de0ae3a0a65e637376b534b625a398a21a7eb1d0f5ed41d329f03ab3f93d48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e151bd-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680718249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718249, "uuid": "ab65c19d-fdbf-4f29-bd37-684e6570aa63", "comment": "Malware payload (AgentTesla)", "value": "296a9f8e795b66272074e0822928e08b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718249, "uuid": "fae445cc-c3d9-4422-84a0-345b9d52a123", "comment": "Malware payload (AgentTesla)", "value": "c8bfbf1eff8a047dac6164e46bd28eeb8fbf3dccac544e7853fce271bce75060", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718249, "uuid": "2687d204-9384-4376-9e6f-0e59851dde0b", "comment": "Malware payload (AgentTesla)", "value": "5462d14ea03f2e90fe1bf5f2ff02ebe70aeacb1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718249, "uuid": "68f4a3e6-0468-4d19-9faa-2015c2b8e944", "comment": "Malware payload (AgentTesla)", "value": "0f7309e62b8d9b6475c5a3e8cb77444d05132816989df3c75441721b50f2aed18b9988a62c6f35633186aae0ca9dab3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718249, "uuid": "f738a7ec-2666-4663-a69e-8d944c3d7046", "value": "T1D0F49D2E8E04C2F5F67C47B5D0D33F191EA809A647E6851CB97B60DA3B81B8A5C0D94F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718249, "uuid": "0cecfc28-c97a-4bd3-b560-6e6e988c4c0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718249, "uuid": "f2ef0d29-d834-402e-bad9-f52b3166cb3e", "value": "24576:UwFZMN1fyUgs8uRcZAoiysqomhR5Mdkd:6p7gsNRcZAoinF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718249, "uuid": "0e6d008c-9bb9-4f91-864a-5902293f2bef", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718249, "uuid": "c944880c-d60e-4689-9b70-5f603bd05b53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718249, "uuid": "a9bee22e-b535-47d7-9b90-ea04a82fc678", "value": "PURCHASE ORDER - 5201927651_4.4.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4316a53-d3c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (SocGolish)", "timestamp": 1680709958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709958, "uuid": "228d944d-5457-4239-beeb-81caf4b6ef90", "comment": "Malware payload (SocGolish)", "value": "c2a78c21ae8579c277a99b564dd97a93", "object_relation": "md5", "Tag": [ { "name": "socgolish", "colour": "#007B88", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709958, "uuid": "efe82e0f-ae2e-4b03-9186-5c1041728e52", "comment": "Malware payload (SocGolish)", "value": "ca0f917039b2ec20f80b1c38d18df3eb39cd59198179ab5614999b8719e7dfe3", "object_relation": "sha256", "Tag": [ { "name": "socgolish", "colour": "#007B88", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709958, "uuid": "1b61c7e4-3104-4f1f-a65c-52e8c6fd1f26", "comment": "Malware payload (SocGolish)", "value": "85a7cb2672d9e031b30e596f6064d851372b5bd1", "object_relation": "sha1", "Tag": [ { "name": "socgolish", "colour": "#007B88", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709958, "uuid": "0ff64b5c-4129-4ba6-91ff-a8ec8dcc96a4", "comment": "Malware payload (SocGolish)", "value": "41c20860fffd1cbce9ba04b3298565fbf9e97ff01a35071fe993e8b9b8c7c09514b3a6b891c526d71b76fdb9de1a7a3d", "object_relation": "sha3-384", "Tag": [ { "name": "socgolish", "colour": "#007B88", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709958, "uuid": "aebcf81d-3618-4b04-89d5-066042fa7e9d", "value": "T12BF4238597D701594E234C1686435CCB22B5EFFBAE1E07BF69B84B31DC472A44E368B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709958, "uuid": "edd7c8a6-0643-4342-855c-3177cc24f481", "value": "12288:TgeU63U9Mt5Syzk1ZCTGwOOKffgsKnhPX63AcPoREb7eHKL85VY5bJLJah:Tg/6E9Q5UwBgoVtfSockKL85VYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680709958, "uuid": "2a83737a-d784-400c-8be9-f99e77a8ccba", "value": 732833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680709958, "uuid": "dc37b135-6816-4dd7-b5b2-c0a4244b410b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709958, "uuid": "374fecf1-d901-412c-93c8-1f6ab9544fe3", "value": "Bcnu_collective_agreement_portability_65614.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4cda2ca-d387-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680681559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680681559, "uuid": "9d334290-9bdd-4d35-b601-5111e921db62", "comment": "Malware payload", "value": "862cb66eb444d1da7e4f006aa21fdf10", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680681559, "uuid": "48fe261f-3855-42ea-80f9-874c4bf46671", "comment": "Malware payload", "value": "cab4f7dfa7d3b5ae47f3eb947dc76cb4b0c55e9f818a2d9622feb58edef66bae", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680681559, "uuid": "bb638259-3231-41d5-8f3e-6ff613730e5d", "comment": "Malware payload", "value": "0762456207fe259926b55dc4125872d27813efe5", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680681559, "uuid": "e43a13f5-7e2a-41a6-9f40-3221b8ca7fb5", "comment": "Malware payload", "value": "fc4740648423022048f6958f1651b465e52412a77586cf3f13468b4584efc7c7017c496ae6dedea1f4a15ff42b7fb0d5", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680681559, "uuid": "afdff276-65b8-47ad-b817-ebd1c5a4c48e", "value": "T181453A666F300026F04953341BD17B2372B4FE5677A28551325ED7684FE9ACAAFB08EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680681559, "uuid": "2f28c8b7-53a5-4d58-b873-233e627b0c96", "value": "192:Q55E9TfDuvjkWamyEaIn0mRGGB3w1T6iIk/+LkXvQn+D:7ToYHsnjGGu9ck0kXo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680681559, "uuid": "a6b6902d-9a80-452f-ac28-03907800cda9", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680681559, "uuid": "77d14833-14fd-4f5d-9eac-5155f5007356", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680681559, "uuid": "70c74989-5575-4c0d-b5aa-373886b46008", "value": "20230405-0710.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb776652-d3ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1680703528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703528, "uuid": "f3679064-52d5-4cc0-8e60-56b917703643", "comment": "Malware payload (DCRat)", "value": "2c3c033eb9c95f58266ec36ddbec3ccf", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703528, "uuid": "ca6601a5-2360-42ee-a041-bb63ae4b1a8f", "comment": "Malware payload (DCRat)", "value": "cac5e721ebab52f115afc1511ae662f9ecdc8166640054e329b1855388a314b2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703528, "uuid": "57396d9c-8d82-47cf-a48e-f0478cacad00", "comment": "Malware payload (DCRat)", "value": "4c70bc0884dbf3e73700676a17ac4a4b07d6ff3a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703528, "uuid": "86b4ed93-260f-4ee7-ab69-73dcc91b5a30", "comment": "Malware payload (DCRat)", "value": "90b55b7ba56ac9a93b9d8a80a24e5e059faaeda8c772557a507b381c3e501fe53a23c1856d4b374c745801f9d57c1216", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703528, "uuid": "574918a1-c8e3-4b92-ba71-0e97f5009c29", "value": "T15E654A023A84DD11D0295637CAEF851447ECFD023B62DB5BBAAA336D65163A35E0D3CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703528, "uuid": "7a5d037e-283a-4a3e-aafe-c75022af75fe", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703528, "uuid": "8173cfac-e462-4d75-a26c-626ac1beb112", "value": "24576:U2G/nvxW3Ww0tMDDgvL04k/MWJHVZXWE9WSeJH1iE9iu+4K:UbA3020j0BMWxYn+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680703528, "uuid": "6da08a9b-58a6-48eb-aec7-3cd2e2e38d04", "value": 1441998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680703528, "uuid": "3e8e80b5-db70-46da-adc8-def69b80794a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703528, "uuid": "d8b6f913-2d22-4f5c-81fd-ac22acd87b77", "value": "2c3c033eb9c95f58266ec36ddbec3ccf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68e2d36-d385-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680680676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680680676, "uuid": "6c8e9fe7-536b-480c-8820-4a277407736c", "comment": "Malware payload (AgentTesla)", "value": "7eb0cab3cd7c2ad8f5ba3721201cd610", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680680676, "uuid": "36da48d9-a987-4586-a266-8fcbd5a7e12a", "comment": "Malware payload (AgentTesla)", "value": "caccf31a032419ab433e8050d034b255476b73a7c9f3be0e6878d9385a04fbdf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680680676, "uuid": "b264795a-6004-4676-8296-ef041c9b125f", "comment": "Malware payload (AgentTesla)", "value": "2fc79be9f00f64b35dff4e7e9a88e437818b431a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680680676, "uuid": "367f90ad-be2d-482c-bf33-22ca57526c1e", "comment": "Malware payload (AgentTesla)", "value": "8f75e4c11461c724801503c87d47670be5b463426f4d3db42724cfa6743ecb75fd6d6b6aec88d6d45b822f20566ba89b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680680676, "uuid": "b3e2b778-af6d-46e1-bd35-730737fe6a45", "value": "T1856422647AD0C0F7E85253336ABD87472BFADD112868162B27967F09BD12042FE6A7D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680680676, "uuid": "94d9a9c1-1a93-4fa7-a748-cad7ba302ec6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680680676, "uuid": "57ffdad9-3ec5-4092-a6ca-21cc468fa2c1", "value": "6144:/Ya6KIdJ5qH0/i0/reQfxxuvqMX/aCXRq6j2L4jeuvVsgjYbZ1Zrm8:/YkIdJ+0/XzeQf5CXR+4jeut9Yb1m8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680680676, "uuid": "3e597ce5-60e1-4b4d-9ecf-bb1128475327", "value": 325337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680680676, "uuid": "fe5ea06e-6b65-41a3-af32-9a980785723c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680680676, "uuid": "70f3e6d6-f0bf-42a1-b676-8c9d3c4dcc46", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13d3996-d3e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680721523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721523, "uuid": "a5671fc0-f0c5-4b32-b202-d2b412036cc3", "comment": "Malware payload (RedLineStealer)", "value": "5184f2fecad5dfa4e1a8bacd693940ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721523, "uuid": "e831116f-7728-41bc-bcbe-c7b145705372", "comment": "Malware payload (RedLineStealer)", "value": "cb14b23e8d0bf9607650ef874c307119d73870a430e6ddb6dbb5493b946ded53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721523, "uuid": "9c113344-59a4-4223-9908-aa7b261f79fe", "comment": "Malware payload (RedLineStealer)", "value": "79d61da0afd12a16be9b604481f715952f4ef759", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680721523, "uuid": "8a108daa-0c56-4ca0-bcda-afb3b0b61664", "comment": "Malware payload (RedLineStealer)", "value": "a1b1c4d1fed0b6e55d33e4bca0c9ada694995b018fc59c36201156ef4e3247a953f251937b976dae1d9c383e92adb54f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721523, "uuid": "9b3eef59-334a-4b7a-8850-ec1be559c66c", "value": "T127E41202BBE54433D9B42BB0C8F652C30F3A7CA59874575B2B86A95F0D72B54A13273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721523, "uuid": "8927065d-c6cc-42bc-af99-4dc92701c237", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721523, "uuid": "89741984-f41f-4e51-8264-5611a60a8cd8", "value": "12288:bMrxy90PKS76JcubXojeFv3apgG1qar87ahAPQCi:6yIscucKPG7CahAPQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680721523, "uuid": "4459ff90-84ac-4b25-ac49-8dda988bc992", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680721523, "uuid": "2eb69889-6801-4106-891b-fe125c5a98a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680721523, "uuid": "f2612337-3b87-4429-a48a-6bf591be2af0", "value": "5184f2fecad5dfa4e1a8bacd693940ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3e0ea9-d3a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680695637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695637, "uuid": "ff213611-ed11-4214-a557-5d2fe9af7ba4", "comment": "Malware payload (Smoke Loader)", "value": "7b69e335ef2c5a826a62a95397cd09d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695637, "uuid": "6384cdb4-5ea6-46ab-aaf4-c96dce1b363f", "comment": "Malware payload (Smoke Loader)", "value": "cb304eb916410c4194d4c4b1de902dac1821256428fc989e53046ed613dbf69b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695637, "uuid": "0e1e4b59-cf4b-4c1f-9096-540d76cb925d", "comment": "Malware payload (Smoke Loader)", "value": "97b68b63cc7d8ea6c259b8409e3bfa6e145ae4c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695637, "uuid": "55d6f061-05d8-46de-80e4-f3a1f743719b", "comment": "Malware payload (Smoke Loader)", "value": "a2735e5b8bc3b44bf780f79772d84232c0a2f076ab12c4929924306ef9ffbdf3d087defa1a4da2b6dac42ed1c26be870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695637, "uuid": "0dbb5856-bb92-4be5-973a-a6028f149f1e", "value": "T10E44C0217391C872E85641354835C7F46A3AFC714B694ACB37882B7F1E31FD2AA76346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695637, "uuid": "734e658e-fc9b-49ab-a9ec-127ca4e0c65b", "value": "d74655147abdbbd28f9cbdc19367e2ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695637, "uuid": "1845b730-6a00-4df6-adcf-d8fea7314903", "value": "3072:21Be9ncTUXVtExkyLnbAZYNKB/SLAZeeFaRfVqRLeTkdfSc27gL16m6j5WTYlXIC:mBYnDtQkyLbAZGKBqWqSiTkdqo6weY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695637, "uuid": "b03261f7-0e2f-44b7-9234-1e802bc98efb", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695637, "uuid": "a51b575b-8628-4833-925d-3639350087f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695637, "uuid": "6f4b0f2a-59b1-4a31-93ee-cd78dcb3c1f4", "value": "cb304eb916410c4194d4c4b1de902dac1821256428fc989e53046ed613dbf69b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9848cc-d3aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680696495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696495, "uuid": "49d837f7-e293-41eb-8d9f-7d6c1afc1bdf", "comment": "Malware payload (Loki)", "value": "c2479b133d93802b4bc5a83628caca1e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696495, "uuid": "5f9f49e5-6b89-45ab-88c4-441c43d9536d", "comment": "Malware payload (Loki)", "value": "cb49e9fdb4c26d8b3e86a9a3d575d9d7bba75defa1477f42f99de95d95fa2e6d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696495, "uuid": "e10e97b9-21d3-4510-a987-50286ca1b614", "comment": "Malware payload (Loki)", "value": "c490b8eb932d4787f58c60afd89f1eebda177022", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696495, "uuid": "954f3ed3-2e59-40ca-a178-6e7c3a5acbb8", "comment": "Malware payload (Loki)", "value": "5efd11fa76c76626434654b6922f6f01fa08bdc437c7600002bafed0a682136bd102fc29b85b08ee53ee8ca552b4a14b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696495, "uuid": "518b8aaa-3b2f-4a04-a0da-62b026de8e45", "value": "T180350113A600CE0ED9068770AFA7A8E9420F7E547D9DB48B21057B5F2EF3E11B907E59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696495, "uuid": "5fa7ad76-ecbe-4efa-ab58-30662e8f27e4", "value": "12288:w1taFiKXK0qUu9VnewppDArDqUu9VneqqUu9VneVpwPArgqUu9Vne6ArSh8ZAvYC:wGLKyu9V2u9V/u9VXu9VEwNLfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696495, "uuid": "bfed6e57-096a-4671-add3-8b9ec614f305", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696495, "uuid": "ad6054c3-3edb-4581-8e75-4b3f05b301be", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696495, "uuid": "dea528cb-3ced-4293-931b-666ab052fd97", "value": "QUOTATION FORM MV. CHIANG LAAN TRADER.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b85eb3e-d378-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680675047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675047, "uuid": "39f0a026-c220-445f-ac8d-41ca6a92e2b4", "comment": "Malware payload (RemcosRAT)", "value": "75432ee33c929721517472be79868d9d", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675047, "uuid": "010412f6-0ec0-4e28-b3f0-cad87297ccd5", "comment": "Malware payload (RemcosRAT)", "value": "cb4cb300f2a793164f42208b0e799e775c80521b464c729b929f6043ad88329c", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675047, "uuid": "42eef739-a9bf-4b60-8800-2e2edd44c39f", "comment": "Malware payload (RemcosRAT)", "value": "816897a54af148a7cc305cbbb00a165cee686eb0", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675047, "uuid": "fdb00c6e-1aff-4b84-9e45-3352492765d9", "comment": "Malware payload (RemcosRAT)", "value": "ff3ecd6cccba9e688652f8b816b811f6686a2dc685a4e452ca088aa0892d4250d27326c3ec1fbeb945f8cc7ed0e3f0e3", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675047, "uuid": "5c2dc3ac-4e43-4ca2-9c19-79e71ae2462b", "value": "T1CB15339C3E480826B732803BC4B68346DF253572B6BB4B244FF765E99DEDC180F65689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675047, "uuid": "172d7ce2-71f6-481c-9210-5e11a72a4291", "value": "24576:0TUwQfIoJ6p8+IsBqMkKJ8f3j0UyfMexEAm9JK:0IwIfYmyZJ8RyfMe3OK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680675047, "uuid": "dd9ad274-d6c9-4770-8d38-aeb8436ebff2", "value": 890818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680675047, "uuid": "6efec59a-5faf-4d31-82c6-a8a747433b31", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675047, "uuid": "414d432d-315c-4ecc-ac5d-94a888411c4f", "value": "Shipping Documents PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf58e152-d3c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680707776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707776, "uuid": "5c2a64a0-f262-4b09-a73a-a6f9b2b5778a", "comment": "Malware payload (Formbook)", "value": "c6015609a495ef992ae14cba63703d8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707776, "uuid": "9e0f7bd8-2300-4951-9c05-527f10747581", "comment": "Malware payload (Formbook)", "value": "cc137e83cd1540c8025151f56b4f667de6c89e605f242ec77a709ca7672daf78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707776, "uuid": "8b65a012-9cb7-4815-817b-cc0d23306ea0", "comment": "Malware payload (Formbook)", "value": "fed8f6cfcd69ef0498afbcf443852b74a97f6b98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707776, "uuid": "e3813aed-987b-4524-8d2f-d33f749dc48d", "comment": "Malware payload (Formbook)", "value": "46aa098e17bb13b6f1014a0853f9abe5ac3c0443020fd0da942758b54d43b9b67590492a813468f0d6c01e98aee66cfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707776, "uuid": "0cff8c39-89a4-4832-b12f-4dd1f4702dc0", "value": "T14A05AE23F1F20833E0730A3A5C2E6A59983A7E103978E9466BE4FD4D5F3B2517925397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707776, "uuid": "60564940-90b4-4a32-b17b-736b2a8d7924", "value": "7a1f03aec8b2c813fb23d7a97335ae88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707776, "uuid": "815728da-d2d2-4ac3-ae8a-e768668c20e5", "value": "12288:AkqyglaEq3vgPIzZpurCqayn2zetLP+L2/WXwCuiglvLFB7u/GFI3dSq0j:AkCAYIzZpurCqaZ8/EwC/gFJgdS/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680707776, "uuid": "0d0e1be1-7a9c-466a-8b33-b4189b99baf5", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680707776, "uuid": "4fe8b673-186c-419e-bb1e-ae62ead39a04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707776, "uuid": "87ba5b64-afff-43e2-8fb1-af97a8e1594d", "value": "z6003423242462235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2c9950-d34b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680655640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655640, "uuid": "bcb57d1b-cddd-4328-96ca-6c8df178856a", "comment": "Malware payload (Formbook)", "value": "e1ee12ca06b9c3b7649b9535749cf03b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655640, "uuid": "63a06816-ea02-4197-ba42-d5c97fca1bce", "comment": "Malware payload (Formbook)", "value": "ccbe33341a3bdff6ef98b11b040e78d1b583a47371fe432947e924c2dec9261c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655640, "uuid": "d528ecb0-f042-46b9-8dce-aeb076b6f444", "comment": "Malware payload (Formbook)", "value": "7fca1fb8462bd809dd83f10725358da08786214b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655640, "uuid": "c419ecdf-dcd6-4df7-b67f-be1ac51141c1", "comment": "Malware payload (Formbook)", "value": "a88d45b95d8feeffb3bc0793b8c37dba5ffdbd02caa8052e0faa34caf6484f6a73dcc07ecc5412f6905747b57b34c59f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655640, "uuid": "d12076b3-426b-4501-aaa8-266bcfa8ede3", "value": "T1F6C215565B8C4C61F26AE877865EE00E48BCF63234C255C4BC9DE3757B3D14E0BAA1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655640, "uuid": "449a6672-5a3d-48a0-930b-3d85d2e333a5", "value": "768:wVXcqAHs9tv+2MVzIeOuD6sDeHQjjVPrR2te6fXfZWafgSfA6DaMcv8:wVsqAHYtoVzI7i6sDeH4hR2te6XZVggx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680655640, "uuid": "c7918763-b1bd-4199-9168-e3fadd7b26f1", "value": 28109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680655640, "uuid": "eccc67c7-4dfa-4ed0-adb9-b0bb76291531", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655640, "uuid": "185887e8-e27d-4582-ac1a-78ae67f42eb3", "value": "e1ee12ca06b9c3b7649b9535749cf03b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf803f5-d3fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680732330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680732330, "uuid": "299307a9-4727-44e9-ab8c-52d29f9d9a7d", "comment": "Malware payload (njrat)", "value": "b78cd9995a8baf17ca3996be6dd90eb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680732330, "uuid": "e7cd7012-d344-4b3b-b064-3039f0d84ac5", "comment": "Malware payload (njrat)", "value": "cd451f6c8dcbe184b65729c0ec8e73b4cabef974c4a673fc2e79d64a096ff099", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680732330, "uuid": "5abb7f77-352f-408d-b8a0-e3b96c605c62", "comment": "Malware payload (njrat)", "value": "51f9450b78a40edda969357451c5a70f65e858ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680732330, "uuid": "e1e1e7f6-ab90-4ff7-8915-1de4a5da18f4", "comment": "Malware payload (njrat)", "value": "555b2f7e27096f5fbe017246c44db0c9cbc3e340dcac9adf6b46ecb785be1f21b39aceeaa2b7722670cbc0c88f0bf636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680732330, "uuid": "0c56bb5e-ddea-4f8f-b267-50bbe31ed5ce", "value": "T165445C4BB68659B1CE4C4776C1CB652083A1D982BE33F60A7D8E13D64D033F9AD45B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680732330, "uuid": "a071c2c0-fc1d-4227-942b-f3ee8ebe94a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680732330, "uuid": "c1f55b2e-dc5d-424e-936f-34efb06cf030", "value": "3072:JtgaPlhlBtSP7xtnHJDt6iw1BOEhqLivY946NYPr2bKCln4d8TM/q1l42/b8wnEK:ZhlmP7fFtpc08jgeC+ClnE8tI2DZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680732330, "uuid": "9d815bf2-f212-437e-8c66-d512c015b65b", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680732330, "uuid": "d485128a-cefa-4e8f-ae43-2a2ead5f20b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680732330, "uuid": "c2b886b1-ced0-42a9-a3da-6d0c40c6726e", "value": "b78cd9995a8baf17ca3996be6dd90eb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f14121-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680699548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699548, "uuid": "c0957831-4762-43ab-85ff-b2b7aa51fd8d", "comment": "Malware payload (Loki)", "value": "b71e35143108b3976555abc26e1d4fbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699548, "uuid": "397893c3-57b1-4837-b717-35dd7d038f5d", "comment": "Malware payload (Loki)", "value": "cdbe576f292ac04f3b0c033f2d20ebfdcabaf2088357941e494ef161e2f55b11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699548, "uuid": "29dacb7b-8a1a-4202-aea5-1d7d0e6e830f", "comment": "Malware payload (Loki)", "value": "1bd0287ba76e196a1e55782b7ded2ebcf257f33b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699548, "uuid": "d8d1d406-f95c-48c4-9a86-c66029bd24c4", "comment": "Malware payload (Loki)", "value": "b07fe29764b01ee9f960bc2a493791bd0c9b35aeda44c666000e2d387e940c13d40928de13ebfb34e896dff143e20aa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699548, "uuid": "4d002399-7a54-4bd8-963a-05d1e8ee9da6", "value": "T144C4129223F98B31C99E0B7BED93304043FAFA2A7461E71D6CC664EA4D73741CA52593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699548, "uuid": "5bfe5adb-9312-4e1a-ac2c-8a566b076bf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699548, "uuid": "d3076b04-bc27-45a9-9837-d2ea9975711e", "value": "12288:qZVavDZPtY/OSwvq0y/fLch9jyQfh0aHblIla:qZVatPtmIhd7e6Ila", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699548, "uuid": "d27327f7-69ca-442c-8477-9a93d4b7ff31", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699548, "uuid": "0f6939e2-5e59-478d-af03-29f1579f872b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699548, "uuid": "21b06bb2-8375-46e2-8873-ab0576a631c6", "value": "FedEx shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a915156-d3c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680706748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706748, "uuid": "8449f7a4-dbac-447e-9297-0e53bbf5f66f", "comment": "Malware payload (Rhadamanthys)", "value": "80613a5b97fbe41d59d7e204b07cee62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706748, "uuid": "a6c08353-38a4-4f5c-ba46-0ed0916aa7a7", "comment": "Malware payload (Rhadamanthys)", "value": "cdf3769ff60af93c67c52ebd0a532c40a7df454bbb217f35e8035f5e3ec4bc21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706748, "uuid": "4c6af545-79e4-4735-a239-60fc763042d5", "comment": "Malware payload (Rhadamanthys)", "value": "10c85ae9506fe4594b36ef0f14620706fef921ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706748, "uuid": "a810aae7-343c-4cbe-a62a-e1cd69fef062", "comment": "Malware payload (Rhadamanthys)", "value": "87fba8c2075e513bfb44cb1e90c5a85b1a3045f3d9ca0b27adac4f4fb4317e20cfba53f42c59aa10096bce7040f814e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706748, "uuid": "d8a9cbbf-361f-4d59-8951-efcbbddfa1a3", "value": "T15B44E011BA91C873C62681B45424C2F42A2EBCA39B5696CB37D87F6F3D313D13A76354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706748, "uuid": "d46d44c5-14fd-48b4-a6a7-07dce56fcd7a", "value": "75c9ce7658f5f9697d0dba7dc400340b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706748, "uuid": "4ac31acf-dce2-49a9-b7e4-2c04aa7eb7ba", "value": "3072:oe0ypFDTg7swaJfoh4pqMN59p4AKnqmAhukZ3lMSABGk+jOuitXmhlaK55rJuTIx:yyHDTgraA4pjKnq5ukZaJok+zCorJuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680706748, "uuid": "19a65266-0580-48ca-b6d6-73d16db4d275", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680706748, "uuid": "be719e27-6ccc-4b4b-83f7-c8b8e935e5ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706748, "uuid": "e1c88144-a55d-442f-bcce-b7f9540c5ea7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c549d1e6-d3ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1680698310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698310, "uuid": "42557236-82d7-4380-b349-f653a61880c4", "comment": "Malware payload (Quakbot)", "value": "dd27c04bc998f69467c2c81c53a111ab", "object_relation": "md5", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698310, "uuid": "a0a8cf27-33a1-4fb1-a7ed-ff883807368c", "comment": "Malware payload (Quakbot)", "value": "ce0b6e49d017a570bdaa463e51893014a7378fb4586e33fabbc6c4832c355663", "object_relation": "sha256", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698310, "uuid": "141b942a-130e-417f-8983-429cd18df097", "comment": "Malware payload (Quakbot)", "value": "3e09fbba03859f0b59059e160109d5a6929182e7", "object_relation": "sha1", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680698310, "uuid": "cc9a169a-87a5-4927-b360-a94e9a23b224", "comment": "Malware payload (Quakbot)", "value": "34af668b8efff562266047550573ef077d45f85aab51854b40cc455b8bf8f570b655e71a6b340df53315f386235b5ba5", "object_relation": "sha3-384", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680698310, "uuid": "fea6bfd1-117a-41af-b7cb-6811dfe247e7", "value": "T16D93F28A4182D82CF8A97926E4CDBF35C16D588F40D3EE796E4364CDD0DEF26E01465E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680698310, "uuid": "a6bacee8-8930-4b99-b759-09a10af2b149", "value": "1536:WdCSCOMKd6r0v6fLvtmEE1VhaoJjZ2U6is9gcbPG+sROdSbnjO+nrqoOC46WM4:kClOTwr2WLAEE1zz2U6tgcLgoMTq+nBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680698310, "uuid": "b20b05c4-6780-4507-baef-ddabf2b6816c", "value": 91315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680698310, "uuid": "d02c4807-4277-4cea-9a94-9671c9eb470d", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680698310, "uuid": "a3a707a8-2624-43af-a523-13abdbb9090e", "value": "Necessitatibus.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b041dbd-d3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680697729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697729, "uuid": "5cbf9518-dcef-4e53-9d77-8bf818ebec3d", "comment": "Malware payload (RedLineStealer)", "value": "9f8b4a271f26a2d4c926be54745cf57b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697729, "uuid": "786b12e2-5baa-4da0-9fe1-f1183a87e6f3", "comment": "Malware payload (RedLineStealer)", "value": "ce57cc598ed2b9f15e9f5e313964ab025e66326daef978279ee15c0668d6c6fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697729, "uuid": "8e46a629-3db2-4d80-a309-93ab16e69a10", "comment": "Malware payload (RedLineStealer)", "value": "8fca36da58da369618edf5c31cef8ae6eef9e5ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697729, "uuid": "acb2eb30-b46e-4a4b-a8cf-b99f349d2a25", "comment": "Malware payload (RedLineStealer)", "value": "faa9841217fa45e4cd7baf8e1fec23763fdedb80fad8c0333ca098ce7d59ce29a5332826eaf242924fd3251e87dc297f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697729, "uuid": "c38b51c8-c0e9-43cf-974d-4a82f78c4ccd", "value": "T1E3C41212B7D95533DC7117B048F602C30F36BC62ADB84A2B2391AC5A1CB26D69572B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697729, "uuid": "f092c168-e070-497b-b207-7a3aa134cf25", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697729, "uuid": "83cbf2e4-fa0c-4659-9253-bb912709d82e", "value": "12288:aMriy909p2jq9uFD3op+wtXoOWggCMOlB86va93E5:MyQ8suFD4F9o8gCMOlBDvSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680697729, "uuid": "aaf245dd-aec2-4f38-9f07-31a4815c9310", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680697729, "uuid": "e6f11dd9-ddce-4093-aeef-af841dc88e63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697729, "uuid": "2f3eaf96-928d-45fe-9750-412226948005", "value": "9f8b4a271f26a2d4c926be54745cf57b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605c0e31-d3bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680705442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680705442, "uuid": "1a7cc420-455a-4e8c-b5e6-896c5b2a2c5b", "comment": "Malware payload (njrat)", "value": "caa55ff418d7be81b9f21770e6c69a0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680705442, "uuid": "3ee775c1-832a-417a-b308-094268ec04c8", "comment": "Malware payload (njrat)", "value": "ceb664af1544013b77f703604fda32a9bb25378dec12b9b8b007e7aa2d2d9f73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680705442, "uuid": "a515dbb7-f222-4e3e-8592-e3be4524dcfa", "comment": "Malware payload (njrat)", "value": "65e9a4f30ece6a78940ab22e6a5f319210e9516c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680705442, "uuid": "640e11bf-016c-4ca9-b181-ef6f76ab855e", "comment": "Malware payload (njrat)", "value": "6c2f69dc355986b1e6a8321be18510351f3c4821934d534d01858dbd33c2cd16ea758f3465df3a7fabc69cdaeccd7b97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680705442, "uuid": "10e5008d-f881-4d64-8553-06b62d9d27b3", "value": "T112C2395D3BA08176C2EF6BB406B2D72102B2E2075A27DB5F4CD840FA5B777C04D81AE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680705442, "uuid": "5bb749a2-51db-45f6-bfaa-399306b610c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680705442, "uuid": "dd96efc4-d4c2-4680-848a-cf0d100bb88d", "value": "384:4Ld6haZIVi/dMkt1cpDkjetHzCYe/4Y2OzRLTm3yilqr63sbbtVvGf:Gw0IVi/dMc1uT5e/4sE0VvGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680705442, "uuid": "54b5fb46-1e2d-4776-afb5-0422e117ab6d", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680705442, "uuid": "3e78f955-eb87-4657-aa1c-f921fe1a8abb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680705442, "uuid": "065a20ec-6987-45f1-8d18-2b191cd4d253", "value": "bLm3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220d676b-d3dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1680717793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680717793, "uuid": "012d8841-9559-4075-8938-6b7678c43cf1", "comment": "Malware payload (Quakbot)", "value": "a5c1fb3cf829fd4d472393dc17a6a20d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680717793, "uuid": "81ac0aa4-1d96-459f-8224-b218ca7f8989", "comment": "Malware payload (Quakbot)", "value": "cf80250331d0634e51c05d1f5e58c5b946bb5d5996acefa9cac04f74dc85c361", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680717793, "uuid": "8b8375ff-9b15-485e-a91f-b371ed9af65c", "comment": "Malware payload (Quakbot)", "value": "e2d20baed51e55086fe19dd947a1a0b3cd01f9cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680717793, "uuid": "a81ebd7a-e90b-44e8-a343-d7daff7c2d4f", "comment": "Malware payload (Quakbot)", "value": "e20ffc5640b850a12df32ffe906d67ac9ac2c2b551d1929167db1db02b93cc460c35967ae491eb87eb624e52ff556882", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680717793, "uuid": "aaf2dd46-9034-430b-b1cd-5f2b7a9786c8", "value": "T11444CF43BBC1C475E4C701BF167D93F60E365A2C97A7DAE79F845590C8262C0B23A68A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680717793, "uuid": "eaba43b8-1715-408d-b653-d996a2eb792e", "value": "6773aa39021b4b6dbb81de5fec9e5772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680717793, "uuid": "d740ca3c-0d14-46c5-ae02-da669eb3a2f1", "value": "6144:Ie73XJK8VCoxyusKqXk3gykDeTyFdchqbhIf:pJJCjKzQCyEMbhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680717793, "uuid": "459f6181-e99e-4aa2-821c-c6744fe67e5e", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680717793, "uuid": "1f954cf8-00de-4d09-9122-0f51f03d4bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680717793, "uuid": "fcd9c568-c7ff-4eb3-955d-1fc28f63d58d", "value": "a5c1fb3cf829fd4d472393dc17a6a20d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf7ee84-d397-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680688122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688122, "uuid": "f39f5a7b-a654-431e-96ea-dafd7e04e7e3", "comment": "Malware payload", "value": "9ec6c9114b1a0c12af4ab1bff275f894", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688122, "uuid": "f0b0f104-f0a0-48a2-b78e-ceaf88590027", "comment": "Malware payload", "value": "d22c86bd4512b14e3d0e8cd5a78911795461f3f793c7b18dd1a31362eb7e7837", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688122, "uuid": "41536fcf-34b5-45c3-8166-44f1002aff64", "comment": "Malware payload", "value": "e4d847e5eaf2c878043f0e00241bf2eb0ee02bc1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680688122, "uuid": "591df18b-930a-40f2-ac2d-60459215a00f", "comment": "Malware payload", "value": "2200326b51f5a63d7c0826bd6f5a00d62bc0ae088c11671ec69dba6f34bc4c60ff0d201b46ca84f16592b8f97b1e09a8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680688122, "uuid": "0c10a970-0f27-45a7-b329-9e8cbe83c271", "value": "T121B46CE6CD5C936D5098DB383C15F5A306BFE78E11ED6A81B1E5686CEB88C4520EC3D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680688122, "uuid": "5061f08c-a220-44a4-92cc-e69be3199e85", "value": "12288:ZAErwBN7x9cpAHr8TiKbtEzmUnMMS7nhHI:xwbr6Vy6UMhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680688122, "uuid": "e78db341-6aae-4bbb-a8c9-ce145f548e40", "value": 509306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680688122, "uuid": "2a77e55d-83c7-411f-882a-43a7261265ca", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680688122, "uuid": "ef72ed53-8721-4cdb-afbd-a12c0a98b6c6", "value": "d22c86bd4512b14e3d0e8cd5a78911795461f3f793c7b18dd1a31362eb7e7837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c87e8db-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680718267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718267, "uuid": "aef295f3-ad43-464e-bbc9-9e6b5920d071", "comment": "Malware payload (RecordBreaker)", "value": "1a33d56debae7b4604acc5e00cbfc9ad", "object_relation": "md5", "Tag": [ { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718267, "uuid": "0dac6046-b06f-4b12-99d2-9b14be3d1d15", "comment": "Malware payload (RecordBreaker)", "value": "d27240a8c8b0b8f0c01bda55ed52299c8945eb93a259e8d0baabf9061ae9c2f2", "object_relation": "sha256", "Tag": [ { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718267, "uuid": "df4d2f20-da92-4a60-8b13-bb2a59696e1c", "comment": "Malware payload (RecordBreaker)", "value": "cd079d2f7915c58c5768b3d3f77a006657cbb49b", "object_relation": "sha1", "Tag": [ { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718267, "uuid": "abdd7a58-6d66-41de-964c-376f89004d74", "comment": "Malware payload (RecordBreaker)", "value": "0c059d31a1b349c28bf6259c5b623dd686d1b32e9829e2d41a867895fa92062f4395145ed8bfc890d691e61a386b4284", "object_relation": "sha3-384", "Tag": [ { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718267, "uuid": "f6e3a0fd-4894-4179-809f-e01f4ac77c47", "value": "T1E184235177DC983E9BB20B7B6D8223F59F00C30AE369E199F6B48911354E5F93786238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718267, "uuid": "eaf443bd-203d-4cbb-996c-9ce219c9de63", "value": "6144:q9xPXcdTOdYjdTcBRqc1rFXs/r2QhpAfsKBgM9KBPWt571aBcHuqZ2cxY2U30BNr:xTYRfc/r2Qj949r1HHJZC330BNzBjHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718267, "uuid": "87063fe7-3429-42ec-957f-d163f061b942", "value": 402346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718267, "uuid": "49eeb511-a2e6-4e34-8680-b6fdd73195bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718267, "uuid": "90ef948b-fdac-4eb9-b3e7-f3fa714d4f22", "value": "U prilogu je potvrda narudzbe_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2309380c-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680718224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718224, "uuid": "8af4cf6f-8e4f-475d-91b7-7b5b3b50c037", "comment": "Malware payload (Amadey)", "value": "8d016b84d7d0d74c7c1fbe3b9ce291b6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718224, "uuid": "df11bf02-e13d-4af3-aebf-c115b0858db4", "comment": "Malware payload (Amadey)", "value": "d4557f4f84bd0062a2202a8cdf15b18558c270169eb6be516efcab635fc28e00", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718224, "uuid": "3ddf6b4c-968b-4f98-8b53-805575795768", "comment": "Malware payload (Amadey)", "value": "84654fbfb3a1131543cc1f282794fc5c01c962bf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718224, "uuid": "83df47bc-3325-4969-83f0-385109011baf", "comment": "Malware payload (Amadey)", "value": "b964657a646237b6f9ffe996be89c58cf9778dd6de6dc226c0eb102a8f6bcfaa6ffdbec87b175dbf100046474bb0413f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718224, "uuid": "ecd5244a-8aeb-417b-8d11-5051c9a9847a", "value": "T1BB35234277E88666C97663B080F140870F7ABCB2CD70839B678295BF5AB3AC4D175736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718224, "uuid": "8e9f7067-4eac-4261-9da5-c2ca0b673d33", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718224, "uuid": "851234bc-5443-4403-8115-cb40b3300cd3", "value": "24576:Ay/YXJ00h6DRJCmJImdrsbJEW2HJx9GXqcDqptpYQ+b6:HYP8RJPImibqJxcDqXmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718224, "uuid": "1b52c9f3-16be-4992-81ad-121f385a332f", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718224, "uuid": "f03bcc34-6464-4eee-9289-d07b5e5c4ab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718224, "uuid": "36955a35-f401-496f-b750-7bd58749b116", "value": "8d016b84d7d0d74c7c1fbe3b9ce291b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be43a59-d3ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680710186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710186, "uuid": "2607b57b-0437-401d-8a21-ada427b5abd3", "comment": "Malware payload (Formbook)", "value": "14d3999a87bbc7e8aed41e0609fb1a98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710186, "uuid": "16a9e7c6-7214-4c66-be5c-abdff67c8c91", "comment": "Malware payload (Formbook)", "value": "d5d72f46517a26b05a5427b0ab8c8264f88e0428cfaeff06f34e7a69ab3c0d3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710186, "uuid": "a0f7c157-2def-4a94-b360-1213fb710fd4", "comment": "Malware payload (Formbook)", "value": "65de9d958d4a655c404984e87e6317667c03dad1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710186, "uuid": "4f3cae85-c5b2-4900-a596-53756c7cc9e8", "comment": "Malware payload (Formbook)", "value": "319dd3cbbefd065c62849cadea9c00a0ae539a83dd85856cb31a19d10925880f83978ea5387b48b047920ca68c5123b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710186, "uuid": "8ea26879-7e79-457b-9c15-d749bc5614ac", "value": "T1F8A4F124E187C806EF50D63E703D56DA259C6FDC8C3D4AD61B9333D6E9328A1F05BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710186, "uuid": "49ebb40a-bc77-470d-9ad8-29982a759c53", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710186, "uuid": "f33f9110-a1ec-4e84-9c77-d86beccad30b", "value": "12288:WYqJQ5JyKYCy/L1FOtzhanqzW9tHcxikrdsRvg:WYr5JyNCy/L1yNa2WbcdsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680710186, "uuid": "b3a47941-0474-4a01-ad9f-63440250206f", "value": 493603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680710186, "uuid": "4b00dd2a-c037-4f29-97b7-512bcd27b714", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710186, "uuid": "c8fa554e-7599-434c-8dcf-5bcc3812d9d9", "value": "d5d72f46517a26b05a5427b0ab8c8264f88e0428cfaeff06f34e7a69ab3c0d3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ef34fe-d3a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680695790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695790, "uuid": "4c91b484-7ea6-489b-8831-71dcd201dd2e", "comment": "Malware payload (SnakeKeylogger)", "value": "90d4291aea29196901e2d9bae97581eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695790, "uuid": "d092179a-2260-4588-85dd-3aa9cee37904", "comment": "Malware payload (SnakeKeylogger)", "value": "d5e86309672a8e1e47bb674fe35761d8ae5c0091665ccf38af18f79afcc08e59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695790, "uuid": "2e58a976-978e-4a3d-8813-573b0d26d3bd", "comment": "Malware payload (SnakeKeylogger)", "value": "409fb2ef81c63cde20f61360074796b84eeb1409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695790, "uuid": "e9550a4b-fd66-4c91-8469-85927d27cee7", "comment": "Malware payload (SnakeKeylogger)", "value": "533ddb0457183e47b691f49b1d1b49845ae7ac13e2c9f88466bfcd36cd95386cd36e4ba069c245dd186ca0e09945d72e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695790, "uuid": "8db7a126-d655-469f-b106-80610fba0a56", "value": "T1C7C4121D67AAD335C6A903F6EC93256003B4F53BA15BFB2A2CD985E40DF734E8541A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695790, "uuid": "6fcc2952-d312-4b38-84d9-6bb46cdf81c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695790, "uuid": "c02d236f-a4a9-4986-8ff4-5314f5e7d0b5", "value": "12288:Hr7nTc7c+ZuHjdud680INBFHhs7Qmlh5ysyEcSFi:H3Tc7c+ZuHhk5js7dyRGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695790, "uuid": "5cc2fc0f-ee0d-488f-b1b3-88876d9c566c", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695790, "uuid": "8b54d6eb-88be-470e-88f2-90982e5c8fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695790, "uuid": "f938211d-5b28-4ab2-a02c-6d1410c1fee5", "value": "Confirmaci\u00f3n de recibo de transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77e41aa-d3d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680713427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713427, "uuid": "ccb2a149-7c2b-48ca-a8a2-8d7458e945a9", "comment": "Malware payload (RedLineStealer)", "value": "dd62c362564c541070dbd72b0df3dd22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713427, "uuid": "486f8521-c806-45c8-8b50-f5dbca2204c1", "comment": "Malware payload (RedLineStealer)", "value": "d5f325ef0964e86dd495350a43ee9d6caf2fce13375491dbadd25ed738ba3b4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713427, "uuid": "ce23081e-dd4d-49f2-888f-3878067b1480", "comment": "Malware payload (RedLineStealer)", "value": "7fcb883f6b8c60419c1dc90338560bfc551d926e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713427, "uuid": "692e44d8-4be2-4ee1-95f5-8791a23f3281", "comment": "Malware payload (RedLineStealer)", "value": "82decff6b75e3f903005a595f1d55671b0e7b5170fa739b82e0d667c68915ce2a283234f5780374f753d3b0cfeed43ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680713427, "uuid": "575c277c-cb6b-4178-8646-4d5bf4236900", "value": "T12B051253FBD88132DAF807F09CFA43530A37BCE64C680AAB3695955A4D32754A87173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680713427, "uuid": "10b39561-e4ed-4531-9332-ab6738b2f4df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680713427, "uuid": "2046431b-6b10-4cc1-b9e1-fb4ad3cca760", "value": "12288:HMr7y90VC0q/wlI/RWxHzwNQqqQ6ndhjQNiUUooW7r1mtZelGa8UQomMQv:syj0aw2sxCQqqPdhjQNiUUY1mvdJUZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680713427, "uuid": "806f5122-e67c-4525-a3b7-39fdac815e21", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680713427, "uuid": "0df4fb65-d2b9-44db-98fa-3bd2ed2c55b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680713427, "uuid": "af86d5ee-5e48-4d7b-8a69-0bac6f0b9f7a", "value": "dd62c362564c541070dbd72b0df3dd22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f372fc04-d3d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680713420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713420, "uuid": "9e79c4a5-5061-4d78-8d80-12fbfa29cec8", "comment": "Malware payload (AgentTesla)", "value": "58fe2fd1b7a715fba396bafa2130258f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "smtp", "colour": "#E64C5D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713420, "uuid": "b6f677c4-1a33-4bba-a627-131c06fcbcd9", "comment": "Malware payload (AgentTesla)", "value": "d68de15bc1f3f981401c8dc96e99f33c850f944327634c7c03aad252bb7468ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "smtp", "colour": "#E64C5D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713420, "uuid": "5bc5a381-ddc2-400f-950f-f536af009765", "comment": "Malware payload (AgentTesla)", "value": "19cf22df29f26ab587515e4f33034373af791f75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "smtp", "colour": "#E64C5D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680713420, "uuid": "6d9677bc-2f62-4d46-826d-da7d28cb605d", "comment": "Malware payload (AgentTesla)", "value": "f81548391a77fc670d2dd551c5abb289101e607cdf22423da43570f441a1446474e16705b1df6516251a6dd4e6ce4010", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "smtp", "colour": "#E64C5D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680713420, "uuid": "ce3e1638-331b-40ad-9f6d-605f501e63ff", "value": "T17E2533F5BE64548EC8DD593E8D19133AC6465DB87D05AF60D09E8843A8F600CC39AEFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680713420, "uuid": "c2d7067f-e491-46c7-aada-4d7b19777709", "value": "24576:yVMAtbfub8mhWOm6T08YD4vzt2kquGtB3t5o:yVMAFchE64hUvEkcB3tS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680713420, "uuid": "4bd7f130-d6cb-4c22-91aa-9f478d2f7bac", "value": 965283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680713420, "uuid": "76b709f5-802c-4f52-9da4-944eef512370", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680713420, "uuid": "adcbb3ed-eff4-4041-9234-5fad8ae01a33", "value": "TT Payment Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd4c1a4-d379-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680675479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675479, "uuid": "f0043833-ad8b-4536-83f9-1f5f8db34806", "comment": "Malware payload (Mirai)", "value": "0ecbe523f4646c9259c10e81793dac5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675479, "uuid": "cede3baa-4e4b-41f8-be3b-a44ea3b47571", "comment": "Malware payload (Mirai)", "value": "d68ff597e7d746883ecc0b5c2e7e3083820ddf864d7bcc15c70b6691415c8dff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675479, "uuid": "d83a636a-6b10-4eb2-95c1-dd708c71028f", "comment": "Malware payload (Mirai)", "value": "cdfa251a54f1bcb34b18074920f082425083e6dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675479, "uuid": "ea76706d-ff1a-4529-830e-cccfaab12575", "comment": "Malware payload (Mirai)", "value": "7459805684fe59e967c5624b26b88b2c313b9ecbbf4a0e43b1b95b237c5f69e624e53c99ca9d330cf30f05c40b0ae71f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675479, "uuid": "83267ef0-b475-49b7-9363-01f55b0c60b3", "value": "T18C130220A49B2691CC411535EF5F056C2A2ED39C517BB9B507108FBDBBD3EB22BF8066", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675479, "uuid": "35ad174d-29e8-42d5-938f-73c2ef51e0b5", "value": "768:wfhgRq6O6mgS/2DsKJNHuCYtDD1ZBkDInpQUw67PbgGvBmZlfUbSj2FKxkYhI9qf:wV6OVTy3WCDInpC6LsGAlfzWY3L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680675479, "uuid": "74ac843a-ae96-4af2-9240-5319a11abfd3", "value": 44552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680675479, "uuid": "2b4e619b-ce25-4aca-85ae-1c96d3c16364", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675479, "uuid": "67095f3e-1d0f-4219-922f-2b40a5c1b0fb", "value": "0ecbe523f4646c9259c10e81793dac5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a01f4f6-d3aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680696278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696278, "uuid": "4cb8efb4-eda6-4ca7-b2f4-6a0629d50313", "comment": "Malware payload (RedLineStealer)", "value": "4dff87a03899ae392abed2790d5b7582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696278, "uuid": "d073b97e-e899-415f-8513-68634d428a26", "comment": "Malware payload (RedLineStealer)", "value": "d7fa0cff141e4e4a3ed3bce2e2ceeeddce61e397005481c733e49bc33e8044ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696278, "uuid": "54666f79-30d0-45a3-b5fc-e5deb31c0e44", "comment": "Malware payload (RedLineStealer)", "value": "50119cc8c6ca2e2a2aa845d390fe6f7d805d42a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696278, "uuid": "a1e37c33-cda7-4610-8f06-3e141c958730", "comment": "Malware payload (RedLineStealer)", "value": "373b94d993fa310d484669ac66577d5d8dc0b87bf0ed638c42eb929e3f0e1ce44ea3931c42e89a43276fcd800c959bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696278, "uuid": "7f679bdc-cdc6-49e5-97c0-0c2c5285a02c", "value": "T11EC41203A7E88033DC75677018FB03E30B3ABD926DB8825B2791685E0C63795A57677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696278, "uuid": "0fab0e7c-0285-499e-95ea-293be3ada725", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696278, "uuid": "09161958-31e8-4b61-bbae-18049787d744", "value": "12288:IMr2y90Xvb8vQyy9HA822oagg2Ms2lGu0N1qUA8u:OyKb+Qy3fg2M398u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696278, "uuid": "8a5c7947-4b63-4a60-8505-81849f7269b6", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696278, "uuid": "ef402513-57c5-4441-9f22-396b3b956ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696278, "uuid": "8fafab44-89e5-49d2-861f-eeb7c4fef116", "value": "4dff87a03899ae392abed2790d5b7582.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b47018e-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680718211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718211, "uuid": "63ce05d2-dcd1-4d46-a2b9-6f39b578628d", "comment": "Malware payload (AgentTesla)", "value": "ebc23ca7b5e0e37a842120fe86c0005b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718211, "uuid": "4ff057c6-f8f6-4321-ba67-f92e9ae91964", "comment": "Malware payload (AgentTesla)", "value": "d9326c1ed6566fed68bf86b5b76363c90203b55dcdc4a41db28738a639a891ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718211, "uuid": "b4be21ec-db48-4be7-9815-2ed2bfe97c88", "comment": "Malware payload (AgentTesla)", "value": "0faeec734ccd1a4a73644e9ab93fabf454d1f814", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718211, "uuid": "988038b4-e7cc-4471-9a27-b099f77cb4ec", "comment": "Malware payload (AgentTesla)", "value": "eefe413db26e36c20749818ce8e7e290e2bd35e1b5c2dc2afbce6e16c5ae1fa5ff09199cadc11dc66608ee10d5951f24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718211, "uuid": "3e8a3295-d707-4d90-bbd9-bca4369cf168", "value": "T1E53412713970D8F2EB770B7018BD6A769FB2E6050094264B1744CFAD7A1BBC46E0B296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718211, "uuid": "7fbb10a9-ee51-4b27-b713-6ea34800df4c", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718211, "uuid": "eb66fad7-c84d-4276-b157-5afc2fd6237c", "value": "3072:pPjxQCdIyVliXEcrwGhWvi0iW9lkqfFjaK0zm1NHCQUpUxciEK6EIUudvCg+q1AZ:pDfeDMi0iWYSPiQUpUx95wWqmGbS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718211, "uuid": "60f9a5b5-9715-49a2-bcba-186324ec42e7", "value": 236360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718211, "uuid": "b5998b3b-48e2-484c-957a-f0694f7d5ca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718211, "uuid": "22f564d6-41e5-44ea-baf6-80133adba911", "value": "785b0132-e196-4271-5702-bc9b22c8a5af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414527c0-d392-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680686063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680686063, "uuid": "8c7d3241-0734-47a9-9f36-d92520519be9", "comment": "Malware payload (SnakeKeylogger)", "value": "fbd56ce2ba130bde239b233150038bbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680686063, "uuid": "b2df4342-c87e-4da0-92f1-6e1d3642fa6e", "comment": "Malware payload (SnakeKeylogger)", "value": "da9da68aedd7dfc3cb324b9c91c2e0ce75ecb7abc0283b1aea395022f277978f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680686063, "uuid": "7f0d2631-3038-46ec-8da2-470b960efa13", "comment": "Malware payload (SnakeKeylogger)", "value": "a094f73f5e64b418d77272e248396d6408281ca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680686063, "uuid": "f8652df6-9532-4704-beeb-7d3ee29044ca", "comment": "Malware payload (SnakeKeylogger)", "value": "758158089e00efe6a823bfe6c85a00ccb35c64ed757458e694785a4d5b5e3f1cefcc3ffa0c67677422f5282a8ba1cd7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680686063, "uuid": "65e63e85-d624-4a78-aef0-51aa9544d120", "value": "T100054DD1F150C89AED6B06F2AD2B653024E7BE9D54A4810C559EBB1B36F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680686063, "uuid": "cd58da92-efa4-4559-898a-29119323e1b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680686063, "uuid": "ac22c1f7-10eb-42f0-aa46-e20be85c5ae3", "value": "12288:WrC5DaoD0xYcfMy894bCzHbGb937bkNA:WoDf0xrMy89Dj4nk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680686063, "uuid": "dfd728ce-b142-4854-95c9-0447b857f266", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680686063, "uuid": "94eca470-3f03-4fcc-aac8-d441e01c53b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680686063, "uuid": "f23f8b6d-e6ec-4c81-9434-2b76e55549d5", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cd326a-d3e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680719457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719457, "uuid": "500344c3-3fc7-46e2-85ca-8734578a855f", "comment": "Malware payload (Formbook)", "value": "2cbf98dca4591be2b01be05ffef24342", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719457, "uuid": "004a4278-a083-45ef-8ab9-237349759fe3", "comment": "Malware payload (Formbook)", "value": "daaea957dac997ea926ef5e2626cfae73bb1541adc7b0ac76e28aef1aa96ab9f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719457, "uuid": "32c47dbd-c25d-4895-bbfe-abf3cbd6c755", "comment": "Malware payload (Formbook)", "value": "4c52993bcaaf28cdb1665efcc6d0a2f920109be5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719457, "uuid": "687f0e98-2d65-4642-b6a4-133ad35732dd", "comment": "Malware payload (Formbook)", "value": "c79e03939fb6f27d5aff7e5b9167db49697e4efe2d8ce8e5b62803c67786bb5ab9718513edbe2aaa75caa1697c8ae658", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719457, "uuid": "03145aa1-67bf-46fd-b0a4-9537c00c5d83", "value": "T188150113A6048D0BDA068B74AF67A9E8030F7F546E5EB48F21057B5F2FF3A11B846D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719457, "uuid": "209a0622-58f7-4fe8-a2c6-99d1bbd48eb2", "value": "12288:hwaFiKXKtQqUu9VneRs1MqUu9VneMAroqUu9VneFNAr7sBz5oxOfYYeh:bLKtuu9Vwu9VXu9VzsBdoxmxeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719457, "uuid": "20450953-1676-432a-8eab-bdcd8d4d6918", "value": 939008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719457, "uuid": "84b0c57a-240d-48a8-b42b-ef9d824f718a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719457, "uuid": "d553e767-4ca1-4df3-adcd-4a4ae2bbba02", "value": "AWB_CUSTOM CLEARANCE FORM.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664be88e-d3a5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680694285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694285, "uuid": "560c8637-85e2-499a-b9f7-344fa4286aac", "comment": "Malware payload", "value": "54367ad3ec805713362b5bb7a21eaa11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694285, "uuid": "5d5a66f8-2271-4e95-9a14-a1ab34a30190", "comment": "Malware payload", "value": "db3ac9c6b8a28a10f237a6a9f566eaf499452af56c8871ddbc65fee524cfc1e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694285, "uuid": "b759ccb9-ef69-4b06-b489-12763f948358", "comment": "Malware payload", "value": "a73fedfbecb3d468437765ef69a1357aed12cbc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694285, "uuid": "6edd859b-e606-4959-8adf-f58a748e151a", "comment": "Malware payload", "value": "4f08cc8c120fafb64107ee50e2acd4b10bc4e35c861574a772ad2cdc2013c2b61d14d305275bb1c951c25f4161aefd0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694285, "uuid": "80e7696c-4f40-4592-b066-62a50989a06e", "value": "T13B73940BAD56054BED2B6B36538F957DC9206E9843DC58F3BB8CBA7D2431FCD942A401", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694285, "uuid": "eb8aae41-0c7e-4520-8228-c36a29b238b3", "value": "75389a3ca7748904fbd520d734678490", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694285, "uuid": "2a12a19d-ab3f-426c-bffe-43e6619d7ec3", "value": "768:NZkTDcnC0Hiuk2dCDMLQNYlMkHuBicrSpAq2bguoNm0:Nq/cG+LQqlMwuBicGpAqvnNm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680694285, "uuid": "7cf42995-9067-4b6c-98a6-4b6d13b1077e", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680694285, "uuid": "e5e10b78-40ea-4f29-b0b2-0847b80afaa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694285, "uuid": "07bf94c6-f496-486b-a860-7eed1e62cc10", "value": "db3ac9c6b8a28a10f237a6a9f566eaf499452af56c8871ddbc65fee524cfc1e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bdb29cc-d3c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680708924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708924, "uuid": "5ebbfff8-cbdc-40a8-9b8c-a892ded12d3d", "comment": "Malware payload (RedLineStealer)", "value": "d539b20ba21090a325b74ba95d3c517a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708924, "uuid": "01ae1d1d-0b6d-40be-a5e4-8647c38486a3", "comment": "Malware payload (RedLineStealer)", "value": "db5f8ac767385c72f311c050fd411b824a6b42b6b92872a4d9ef133747ed7da9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708924, "uuid": "da6b9cd6-150e-4c73-a5be-030fc8ec5afd", "comment": "Malware payload (RedLineStealer)", "value": "3aa76b8c7cfe14ba388d5060d07252eb168e4a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680708924, "uuid": "533fcdc6-014f-4ce4-89d2-3ad4391ee9fa", "comment": "Malware payload (RedLineStealer)", "value": "ea0dcc6d2cd8597fc8d85046d933754ec48a6eaf5fe3330cbac18665bd6be916fecedb213d77b2b9f64968abb195d90f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680708924, "uuid": "47424e47-3868-4802-9aab-0e558df72715", "value": "T12335239565D00472FCF1673068F622830E35FD71BBB4862A2B45B42F5DB35A8B432B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680708924, "uuid": "970748de-27fe-425b-ad53-4505d1d6f10b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680708924, "uuid": "cad7234a-cfa4-47b1-8fb0-cbc5949c8488", "value": "24576:iy+1CG5q4PXX0LFvXo83mEI4lCFV2ZKoTv6hInFgGSm1y3mW:J+YG5q4cLFQ0mEI4CFKfTv6hInjim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680708924, "uuid": "cb2cd11f-6382-4d8c-8099-7996e54b6e24", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680708924, "uuid": "936f47da-cbb6-4de0-92d5-7ce1bef1d0a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680708924, "uuid": "92d55a0b-a3ef-4a75-b73f-a718731570fd", "value": "d539b20ba21090a325b74ba95d3c517a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6279e5-d3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1680697596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697596, "uuid": "2eae3ce1-fa35-43a8-96c2-43c05efa7cb2", "comment": "Malware payload (Quakbot)", "value": "643c36d3820bbc8c72bf52bbef5b76f5", "object_relation": "md5", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697596, "uuid": "9f4a5ab9-a79d-4e40-96c9-3293e2290415", "comment": "Malware payload (Quakbot)", "value": "dcaeb1df2170d704d700b9ab6a915987841345280a773739b27a1cd40f27cfd4", "object_relation": "sha256", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697596, "uuid": "f6ed7378-b2f5-4f91-90f2-cc0646cde815", "comment": "Malware payload (Quakbot)", "value": "e3c8b4c4126fddcb2487c977b1942e9b4ae8dda8", "object_relation": "sha1", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697596, "uuid": "0cd301ee-7a34-404f-8abc-3c5fcf1f6898", "comment": "Malware payload (Quakbot)", "value": "7be6d1a52cdcce95f0924a8490980ea9f12854175adf8a910968928b5ae5af8c84694208dbc0699851e079970d4e90cb", "object_relation": "sha3-384", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697596, "uuid": "7dd28014-bda9-4d79-9952-49be6c9a70b4", "value": "T10B34924087BA306917BB6B27D6265A50DE680A3E96448507F07E3385FFEE44DC2F49F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697596, "uuid": "c1879b05-72a3-4021-a8be-4915f0cbd3fe", "value": "6144:AYOa6wxOc3pS4csbp3DPwUqCLPTg3GeUm:ZOa6lwdDDPTgJUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680697596, "uuid": "25431a33-ffe3-415a-aeb5-8a5cd07a4f2a", "value": 236214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680697596, "uuid": "01638f53-fcb9-40ef-b363-5a73b1bb99ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697596, "uuid": "707c13e9-2ef4-4fb3-884d-42a95abc1933", "value": "StartApril(gC2193).wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c4687f-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680700437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700437, "uuid": "fb6a3010-f6eb-4c29-af64-e5bf6017b299", "comment": "Malware payload (AgentTesla)", "value": "05f158812e18568278e0d3ec650d7954", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700437, "uuid": "4d7cc2ae-24b9-4910-89f1-36efa65d8db2", "comment": "Malware payload (AgentTesla)", "value": "dcb3a5d3d2adb7550bd19587be413a919988f57f93860a58e97dae1ab9ace88a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700437, "uuid": "d3c9a38b-1d07-49ee-b202-3bb5533a287a", "comment": "Malware payload (AgentTesla)", "value": "c03f8ace9f6a21340d0c4273f07580e23aa2b818", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700437, "uuid": "1a0c6024-925c-44dd-b923-314f65460062", "comment": "Malware payload (AgentTesla)", "value": "89c22fc5e815973d34f5a455a0713c99b67886bea3e8a0023d37cb9e63bb65d4fd645e95dcbe2519bf82959a533f3530", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700437, "uuid": "8512b30b-2f36-4608-b611-c0cfa92b5ead", "value": "T103F48C2E8E14C2F4F6BC07B5D0D33F192EA409A647E6891CB97760D63B81B895C0D98F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700437, "uuid": "75411bd4-101c-4585-baeb-6ca88b89f388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700437, "uuid": "486c71b6-65cf-48ed-89fd-1ce7642e6a67", "value": "12288:mwFZwYN2iNhA7aLmK8B1VwdLvT/+6BTFA+2KOpxCF5olon2I:mwFZvN1zwI8Le9L+6rR2Fx6olo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700437, "uuid": "8c289cb0-68fb-4991-b18e-292d11207087", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700437, "uuid": "0f97ffe5-0160-44aa-8205-6d744a8f7ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700437, "uuid": "06d1c6c9-fa01-460e-a8d4-1d805e540745", "value": "05f158812e18568278e0d3ec650d7954.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da77a0b3-d3e0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680719820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719820, "uuid": "1b96bee1-5f5b-42c3-b629-d8be8e88a35b", "comment": "Malware payload", "value": "133e4f6b98875d41316522a8133d0742", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719820, "uuid": "e14dc1f4-944d-4fbb-aa2a-91466fdde9b0", "comment": "Malware payload", "value": "dd2aad2ad65b6173aa5894856f3a05dc6c1b065238815e2aca60965d45f54117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719820, "uuid": "4c9d0a7e-8a87-446f-bffe-35416021300b", "comment": "Malware payload", "value": "a16f05bf67c792fc5bd61a862e76a988051f0e2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719820, "uuid": "280fe981-c9fd-4863-91d0-9344ca186e2d", "comment": "Malware payload", "value": "0767b4df965e14228b19bf10bd317404cccfdab98d1d331cda39149eab7b4591b0a403933bb5d2a8034d0682525b31de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719820, "uuid": "690fc3a6-c4da-4d63-a841-c58fbf80a370", "value": "T1A7C4122D77396123CD4C49FEE4E6250B03F1A565618AF3D59CC206E929E3BD4CC229EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719820, "uuid": "0abc6db4-a7fd-4af1-a763-515ec4962bd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719820, "uuid": "df8bfa3d-3451-40b3-be0d-d0e0c12558df", "value": "12288:x0wAdhQtgRwi64v2oB2XflaxH/+2zDqMJQd4N3b0snt7c:nAvegRI4OxflaxHPhGwr0QtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719820, "uuid": "90c5e45c-b07b-46e8-81b9-ae6f6759e42e", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719820, "uuid": "335fd982-ed99-4c54-935e-fa605111e00b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719820, "uuid": "7cfbdbea-9ada-448a-b1eb-41b56696d629", "value": "133e4f6b98875d41316522a8133d0742.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62dbc3a0-d37e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680677529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677529, "uuid": "1f885ca2-011f-4e68-9b64-7117dd3943d4", "comment": "Malware payload (Mirai)", "value": "581940a3c2be71096b812a50e56df46c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677529, "uuid": "da79626b-01fc-4d7e-9532-765a523cef0f", "comment": "Malware payload (Mirai)", "value": "ddc42b7f45647125c659d08c7fe298cac47f79bae94a39cf1a91576f1a143521", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677529, "uuid": "0c6a5471-9b85-45bf-bc16-520c3e91654b", "comment": "Malware payload (Mirai)", "value": "ad6f552e920f757330c10e1dd048afa6fd3884b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677529, "uuid": "5340468c-582d-48cf-bfbd-b1c63e0b1480", "comment": "Malware payload (Mirai)", "value": "4b965ff29ade80ac08868639a131ba47d6e0b461d9448b2ea94ae2a24a6e97b7dacdd016e546f1b7bacf51aea914f018", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680677529, "uuid": "70effad8-d538-430c-be10-0fe64fa7ca1e", "value": "T1DF13F1DEC558BC50EE5D6C7E02BDAA61FA8069D1718B43258217CC4B7E6844FBDCC4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680677529, "uuid": "dee6a3f1-37f7-4213-b655-cf241e265e44", "value": "768:quHbLhz1Hhin4hkS3TWtVARXjNA8yan/QvGioYmVZcAYX3ZRWd:ZHfhi4hvDWsjAGIvfuZcJZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680677529, "uuid": "26dd8378-0ae3-417f-8ec6-ce21689e4049", "value": 43492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680677529, "uuid": "034a839f-65bf-4347-afc1-f973fa45f900", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680677529, "uuid": "bc2939ad-3ccd-4076-8e02-cc9a94449a34", "value": "4UU3hYu3wi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224f63bb-d360-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680664536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664536, "uuid": "dd0cf9ba-4d24-4edf-823c-eda04bfc4f1f", "comment": "Malware payload (Rhadamanthys)", "value": "0d59e7d7e996a61f8fabd546d1c0f298", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664536, "uuid": "542a64fa-b53e-46db-86c6-0b517e0a263e", "comment": "Malware payload (Rhadamanthys)", "value": "def37ed3e6ccca831f35008fcf829583d483939669a9bbc8410f9ce9fb303d6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664536, "uuid": "712d3688-e431-40b0-83cb-e9064c3e41a9", "comment": "Malware payload (Rhadamanthys)", "value": "c4d58ca0161a851784641d59d5179b3a28785834", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664536, "uuid": "d3175fea-7f74-409e-979b-0c4e2f4712aa", "comment": "Malware payload (Rhadamanthys)", "value": "3d3dded47eca2bda5a7f64c837cd6d6ea4181cccd7ae91595253e37404dfc0ded618a235922ced627f177a6a50fe8fcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664536, "uuid": "988377b0-9186-4dd1-884a-88d50869bf75", "value": "T14874CF1163E06430E53B0B319E1AC7FD2A6EB8616E617A9E17B5493F1E303A1E67371C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664536, "uuid": "16d2ac25-3648-47d1-a8bf-3a1304bc59ce", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664536, "uuid": "ad27804e-6ade-4639-bff3-7b21dd4f095c", "value": "6144:OHv6soVCMPERIuPJ4XvNDu+Iu+x1QAbRQaW:OHv6soEMP41mxu+IuopbRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680664536, "uuid": "d2cdb0f1-ac22-4e43-abad-5a00ec9211f1", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680664536, "uuid": "93c35b7a-c105-4967-b1a2-4de9aae42182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664536, "uuid": "1ed28d08-b9f8-4d2c-b814-712795ef9d5f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4ecb66-d35e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680664039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664039, "uuid": "56a3e766-6e80-4b58-9c2c-ed6d20a1d6ab", "comment": "Malware payload (Stop)", "value": "86b8b032ef817a5cba08b00daf802c44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664039, "uuid": "8b3ebd0c-a642-4de8-bff9-31748ff13ad4", "comment": "Malware payload (Stop)", "value": "e005e7585e4b7d705cad0474a059f636643a53a728c28224bbb91879c56b792d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664039, "uuid": "5bc9fd6b-d6ad-43e7-a49c-2463685b520b", "comment": "Malware payload (Stop)", "value": "93bdfe41a29cc15042309614f810cf3407e421ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664039, "uuid": "2f77718a-376e-416e-8a65-7bcf638736a4", "comment": "Malware payload (Stop)", "value": "844f780d1f82aae990255a77037f378a4fbc727ae4b5e3d0cc4d328e5f8367bcd077dc73537bbeda4f68f61d997565d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664039, "uuid": "cea8f4fa-6780-43a7-bc65-7aa26c303b7e", "value": "T148F4020263E06874E03B0A328F1DC7FE2A6EB5615D65BE9E1778597B1E703B1E22170D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664039, "uuid": "8cffa52c-2d4a-4efb-885e-08d1b7f195a4", "value": "262ebebc1125c68c79c87bc329257c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664039, "uuid": "a36a718b-b25c-4a2f-be66-37c60e5964fc", "value": "24576:vQRCZ6gouTfhHfRiaEfNgR/Br03rI+ok:vQRQouT5HAagmrgrI+ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680664039, "uuid": "6d71d946-69e9-4fdd-be72-d67f1b9c7457", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680664039, "uuid": "6be0b6a3-ac72-4960-9acc-d7974d337b6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664039, "uuid": "6775d9a3-df25-494b-8005-7c6ea4ab7968", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef80aa7-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680718217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718217, "uuid": "f428f72b-4919-41cb-8f96-4eec133d5850", "comment": "Malware payload (Formbook)", "value": "8f8bb3b7cd8c546f7c1c4edafdf30f0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718217, "uuid": "a83bf793-1250-4d3d-ab68-f458c795b4da", "comment": "Malware payload (Formbook)", "value": "e05dd4fdf0071a4108eac210a9eeae5c2bfa44d80dc8eac941f4e4a0d1fc0aa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718217, "uuid": "99b5db4b-2a0e-4984-923a-0909389d716b", "comment": "Malware payload (Formbook)", "value": "6a2f40c43cf5b164ee76b12b36efe917802d1e2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718217, "uuid": "2bd7005a-11d1-4351-bc41-1e0948c07218", "comment": "Malware payload (Formbook)", "value": "851960d753e418d4154fa9183fe888ac7b550ca66c4f913f2ea37f3afd036e5ae23d563e9e896d35eb025bc7f77afff7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718217, "uuid": "a2e15896-a911-4c5d-875f-d85d298896df", "value": "T111F4CF0E53604793F0082B75DA6D3E1903701C7D79C2EBD8FAA5765BADE2BA6147302B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718217, "uuid": "637be8a3-d840-4346-bc02-a5d83483ce95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718217, "uuid": "0ce676a1-62fc-46d9-ab59-6f15675bb2b8", "value": "12288:6U1V+thrkoFBoGPWc8ei/Cl+KWlxPkJPXd6oaPxxYGkE:6U14DGGw/Cl+LlqPNraHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718217, "uuid": "7854136d-e15d-458f-9da8-02bd064930fa", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718217, "uuid": "21cb83d1-4043-4641-a0a2-7ea579ba1e7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718217, "uuid": "093ca0c2-dda3-4983-8127-415b48631bd9", "value": "Confirm!!!.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d585453-d37f-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1680677896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677896, "uuid": "a2f779d2-4ed9-4393-bf00-07d821d73b2b", "comment": "Malware payload (CoinMiner)", "value": "2b8424d44a9d22b08b68af4e0f5ea9e6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677896, "uuid": "430b3ea8-3dbf-4725-9e19-20a066194fd6", "comment": "Malware payload (CoinMiner)", "value": "e0b361a5a568b0620b57e5af25e0627597c0633c285080a490e221c896ae5372", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677896, "uuid": "06632237-35cf-4529-92bb-0b14d60ab64b", "comment": "Malware payload (CoinMiner)", "value": "e5e99de12e7113ca2b0cc5b7472920b1d457cdd3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680677896, "uuid": "f52856ea-4eeb-4218-9317-238078f0f8f8", "comment": "Malware payload (CoinMiner)", "value": "db74356e871435b9bcd002c108380f9cd1f4ba6a550035f4d00cd0c191f2a1a2269b66729cec39b09d60ae64e5de0db6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680677896, "uuid": "3f2474eb-5875-467f-b40d-e122fe191576", "value": "T103D43330C29B5372C57366BA4BB0BF553635E97038C95E0D7C8DE1A9ABB1BB158C70A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680677896, "uuid": "23de0a49-0c5d-4b70-9252-f1334ea82879", "value": "12288:Nmdtg3kmf86lu1lsR9SBkrXeDGoHRMCoUhc9y95MxpwB6gbx:NctHmv79SwODGYRVoKgPwkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680677896, "uuid": "a874a917-df7a-48e4-b826-b336bb57fbea", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680677896, "uuid": "7003bae8-5e48-45cd-8fc2-5f49f204984e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680677896, "uuid": "7d066456-f5bb-497e-b755-9db9277d8407", "value": "2b8424d44a9d22b08b68af4e0f5ea9e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c9ab96-d34b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680655714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655714, "uuid": "8e33d3cf-8005-4198-9243-6ad3ce714c3f", "comment": "Malware payload (RedLineStealer)", "value": "693800d4b6520c44107d8305943d1d47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655714, "uuid": "43514e8c-f2f8-46c2-94ec-11db2e2a7de3", "comment": "Malware payload (RedLineStealer)", "value": "e242a16aeb07599ab5a4eba460bb9ae8e12bcf7b44ade783aac87400728c2f29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655714, "uuid": "38a6c30a-c3bd-42df-ad12-d689e673205d", "comment": "Malware payload (RedLineStealer)", "value": "585669e97aaa4a80613701a3cf4fe1f87ba16d8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680655714, "uuid": "f11ca4d1-a33d-4834-a574-593e680445de", "comment": "Malware payload (RedLineStealer)", "value": "624d9330fe859569684bbf35a1a9b10ba6dac3ed1337fefecb518ce8a21bbef249bf383cbc6a26d3f01e3357f71e4d50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655714, "uuid": "933003f6-bde1-466b-9959-f35639a26b20", "value": "T1193523C7BAE46072CD7317B459F283430A36BD665E74A7573791AA1A0833A84783633F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655714, "uuid": "a47d59c2-b3c0-472c-a1fa-dfa7afb0a41c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655714, "uuid": "411112bc-771e-430d-8ce2-ccd982b88717", "value": "24576:FyjFtkR3UtoypkPaFfUzKaWjAAARC4kkpSgZd:g4RupkSFfXaWjlA44Bp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680655714, "uuid": "9e05dab2-6b25-473b-8bbe-05993ab1bd6e", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680655714, "uuid": "17d72d3a-51a1-4cc2-aa65-ff5a913b2fa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680655714, "uuid": "089b44e7-1aea-4b2f-a29f-bcb3a196e003", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2060126e-d3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1680697604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697604, "uuid": "5443c8a6-4e8c-400e-9124-f898ef00e9f7", "comment": "Malware payload (Quakbot)", "value": "c4697b24413949c2bbcc014e4222f5c5", "object_relation": "md5", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697604, "uuid": "34b2b647-a027-481f-897f-83ee5e362c12", "comment": "Malware payload (Quakbot)", "value": "e2f609770d9fdc0fa7ae8bfd9c10ea91c094a731549ba2520a7167b0feab63cf", "object_relation": "sha256", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697604, "uuid": "5a8ce47d-b18b-4b7d-a8b3-d37a59392a38", "comment": "Malware payload (Quakbot)", "value": "5af0d5c2f39d59523ee1001ba51c9cf0d9cf983b", "object_relation": "sha1", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697604, "uuid": "78c7fc29-fc3c-4afd-87a8-9cab0ebe9286", "comment": "Malware payload (Quakbot)", "value": "d6739d4431b2463205d7a89306fd0ba9341162d5482383e36caffbb4528c21d6fce32865664a43db01f578605d5cfc9f", "object_relation": "sha3-384", "Tag": [ { "name": "1680686988", "colour": "#675113", "exportable": true, "hide_tag": false }, { "name": "BB22", "colour": "#A3CDAA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697604, "uuid": "666ecfac-ccb3-46f7-973a-1e37b0d94186", "value": "T14744CF43BB91C475E4D301BE217D97FA0E3A462C87A3DAE74FD05594C8362C0B63A65B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697604, "uuid": "831a6fdc-d42c-410b-b323-3324dd8560f3", "value": "6773aa39021b4b6dbb81de5fec9e5772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697604, "uuid": "ba48c193-e6b1-4b46-b3fa-d76649f484ce", "value": "6144:de73XJK8VCoxyusKqXkfbShAzYXgxMBtARW+Wai:kJJCjKzfbGXXgxMrR+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680697604, "uuid": "9050f094-3234-49f9-bedf-60dc01a630b5", "value": 263687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680697604, "uuid": "5d2d126c-d43a-4ccf-906c-e22e073bf268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697604, "uuid": "1649caf0-0200-4f9b-9830-68826f76f85e", "value": "itchiestLongacre.telfordize.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c3078f-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680700509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700509, "uuid": "ff53ad33-a392-4b07-8597-4b3c57ddb98a", "comment": "Malware payload (Loki)", "value": "3edef600478cb64110fb13d59167da68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700509, "uuid": "8194e340-1b41-48f9-940e-7d20060aa635", "comment": "Malware payload (Loki)", "value": "e37c9f95987366f5222f9bf77421e6e3b81684f93eea9c1a947d29dc6210d98e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700509, "uuid": "d998c63d-6596-4bf5-93e5-f990e04fdeed", "comment": "Malware payload (Loki)", "value": "2d4d68479007c692639620759fff22554d22d833", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700509, "uuid": "5a486367-d7f6-4434-9ba1-11362ac5ac20", "comment": "Malware payload (Loki)", "value": "5d31d282ca641eda8c321e265d4717a26f0206cf179adb9eb1076dadd201dd2e8174f73dbef3fc1c6739a202ed5852dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700509, "uuid": "9bff8be2-b200-41bf-9930-abed04987fcb", "value": "T173C4126533F49732C95E4BBAE865325403F5F57B58A3F30E9DD254E86EB37008A026A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700509, "uuid": "2f1634cb-5d34-4b81-9a98-a2a4036bb454", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700509, "uuid": "88947ab9-f303-4bd0-ad72-d1c111b4a57b", "value": "12288:Lpivbm8G0V/ry4PpVH3tWXEOTFT6bhSWw22P5q5tM9n:LP8pV/G4xVqTOSJz5qTM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700509, "uuid": "0c21e1be-0053-420b-b851-ec74908fe75a", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700509, "uuid": "803010cf-4614-49a2-a9b8-0ed7fce4db3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700509, "uuid": "c3870ccd-e7c6-4fdb-ab1c-111fb1dceec0", "value": "3edef600478cb64110fb13d59167da68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f61c48-d39e-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1680691327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691327, "uuid": "46b2014f-b1f7-4104-b815-6f395a3025a2", "comment": "Malware payload (QuasarRAT)", "value": "de1079d6af97cd7fc890e0f273fd8edd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691327, "uuid": "91518b65-ec7c-4cda-aea8-f86ef95d2bd5", "comment": "Malware payload (QuasarRAT)", "value": "e57f004cdd5d2da92e0429a1fdba612f17852781f389dc855c217341e28dc35b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691327, "uuid": "3dfa4072-63cc-46ee-9145-a14304cd3480", "comment": "Malware payload (QuasarRAT)", "value": "dec3dcb97bc1af1e0188c69c96c1ade83f5d44cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691327, "uuid": "19c109f5-ea5a-4965-aa37-f7304099749a", "comment": "Malware payload (QuasarRAT)", "value": "77d79da17cf5c854150fd41af92beca451f6997c3c6f09f189cd059a51e5b54e96a8a0d527be4e8885e4557b437e93b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691327, "uuid": "fdc1c09b-7d61-4f38-b779-97f3049ece5f", "value": "T14F16CF30C41CFDE8467D3B544A6A2D1581A6F0A7CBFCA769C941087E38257B3EE3694E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691327, "uuid": "2b497e81-e0b5-495e-a1e6-b041a8c0edca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691327, "uuid": "94f88438-cabf-43c6-a304-464a68d5008f", "value": "49152:PU2w4nWECe/se7jxTvBiJ8UeoGn7eSbRvbRNvdJqCCXNNkt:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680691327, "uuid": "6ddfc277-e1d1-4e6d-b354-4dad1397ed45", "value": 4360908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680691327, "uuid": "dd11fab5-e462-435f-9222-f7bde3d450e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691327, "uuid": "e102be7d-e2f2-46ec-b177-5f65b779465a", "value": "e57f004cdd5d2da92e0429a1fdba612f17852781f389dc855c217341e28dc35b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4717ff8-d39f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680691813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691813, "uuid": "72f5092a-7d9f-4593-b9e1-3f638f3f0fba", "comment": "Malware payload (GuLoader)", "value": "bd90521fa15c4e24caee527f0c93215c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691813, "uuid": "42b3fa88-7885-4cf2-bded-8785a9521bda", "comment": "Malware payload (GuLoader)", "value": "e5a97523932ad9ec8220297a00dc0b2075d0f52f02255c2f465ff4fc1d509f9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691813, "uuid": "9559940f-6ebb-4c67-86b1-36e5969d8381", "comment": "Malware payload (GuLoader)", "value": "6ab3f9c56ab0417d257d515d22846ad36cc04ad0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691813, "uuid": "f6ad9280-1df8-43e5-be08-1192f02da65b", "comment": "Malware payload (GuLoader)", "value": "edd5d4f0081ba852227aa5319cdb2b7f4492e7161cd4a9bf2d588642e5a5dd0d2a679b2538df284ff7687e61d20d993f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691813, "uuid": "7cb5ce80-0c59-4fe1-9d49-020b081e1d3c", "value": "T1E4B4F0796BF4C012E4E1CEB18EE1C9B876257D8078F166D763007B7EE835210A79726B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691813, "uuid": "0909f4ca-d11b-4558-bba5-d355cdc16c7b", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691813, "uuid": "ac04d9ac-8368-4a15-a8d6-48138322d045", "value": "12288:cz9GxaChlC3qKOcVbNdwE4RToOKNzMIcnmmf+NShOGDZ:vC3iKNdwLTVKxLcmmGghOyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680691813, "uuid": "42da1b73-8934-4b4b-8ce9-1f6d0c5199d1", "value": 518760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680691813, "uuid": "97b7f5ba-2dd6-4b3d-8e4a-3caf639dcf52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691813, "uuid": "393debfb-42f4-477e-9912-cd120e3f64e0", "value": "e5a97523932ad9ec8220297a00dc0b2075d0f52f02255c2f465ff4fc1d509f9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4951d5c5-d3e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1680719577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719577, "uuid": "9f726053-d735-41b8-b035-01ef26309d10", "comment": "Malware payload (zgRAT)", "value": "a9e5fd5914a1c0ff6e97c663078e6434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719577, "uuid": "aaef9d93-4baa-4c84-8248-9f5b93cdaee2", "comment": "Malware payload (zgRAT)", "value": "e70826fbbd046332901ab8eea235b932dd8c621de94ad618338fe5cfcc0fa209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719577, "uuid": "2151c8a1-d155-4f38-acfd-1573e530949f", "comment": "Malware payload (zgRAT)", "value": "a6e0757c384fe97246eaa25c1f196b4df684d317", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719577, "uuid": "f180ec6d-fee1-49e7-854b-abc8203b1faa", "comment": "Malware payload (zgRAT)", "value": "b3fe1fced44fed863168be5b63589810ca951678b0e2623d90158d1ed237047d0aa7f9237de6caa9071971ec76dd1f41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719577, "uuid": "a6fca694-d637-4c5e-9bcd-d2512676c555", "value": "T12C54E06773D69D55C6119BB4C1CB400803B1EB467B73D68A3E8B13742E837EA9D88A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719577, "uuid": "981c6fc5-bb94-49cc-9559-ded7f3d104bb", "value": "6144:zPwjF6W9nQQ4dFc0Q0fnAeCWdbGhCvPFI:zIjFnnQQ4VqWdyhCvPFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719577, "uuid": "b520c640-3df5-4acf-9988-0597ec240c66", "value": 287464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719577, "uuid": "5a594d21-632f-4c10-963b-e9ba69c0225e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719577, "uuid": "f5de7cae-61f8-4f1e-b472-313ef2156995", "value": "Dekont-c,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acad84f3-d39f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680691826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691826, "uuid": "8973a3f6-ed11-4705-b536-566b71ec7267", "comment": "Malware payload (RedLineStealer)", "value": "061b06d4ab57d5132b53dbb4c26b1b12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691826, "uuid": "37dcb9e9-0d84-4105-8018-4edba336b4bb", "comment": "Malware payload (RedLineStealer)", "value": "e7788155fe55604ea254a28d4b1a2d6bfddc5fd061e3d3bddce7a4baeb11f7d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691826, "uuid": "60d4e6fb-0b94-479b-801f-cccea1773e38", "comment": "Malware payload (RedLineStealer)", "value": "53c4f0a5b19181f212ab754b23e274bcdff472b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691826, "uuid": "6e5318d8-53ba-4fb6-89d6-a35242555754", "comment": "Malware payload (RedLineStealer)", "value": "6e20b95334d1732672d6392ea202a3ba45e8ba4ba69b15e053ab9914a45709468ce32ffae218b241ef4f624a5b695606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691826, "uuid": "b833211c-2e4d-47dd-899b-20b085a4eabb", "value": "T1D8352312AADCD0B3DCA11BF02DF702870B36BD92697843776728E25E14737C4A971B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691826, "uuid": "0381cdc3-a38a-4463-b319-a613f01de096", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691826, "uuid": "dd8a8f3c-7619-459c-b033-6494ad7e7568", "value": "24576:yyaltYXHhmW97I9h/HGSH+RACSvi9pGh7jB3bf2WkcJgcqX0UwPu6:ZakXHh397YreRnnG5jBTDKZX0HW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680691826, "uuid": "63328c6a-9c9a-4a26-9392-f4a00a2d7b01", "value": 1144320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680691826, "uuid": "6fc1f5e2-193b-4820-be44-d289d4ce35d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691826, "uuid": "d26bc2ca-15b3-40f4-a234-27725dd60ae2", "value": "061b06d4ab57d5132b53dbb4c26b1b12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e62b1c2-d3bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680703587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703587, "uuid": "52a67db1-a96e-493e-a5a6-1acd7d0fbf8b", "comment": "Malware payload (Guildma)", "value": "22a39e264b8cd83b60d344354930b142", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703587, "uuid": "c9491ee7-e3b8-4b8a-a10e-f61bc37a88d0", "comment": "Malware payload (Guildma)", "value": "e835363d618c4029d67755a0062f4d404190433b4f3e874533030636c738f66c", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703587, "uuid": "fa4166e4-9623-4d80-bef5-4dfb59481c07", "comment": "Malware payload (Guildma)", "value": "ce4244313c1e469d533da53e6b5e447a859bf9d2", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703587, "uuid": "2cd6334d-14cc-4ae7-8fed-298ea69a9cd2", "comment": "Malware payload (Guildma)", "value": "4d10e70d4fd5b5e278a8ffc2e938dcf998562c79f19c5e4ecb13764f3b181b47bfca35c38fe3289616f4350bd5f5fcf1", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703587, "uuid": "b5044449-dba1-4138-be56-1a42d46ee6ab", "value": "T1DAF0230D90D21D62E01C403D59A6CB5D0F1C7C254F9A7817A31A4198081084C6F3FEE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703587, "uuid": "330bf7ab-2093-4945-9f98-e7259dfe0168", "value": "12:8rflM8OBE6ZGBgkxL6jdbML6UOm0m7fIhBSmij2mpKSg:8loGBFxL6mLXOvm7fyBBijg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680703587, "uuid": "24f60c27-2ac1-447c-96b4-8b06d7f3c654", "value": 513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680703587, "uuid": "1d3ae53a-93dc-4686-8244-9c1e940c43a5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703587, "uuid": "54729ed9-3072-44ef-a1da-f24745ae4466", "value": "Curriculo_46892763921.948622.26491.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b351331b-d39e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680691408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691408, "uuid": "2f2ac7e8-eb31-495e-b605-23c9f4048707", "comment": "Malware payload (RedLineStealer)", "value": "b5918ddc04b1d80d2bf0bcda4f638699", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691408, "uuid": "3136a125-bf12-4475-b976-05c9209ebed9", "comment": "Malware payload (RedLineStealer)", "value": "e8601875c0f172a8f8038fccf49e982f1e164b9845df0e244a389ded740b029e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691408, "uuid": "b52a5e7b-76de-496e-bcdb-6c8907b23faa", "comment": "Malware payload (RedLineStealer)", "value": "62188cd945ea3f12826eefce08d0a6781ae358e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691408, "uuid": "24ec1263-5dbf-48a3-a191-7e05de2d1b07", "comment": "Malware payload (RedLineStealer)", "value": "011109d51a71e04ca5c3911be96ef9f3c2a8c7226129d34615f642769a47456f0a42a9d88a62a8f5588737340301496e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691408, "uuid": "5b0ef061-a5fd-4763-b3d7-5f08aa527f58", "value": "T17404B51437BCCD11E1BA2A3F6961A05147BF98026852F25B7AC367CD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691408, "uuid": "6172f263-77a7-4bad-b95e-5f88bffa8d88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691408, "uuid": "cb4131e2-ebb1-444e-b534-6a7c2b012a7c", "value": "3072:yxqZW11a2kX8fqvPIeJBeGg9ShLrxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOJ:gqZkqvPZJ8Sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680691408, "uuid": "09136d82-eacb-4cb4-91ac-cd8435057651", "value": 179334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680691408, "uuid": "da2eaa88-3e42-4b5f-afdb-df0f533aa79a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691408, "uuid": "a4592e83-4043-4f53-b316-d04e1671dd9a", "value": "e8601875c0f172a8f8038fccf49e982f1e164b9845df0e244a389ded740b029e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff2b3c4-d379-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680675457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675457, "uuid": "9f91e90a-9816-4242-924c-a27f162e8de1", "comment": "Malware payload (Mirai)", "value": "2f620ea1a4ee21da5162312d79ae8f9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675457, "uuid": "4385dca2-622a-44f2-a692-976aa86f0909", "comment": "Malware payload (Mirai)", "value": "e8b91b37d114d8c14c699795c2d589e9a941b3f5f106e1de3e079d424ff07aec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675457, "uuid": "019435d9-d4ec-469f-a5f3-a80013bdaeee", "comment": "Malware payload (Mirai)", "value": "0992a9161e840947b122b3b4377b405a9d34b323", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675457, "uuid": "f247814f-9c64-4801-8c77-12e4fc9ecd42", "comment": "Malware payload (Mirai)", "value": "d415eb871e0baa10758d460051785fc7f1be580585581283024395fbdd98a3cd296351879451ca6d5849efec90942442", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675457, "uuid": "0149a3d0-bcb9-4be8-bdf9-efbc7e3d4ed8", "value": "T10903E17A53651631E3A90D3FE42C4AD2370B09FEE1E534F1BE5A90971E82B484DBD2C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675457, "uuid": "6c85e04d-6bf2-4c42-bcf8-173837e5f353", "value": "768:zwVnmJGD0kA04sSPePIFhknXheqmH4VUvylis3Uoz1J:kY0XSPeQBH4Vsylfz1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680675457, "uuid": "bf8d5bf1-f246-4365-9de2-2015b67ba25d", "value": 38452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680675457, "uuid": "d17c547f-c128-4805-84a3-26fad1e70f7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675457, "uuid": "abd33b46-bd2d-428d-9f35-2de436315bca", "value": "2f620ea1a4ee21da5162312d79ae8f9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86dcb2e3-d3a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680692192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692192, "uuid": "da41648d-b2c8-4659-a022-9156645e6b45", "comment": "Malware payload (Rhadamanthys)", "value": "94b5e686a97900aa3b37e4b91bc1f527", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692192, "uuid": "8aa9219d-31ef-420f-b5f7-377ea715f69c", "comment": "Malware payload (Rhadamanthys)", "value": "e98666fc150e5d345ed957a4755bcb23529d17977c8da9920faaff25003f561d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692192, "uuid": "5f13d308-3610-4d24-81cc-fac12e0d887e", "comment": "Malware payload (Rhadamanthys)", "value": "8a4e96d9f9489a73ad49ac56e61e879111b0dd4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680692192, "uuid": "4d1d2d2d-1d74-4f7a-ab30-5d6f2ae1da03", "comment": "Malware payload (Rhadamanthys)", "value": "e7ef025410d72999e80bf68de2000bbb6c3d804e1426661d9bd27a2d08608cb110fd0cfcd9c30ab142f2650407cb7d9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692192, "uuid": "3e42087f-90dd-4325-9e31-c7dec14af832", "value": "T10B54DF4177A1ECB3D91244744838D2F4263EBCB29B99DA8773543FAF2D312E27A26315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692192, "uuid": "6785616b-49ae-4891-9e8b-7ceb78924e29", "value": "7e3b1e18e4b8642ee42be6e8ca53a819", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692192, "uuid": "8cd6f5b0-14b2-49a5-a3df-8b3e3f5a9a7d", "value": "3072:tQX+w/80EWdxNbHsu3VjCEN4MLm857pkV+Pyb586hkg45sYUYsxTw:yXp80VNbHBoQfL7++Py986vYUYiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680692192, "uuid": "00acfdf0-62e3-4c20-815e-818ab085be84", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680692192, "uuid": "49c24ea2-4907-4aba-bb33-4eb81d784700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680692192, "uuid": "ac6e4046-4aef-48f3-bfdf-3a11d33e75af", "value": "94b5e686a97900aa3b37e4b91bc1f527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445dad3f-d3f3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680727729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680727729, "uuid": "1cee3c16-c04a-4995-9a7b-d93294322399", "comment": "Malware payload", "value": "5dd7c5c8dfc1f513fe93aa775cbde6f1", "object_relation": "md5", "Tag": [ { "name": "PhonyC2", "colour": "#6C0565", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680727729, "uuid": "4750323f-6e86-4365-b1f1-bbb39a9f72b0", "comment": "Malware payload", "value": "e98aa0a030f97703b4b956440e262b6ad00cd4b4ed39f33567cb488a5ace5a2a", "object_relation": "sha256", "Tag": [ { "name": "PhonyC2", "colour": "#6C0565", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680727729, "uuid": "21788b15-f034-4a24-ac63-b57b9edd28dd", "comment": "Malware payload", "value": "aa04cec7b6a1d05632d3f4827d4d8b819da5bfc1", "object_relation": "sha1", "Tag": [ { "name": "PhonyC2", "colour": "#6C0565", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680727729, "uuid": "b4039e0d-3b4f-4d87-b250-fadc695fe9c4", "comment": "Malware payload", "value": "a2cbf7dfd7b095e5804f158f374bd3c85234b7266e6280c87f3fd5e0b18fd85138a18b88a9f52aefd94014f39bfe3513", "object_relation": "sha3-384", "Tag": [ { "name": "PhonyC2", "colour": "#6C0565", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680727729, "uuid": "bfca0bb2-1dd2-456d-ae55-1ffe8b44f70b", "value": "T10C83CF38B40C0966E36B8975C589DA38944B5C0522CF6BF33D4C37A58D6A7C427BDF8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680727729, "uuid": "958b5e9c-0c2e-4b55-8727-87654d0fae1f", "value": "1536:fhqP7L6QM/nw5IxMWw89waY2FRWHq/h5RDCRgwRjuTb3XAPpYs5:fhqPfmdxC8Ka7FRWLSTb3XARYs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680727729, "uuid": "3dc82a5d-13f4-4e04-8dbb-232855139b5a", "value": 81903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680727729, "uuid": "3d586fdd-d5fa-4434-978b-f40704a723a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680727729, "uuid": "47bb3e58-ba4c-4657-873f-b85c81eb7369", "value": "PhonyC2_v6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e22498-d3a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680695806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695806, "uuid": "77a36671-e5f7-4f0e-9a8f-3eb747334c21", "comment": "Malware payload (SnakeKeylogger)", "value": "969b34d54e857aa7bc98aa4447e4a986", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695806, "uuid": "68a9d23a-cc4e-4f6b-b89c-f8dda3703655", "comment": "Malware payload (SnakeKeylogger)", "value": "eaaef6c4f58cd6de149d1139623eaa618016295c7ea638d7252634cf0638747c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695806, "uuid": "6056099c-f7dd-45d3-a416-3116ecfb7b25", "comment": "Malware payload (SnakeKeylogger)", "value": "6d3f3994bb380aebf60cbcee07c1a2473b8b9622", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695806, "uuid": "6284b9dd-8140-49fe-92e5-b5ca739803a1", "comment": "Malware payload (SnakeKeylogger)", "value": "b7291f7b742e78c9dc1080da16ee2c191a60807718dcd446b6c80a015b02a77b1f699763b03bf403267f82e4ee55eac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695806, "uuid": "0958c780-59a7-4596-b78a-997c9891a57c", "value": "T17FC4BEE2C28045A9FDA60F7650335CBA15A7BDBAFCB8A50D615DB5722B732C3007AD07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695806, "uuid": "b9b86466-1262-454e-8bb9-529589f9b07e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695806, "uuid": "f8a96dd7-140d-4746-88c5-5e9d6bc5fd5a", "value": "12288:jY+iPr5HFvpSppT7cPAXjkA9tV/Gpf7kb:jY+a5HDSrcYTj8f7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695806, "uuid": "290d12d5-e1b1-4573-b9e2-b8f44f03a901", "value": 556121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695806, "uuid": "d14bd301-7df6-4382-835f-8e674c99e6fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695806, "uuid": "0e351934-0a33-4f08-8750-16aecb7bf773", "value": "PO 0027220029.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b611cb27-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680700432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700432, "uuid": "2be0b3ac-fd97-4c3e-8871-2c95134f2af0", "comment": "Malware payload (AgentTesla)", "value": "8d65cbe7e53a7d0c1329fba32ad439b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700432, "uuid": "91bb7d43-62cf-4150-b11c-aa0eb5a3bb80", "comment": "Malware payload (AgentTesla)", "value": "eac54971eb50b657345e1629f6931818ef3eecaa29196b5fa97492ef4aea1198", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700432, "uuid": "0f646de0-53cc-401e-a1ab-28decf932e43", "comment": "Malware payload (AgentTesla)", "value": "918568d13791f45978ac5d7da456eb23d3db05ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700432, "uuid": "0c19a436-966e-4800-9634-c335d73764e1", "comment": "Malware payload (AgentTesla)", "value": "820de69dce6a2dd70061e764f6da21bad7473ef9b86ef998bc9823a4400176543bf8a7354c208bef40ce8b0d301a5a41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700432, "uuid": "74bd3e6e-d18c-4668-a2f5-b4fe0e7638db", "value": "T136F48C2E8E14C2F5F6BC07B5D0D37F196EA409A247D6851CB87B60C63B85B8A5C0E94F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700432, "uuid": "5bc0c183-eeb4-4c99-8fbf-09016e3d96c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700432, "uuid": "d7ebc53b-489d-45e3-bec2-09f643642f5a", "value": "12288:DwFZRkN2iNrfGq0J6wwxHICb65K3FcgAHCPMRovwHfRH02Y:DwFZON11f46zpa5dgERD/Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700432, "uuid": "daaf5cda-5a25-4cc8-8591-70248413540b", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700432, "uuid": "3b1f5e73-08f8-46a4-9dd0-545f88665c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700432, "uuid": "8cd01480-e136-41cf-80d3-76ba20609379", "value": "8d65cbe7e53a7d0c1329fba32ad439b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7662dd9a-d383-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680679709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680679709, "uuid": "22877bbd-b791-4dda-86f6-86d2202270c8", "comment": "Malware payload (GuLoader)", "value": "6159ac142cf72c73d0e72a3ce2977d37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680679709, "uuid": "55fc71eb-fa0a-454a-ab62-a58005a0d876", "comment": "Malware payload (GuLoader)", "value": "eb3d78599bff53b85a15840458fe377fc7183af94f47952e9d79bf9cdb8d506b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680679709, "uuid": "f88a64ad-308d-4437-9176-f44d228dc1ed", "comment": "Malware payload (GuLoader)", "value": "08407618cccd9da5a917e2a0f4e0570ce942922a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680679709, "uuid": "c08c3bce-b21a-4aa3-bf3d-073e6031c1f7", "comment": "Malware payload (GuLoader)", "value": "2a327f2ab5f80b6938996ad23b87a3fa00250142b9829a2d79e4ef6157e4009c69199260d4dc40b642a49ac2edfb6516", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680679709, "uuid": "ae99d299-0a77-46dd-88e1-da7091c47c49", "value": "T1AA6412641361C263CEE186320A3DF15597F7EE141420AA1B5374478AFF3ADA58B4A3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680679709, "uuid": "191e750b-1e62-467e-90e0-ae4947fb7880", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680679709, "uuid": "06b0b721-65f2-40e0-a97d-6221c4d5a928", "value": "6144:G5lz/inteGHQ1r7Q2fQUTOT0+4wALkqSeqE82K+fk+vIKTKYE:+0ngjmzUTOTl4w5qSeqE8n+fsKTnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680679709, "uuid": "2016e5b6-4446-4520-b7eb-68a2c4b05f3d", "value": 318839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680679709, "uuid": "0dfe9bf3-cf59-4d5a-98c2-28cf790d3c96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680679709, "uuid": "92c6f000-9383-4030-be50-ecdae4ac9821", "value": "Scan00000083432233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d511b0ab-d368-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680668272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680668272, "uuid": "3bd4891c-9c46-4e57-8f30-ae53347fd57d", "comment": "Malware payload (SnakeKeylogger)", "value": "49bef31c56451ca1a9cf90908bef2d27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680668272, "uuid": "522bb509-b100-4db8-baf8-85c313522ae5", "comment": "Malware payload (SnakeKeylogger)", "value": "eb9b75de38d85a10701424dccef23e23ed5fe323b52871cde5b4054f4dc6c087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680668272, "uuid": "b597ea09-c2ba-4ecd-85ee-fc7281bc245b", "comment": "Malware payload (SnakeKeylogger)", "value": "477734f8527a127019cd8cb68ad16dd0df6d54f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680668272, "uuid": "abe8a4e1-bea3-4079-850f-abf2c75d296b", "comment": "Malware payload (SnakeKeylogger)", "value": "bc0a0a42a86e7138b960e194bdfed4045759783b102c68c1fa9908664b24f324c6be1d8a241058af055c03a2ac7e5a1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680668272, "uuid": "1d7a87ab-0b4d-428d-903b-b351e97df2a2", "value": "T10B357D697BA79923C1BDDE31CAE25400A3F1C4477622E91F2ECE12C50B13B9E59C71AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680668272, "uuid": "f4176513-9855-49d4-a0fb-2e154942b9fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680668272, "uuid": "b5319c50-ac93-42a1-b315-765a0b016317", "value": "24576:xcitI0Be2+GZLAH/sVqcPZk4rBKwyWfM2l:xZt82us0GtKwzTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680668272, "uuid": "463d045e-f9a5-4b76-b1f5-5a7c9fe34754", "value": 1076224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680668272, "uuid": "9e2b8c71-f010-49fc-9e22-2e7880f2be3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680668272, "uuid": "45eb96e4-345e-4bd8-8b03-a6ec1084af9f", "value": "Pending invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f76fad5-d3a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680693925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680693925, "uuid": "23c26c46-3bba-4b67-aed4-b371d36edc06", "comment": "Malware payload (Loki)", "value": "5aa49680f350ae154bf8b15502162c2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680693925, "uuid": "495b727a-8feb-4827-b565-7a5c2274f2b2", "comment": "Malware payload (Loki)", "value": "ec6cebe1ace02965184a065528322e6b881abc1930d87223cfeafac4204c0bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680693925, "uuid": "49b04b30-3df7-4290-8106-0d1393e70aa8", "comment": "Malware payload (Loki)", "value": "2634b4597bf09b177517cc588d21adafa8958d6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680693925, "uuid": "19a8e684-ee40-4cc8-8bfc-23f8fe66133c", "comment": "Malware payload (Loki)", "value": "8aa531e4712ecdbc6598bce6bc6b0cc9fcee572005c2fcaa8022de7c1768624c4542442ce367b78128ab17d53145a8a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680693925, "uuid": "5e60be46-403b-419d-a7f3-66dc66bfb158", "value": "T1A7B412CC7B68D712C6A947F5FCA3290103B0712698A7F71A0EE714F9A9C778C4EA1593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680693925, "uuid": "ee6cd7e9-ddd6-4ffc-a30e-1a588b94d587", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680693925, "uuid": "e5169a83-ec09-4450-a813-b8a21b06adeb", "value": "12288:MrZ8UL2l/itISupDDdiQJpfw08chilNIbF:MF8i2ctISiD4uBYzIbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680693925, "uuid": "8d1085ec-a9bf-4763-b614-fe51d9f4d13c", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680693925, "uuid": "7bdc3895-5aac-4977-b0bc-430f18068da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680693925, "uuid": "d228479a-0bb4-40cc-83ec-7d2555cf399c", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7575cd-d3d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1680716098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680716098, "uuid": "5af92f2d-2c8f-44d6-b5ec-3fcbf500713c", "comment": "Malware payload (Quakbot)", "value": "ff2fbe2db1ea2003cb63df65b8b6eccc", "object_relation": "md5", "Tag": [ { "name": "obama248", "colour": "#1B2A52", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680716098, "uuid": "65c989e6-78c3-4c99-a1f2-6bc8f5151963", "comment": "Malware payload (Quakbot)", "value": "ed2728b28524bb01e629a6984e36bd26ab0eb727bb65e583eb826d378e20f02b", "object_relation": "sha256", "Tag": [ { "name": "obama248", "colour": "#1B2A52", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680716098, "uuid": "babe96a0-e3f1-4b2a-bd45-51cf4a861546", "comment": "Malware payload (Quakbot)", "value": "3d2c568f7554058f22172d32880db29eeac2e780", "object_relation": "sha1", "Tag": [ { "name": "obama248", "colour": "#1B2A52", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680716098, "uuid": "00a76d71-1f89-4aec-93b6-92e4af79f9e9", "comment": "Malware payload (Quakbot)", "value": "519657e5b83a8e1dc178f579e65d451a2d27e9a230eddb97e4e6b6cf24d8a58f230417973a824d9e633e0e5560f552f8", "object_relation": "sha3-384", "Tag": [ { "name": "obama248", "colour": "#1B2A52", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680716098, "uuid": "527ba3be-96b4-4ee7-818f-a329b70ea8af", "value": "T12A34B55087B930691BB72A27D6255A21DE6D0E2E96848107F43E7380FFDE48DC5F4EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680716098, "uuid": "efd1bc3a-fb5a-44b0-9e7f-02dcfe37ac94", "value": "6144:eVcD6yCSBEgQV2hFsmDByO6OP9FzEHSWZsAxMfZ/J842uiMvRwE0b:IGLBEd2hEHulLrob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680716098, "uuid": "6441b5c2-d97f-4894-9a48-501b5337de18", "value": 234771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680716098, "uuid": "7a52d485-f25f-4d8b-8511-388e5b819ad5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680716098, "uuid": "b1615717-cb36-40e7-ac0f-ca632231ef0a", "value": "AprilINV(f3354).wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4d3424-d3aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetSupport)", "timestamp": 1680696656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696656, "uuid": "30773b48-a544-4fb3-8dad-491b5076d973", "comment": "Malware payload (NetSupport)", "value": "c0eb3eac96511077dafc0afa64c6388c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696656, "uuid": "2d09d60f-f568-45b4-aa12-3432dc699e3c", "comment": "Malware payload (NetSupport)", "value": "eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696656, "uuid": "c2a7a519-96cf-4427-acfa-f806e30f2598", "comment": "Malware payload (NetSupport)", "value": "33e81f25493eda3bbf0b7cdcddd523547fa6c31e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680696656, "uuid": "08055f33-bd77-4c3b-aa0b-e9c76ffcf78d", "comment": "Malware payload (NetSupport)", "value": "6fcac90e82d7b9106a663a1609df2c5a4317f87d8f23055c53dc8deda596ef2e89074d709e2f3b0ce530d65971b05bc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696656, "uuid": "35f5f6cc-5ee0-4954-94f9-4b52c71e9515", "value": "T13AC3B30F429DE173EA42E97DC4819B050DA4BEC5B5B458FB405EF63E3E3138E2B6416A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696656, "uuid": "a488c97e-7cb7-415e-b918-556a0e6a4eb6", "value": "a9d50692e95b79723f3e76fcf70d023e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696656, "uuid": "688ad8ad-27d9-436e-b708-7c82e25211a7", "value": "768:YGpVZl6FhWr80/9P3r2pe/sIQKFKcMkjr2pe/9n/FKFKcMkW:YO0hG1Pbee/6IrTee/7Ira", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680696656, "uuid": "c7f1c9b3-b9bf-4807-bfc6-3c3355dbbb75", "value": 120232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680696656, "uuid": "d6a349ed-d1b3-4eca-baa2-3b0f9ff1ebc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680696656, "uuid": "68184fe1-f697-48a0-bb62-7e6bc1c37dfb", "value": "client32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904045f7-d3c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680707670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707670, "uuid": "f3db40d3-9708-4bda-ac57-4b9164a0387a", "comment": "Malware payload (AgentTesla)", "value": "0403ef9967512d69298c4ab4fbe56017", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707670, "uuid": "b7e8155d-9ac3-413f-b93e-8ff2be9e1e73", "comment": "Malware payload (AgentTesla)", "value": "eec6cee0a3f634acb82b8f9b131a319c17b6199adb4dc45ef5ad661124ecb6fc", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707670, "uuid": "76fd6986-a831-47b3-8494-4d358cd2e9ea", "comment": "Malware payload (AgentTesla)", "value": "61e508a9a1810f585f2a1d6bc401bcd61fccaa5a", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680707670, "uuid": "d8fb85ea-c777-4dba-a2c4-c3cc4b7124e8", "comment": "Malware payload (AgentTesla)", "value": "6edd4506d9730568f9a9b114c1f38b914c3d0d9202ab92d11f47a829eb5cea53accd9643cc2b3017672213a891e3e386", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707670, "uuid": "df852099-589d-4626-9f22-a30ab6bb331b", "value": "T1A8C4236BC061F5E6AB2745F82CF9914147BC87CB30DCCDBDD22662351AAAE190BC41DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707670, "uuid": "cb45e521-bdfc-4a51-8e83-99e0a29c4683", "value": "12288:kaZkFggvtnGHEVfXpg711gPN5ktFgKOdDOEU+7mj:kalSNGHEVfq6O/+dXU+70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680707670, "uuid": "8783f446-de23-4a6d-a1f7-15948937568f", "value": 557169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680707670, "uuid": "d9301321-84a3-4e5f-ad0d-2b3f017578f2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680707670, "uuid": "40ac121d-c124-477e-b4bd-9afad459f68c", "value": "12192022_Bank _Report.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a22166-d3e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680719921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719921, "uuid": "adcd16da-3189-4106-ae45-9ae11220b35a", "comment": "Malware payload (AgentTesla)", "value": "721895f6ecf9c54778e9860a59355faa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719921, "uuid": "656edd9f-dee7-4b28-9f64-d7138796c4af", "comment": "Malware payload (AgentTesla)", "value": "f06390d772932400286cb5c5ed7c35db3178f2a56b824edbff4ee9e1badc47d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719921, "uuid": "646bfcca-5da5-4284-8874-162d86bf909c", "comment": "Malware payload (AgentTesla)", "value": "98cb81cc8ac935cf9560a2691ab8e584f2655270", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680719921, "uuid": "29db5f71-b896-44aa-b315-b65babec7d9f", "comment": "Malware payload (AgentTesla)", "value": "785d0b36ffcbc38ab54b9d3024393830b574ba43d3ad25654dbc11b7c910b48e9ff2a9cdf83cdfde3306eb23ad016fc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719921, "uuid": "cb5f748c-70fd-41cb-b192-e4975892dd47", "value": "T105662A13AFDC4D97FEE623B7646552C8DEB8E867C7D2A306300DA0A90B2D7444E53663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719921, "uuid": "4a31cc08-4e9b-47e1-a9e1-a6d0fa4a626c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719921, "uuid": "cd7762a0-add5-4f33-af04-11f1f6b66963", "value": "49152:pKmGcI93jiRPVMVieniwaz+1hpnwbne2YfmtfevJ5jbydd0sGBUG0GwCP4uW:YaI9Wmibxi4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680719921, "uuid": "6ddb54b8-9788-45ff-ab36-efb55f09f9f2", "value": 6747648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680719921, "uuid": "e19d40df-6d46-427d-8ab4-fe182f91ebdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680719921, "uuid": "2454854e-b4ff-4cbd-9039-e90be245d3d9", "value": "Wjjfcrewq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af58e06-d3ad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680697810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697810, "uuid": "6fa3e307-43b8-42e8-81f1-0dcdeed1ac27", "comment": "Malware payload", "value": "ce6497ecf03542d48502d48576d6f165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697810, "uuid": "b6d18b64-3add-4c69-9c38-4d1ac6c2e1f0", "comment": "Malware payload", "value": "f0b3e189929f3589c8369ae04343b0c2d8e5d614ae5b6b3a521cf3f843aa8cc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697810, "uuid": "81c8d299-ac42-4559-b347-e72596267000", "comment": "Malware payload", "value": "c25e57482c8315962ad9286d9413c647b3b65069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680697810, "uuid": "8044b7b3-c9eb-4989-9494-a6e08a10bbf1", "comment": "Malware payload", "value": "27c8ffbfc08395bb899964cdccb3753a707f0f6d1ec9784583f3893d9767ac99d2bb299b16c98e7e9d24dfd0c1e1917f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697810, "uuid": "eb8cbdb5-3253-44b6-82e9-5c726330136f", "value": "T10307BD11B7E94629F5BA4F31A8F76F425B3AFCC21DA1C61F1954225D2CB2B94CC70B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697810, "uuid": "2a31aaf9-60d2-44db-96a1-f5089c3fcf65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697810, "uuid": "39a861f1-f294-44c2-8281-3b5b3df4d11a", "value": "196608:rQedeIY9MJWqJ14OxDAxOSqMs5zdCHUW0S2CxhxTJ9q8V5spT1c:ceEPMjGOkilW0zCxPqjTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680697810, "uuid": "d335b335-8dc0-44d2-a4b6-3e6bb9de3cde", "value": 17972224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680697810, "uuid": "157f0d23-699f-4ceb-8544-3a020b2f11c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680697810, "uuid": "d44cb085-db42-4a63-9dbb-e6a240db9804", "value": "Q-177.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1de9bb0-d376-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680674333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674333, "uuid": "b9f6be7d-3207-4aba-aa25-d606bd8a2dc3", "comment": "Malware payload (SnakeKeylogger)", "value": "62fdbe4b201f47d997ef781c44d5bc98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674333, "uuid": "7b823ce5-2c7c-4ba8-aab5-21e00d672a79", "comment": "Malware payload (SnakeKeylogger)", "value": "f0e160fc8c0dacffdd789b3a91933fd9c3d629077d25e29a4f69217220689374", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674333, "uuid": "e3ff1bc2-5011-4147-a53e-a11da5ea7885", "comment": "Malware payload (SnakeKeylogger)", "value": "7fd25f28c18615bc3fd7aa1f44ae27686e7e8d8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680674333, "uuid": "22ee2395-9178-4bdc-bbe2-28318b5ad13b", "comment": "Malware payload (SnakeKeylogger)", "value": "d1d12b65bbb541b03fc34042c2b159be03705d0d0dc67bdfbf5cd9d478f6b75c8d8a06b34904b669ffc7a7b6adf87ce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674333, "uuid": "a3528d87-6e55-47e4-97b2-81a6dcfd986f", "value": "T141155DD1F190C89AED5B0AF1AD2BA53014E7BE9D54A4810C569DBB1B36F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674333, "uuid": "9e33135a-f4fa-4514-b2e2-54a7a59356ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674333, "uuid": "8ffe0117-0a57-4144-8e8e-78c508076d35", "value": "12288:fP2as42rFffEMax6pdwyeALoWjX4l2K9bX3eq:f+a92r1N5W8o04kK9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680674333, "uuid": "eddf1a62-77a8-441e-a0a1-3b518d5362e3", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680674333, "uuid": "1f074031-2336-47e1-a657-77a922215a21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680674333, "uuid": "8fe03977-b42b-404e-bbf1-1f1634dee693", "value": "Halkbank_Ekstre_20230404_075819_154055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c858d71-d3b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680699718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699718, "uuid": "93596e95-5bf4-4a05-96b9-d7509fdfc2e7", "comment": "Malware payload (Formbook)", "value": "a6fecea68f4506e6d7f566c2b903e720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699718, "uuid": "1380c6b0-2d9c-49d0-bfeb-eb9036227b97", "comment": "Malware payload (Formbook)", "value": "f0eef09d45e8b0edf907f9fa6f9bd84a33327f62359fef4b92508a413d68c1b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699718, "uuid": "3ef1c697-9ae3-4d62-ab6e-2e6c4d3dfa83", "comment": "Malware payload (Formbook)", "value": "83efe6f1d566a375d8e7caa9e35fc7a7a4ca96e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699718, "uuid": "5f1caf2b-ab22-46af-aa84-b3f9bfaec031", "comment": "Malware payload (Formbook)", "value": "6d92eabf0814bec4a32980abef4de149d803f1e803740a2c0388b899cb1e8c3d613ddba13849a019116e127d33f1f331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699718, "uuid": "3def4dfb-2fba-4365-bee2-474be00fbca5", "value": "T1D8E4124637F98339C46E8BBADCE2211253F4F19E25A2F71C0EC1A5DD5DA3B80C985267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699718, "uuid": "112aa302-fbbb-4458-8e7e-825ac467feb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699718, "uuid": "108f5acd-889b-4123-9c3a-29ca330f5a97", "value": "12288:2b27JXQZNkyUbSRsiXJ55Frfd86PazF83iKLFwoJe1A:2AJUNtLND58IazF8yuFwo0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699718, "uuid": "5c26036f-fbd9-4a79-8356-e98a2ba267d2", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699718, "uuid": "92a5f8a0-6c57-4933-bdce-96f729838be8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699718, "uuid": "aad8d0e9-21d6-4cc1-a6ec-56f8527028c1", "value": "Angebotsanfrage (RFQ).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b863fd65-d3b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680699577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699577, "uuid": "fd30a6e2-8011-425b-8d42-30e305c957f9", "comment": "Malware payload (RemcosRAT)", "value": "7b1f73ebc529482bf3c8170060fc6b87", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699577, "uuid": "25a1f16c-9a35-4984-a221-00bf046bcc3f", "comment": "Malware payload (RemcosRAT)", "value": "f1474f9e0cd1b869ba250d2797a084eaf8c9b784f6c18e2340db471921e917c3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699577, "uuid": "a42d261d-3fe7-43d2-ba7a-3838237fccc6", "comment": "Malware payload (RemcosRAT)", "value": "fed1b7c90e53dd6b366876f96618035fe69faf23", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699577, "uuid": "853989a9-c5ab-4446-96c1-c668fb9e8a80", "comment": "Malware payload (RemcosRAT)", "value": "39f6a9b971ea2b2df1dac954ab25eb894bf65e03aa9996a11ae592ea1011eabea0cb62149cfa017dd6bf2c4f72a9a04d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699577, "uuid": "f9af9a95-4003-4469-a690-a6b045f1e417", "value": "T16E95383439FA502AB173EFAA4BE4B9DADA6FB7733B03645D105103864723981EDC153A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699577, "uuid": "b3438ab0-1f01-4c48-93e3-7eb5bf99cd16", "value": "24576:qC1amPOjlNkiJ2oOvUXem5iJ1SFlMK6AnHwbrOH:ql92pzKlkiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699577, "uuid": "7a02e52e-a496-45ee-b585-6c76da7bf409", "value": 2041344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699577, "uuid": "5b1dc09a-0d4d-4f32-9a6a-8bf7c0b7fed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699577, "uuid": "143a4c0d-a89b-4831-9293-b3ebc7aa43f9", "value": "DHL_Mar 2023 at 1.M_9B7290_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb880a22-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680700441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700441, "uuid": "4c30037d-8c56-461b-8ce2-039afb6cca19", "comment": "Malware payload (AgentTesla)", "value": "2cbbbe0fafc990de6931084ef81ff9c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700441, "uuid": "0bff41c6-78af-4300-a8a6-6464238db981", "comment": "Malware payload (AgentTesla)", "value": "f176afb0e949e8898728f53d6621a1d53e5daa49c0794e00a7c7b9b9224a0f2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700441, "uuid": "0f8cf680-bc6a-4bc5-8bb4-60d906f08c25", "comment": "Malware payload (AgentTesla)", "value": "c2fe690665aee07042f18bcf15c533d62c1053fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700441, "uuid": "ba5785a9-6185-4f19-8c99-103e49f904ce", "comment": "Malware payload (AgentTesla)", "value": "fbd4735864c64f2b0fcd695b6556abb6eefd671497bae7779d9e465c2a2c536593c2c598f734e13dc4bc0a0030550a39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700441, "uuid": "6c0d3a00-d154-40f3-bc18-c9ddcc00b252", "value": "T16CF47B2E8E54C6F4F67C07B5D0D33F191DA809A287D6851CB97760C63B85B8A5C0EA8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700441, "uuid": "2ce77eee-7350-4063-8944-602f6cb4f92e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700441, "uuid": "af0cf248-bcfc-4657-ae9f-89480505cbda", "value": "12288:jwFZZdN2iN8Ni2jxYDo/OiPL6oGlHzG4NeeigC+z9SIDFADSSMoASar55nR9n9:jwFZHN1CdbbPLl8zviiVhb1oAS25bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700441, "uuid": "4d6a74d0-ad9f-4202-a12c-596278666497", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700441, "uuid": "2a567d91-683b-476e-8e3a-953d322cf7af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700441, "uuid": "f971bc0b-c440-4414-a582-68061be03f60", "value": "2cbbbe0fafc990de6931084ef81ff9c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dca0bef-d3a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680695479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695479, "uuid": "8a3df394-0740-495a-82f4-097282d1481f", "comment": "Malware payload (AgentTesla)", "value": "46933a777b413e9c28c7207134688e72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695479, "uuid": "8a8b6934-fb9d-4741-b223-4e0fdc88fbde", "comment": "Malware payload (AgentTesla)", "value": "f1abca8d739cca8a00122dbe15ac461e0b0114451e351c339bec22b585e488c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695479, "uuid": "619941d3-84e9-406e-8294-0d2957919640", "comment": "Malware payload (AgentTesla)", "value": "798abea70f227ef181f0b22b05ab4503b0cb86e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680695479, "uuid": "22251c41-f6b2-4b2c-ad4f-371c4eb967d1", "comment": "Malware payload (AgentTesla)", "value": "462c6581d0c658555389fb7cc880d05a632fa51641178bcfecdc4e3c1cf160c71577498516601df5f79d1fafe1f062ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695479, "uuid": "05ebbc97-c628-46b4-bdbb-d77b91064f28", "value": "T11893180A1BECD913E97E87FD90A302210379A113E543E3D71FE1D4E56E5A78689027AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695479, "uuid": "62bece7a-241c-4319-9636-613323c57069", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695479, "uuid": "7ba6dc34-1c51-4fa1-aac4-be885cfaa640", "value": "1536:tZ4ZDtuztig8TxWJA1MxkihCzW9LvMLOkoscI9upQI7PPxB:bqk8TUJA15zqLkLOkoU9uiI7xB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680695479, "uuid": "f2163fe4-b6e8-4362-a134-d2d6f0d0c9e2", "value": 95512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680695479, "uuid": "1223082a-f39b-4374-83e3-5754780819ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680695479, "uuid": "df648a51-1a61-46f8-b5d5-ddb812de1f38", "value": "f1abca8d739cca8a00122dbe15ac461e0b0114451e351c339bec22b585e488c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d4128c-d375-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1680673848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680673848, "uuid": "e8cb5b08-a543-4c7d-ae7a-d4e2d3dec27a", "comment": "Malware payload (Vjw0rm)", "value": "ba46627336f749aef1adfd78f958212f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680673848, "uuid": "60592cbf-1f7e-4ee3-bcc3-6913adea25b3", "comment": "Malware payload (Vjw0rm)", "value": "f1f985bd12efabd68532363a591006c7d6731eb81c3b4dfde0c87923d9d544b0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680673848, "uuid": "a05eaf84-1160-4f74-9739-3a4bd1c320d8", "comment": "Malware payload (Vjw0rm)", "value": "7fce56ef8cbbf08e12c645d01fa0df595af04cc6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680673848, "uuid": "4d41da42-8848-4ac2-8a69-f533ffacef05", "comment": "Malware payload (Vjw0rm)", "value": "415ecbe5da528bd307a92de164dddccaf78df417309e52695cdffdfea2a5ca09195044e9a8d437007a46cc932a715771", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680673848, "uuid": "be1f61e1-7e3d-4bca-8020-a275ce7be134", "value": "T11A71209C285BC62843D27B8A902ED10CCDF548B07B28D2B1148CD6C5360E9BA87F59BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680673848, "uuid": "4df457db-a67a-4982-ae44-9292b3915b25", "value": "96:SABNo5Drk2c24ZRMHXE6/BI2w+Ys+fJADdQqR7bJy7Kt:zSc2c24ZRMlBIYYs+fJGfRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680673848, "uuid": "d0687aba-9374-44bf-b733-48b4d52e303e", "value": 3660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680673848, "uuid": "49fbe1fa-218b-4533-9b2c-1b672ab27ada", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680673848, "uuid": "6594912d-0553-45f0-a8c4-0e13312042b5", "value": "customerinvoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c2f3ed-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680718209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718209, "uuid": "989939fe-baa8-4cac-b795-25599aabb994", "comment": "Malware payload (AgentTesla)", "value": "8d3f1f94a721caee9cc4e9abcd7e72a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718209, "uuid": "a1ed82de-c001-428e-b627-e37a24d30d0d", "comment": "Malware payload (AgentTesla)", "value": "f21c0e41fbff323c6ef42354825edbe3a77f6ed977c2cb35a50332dcea585654", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718209, "uuid": "27ee585f-a4b2-44f4-9ce1-51f1abe3461e", "comment": "Malware payload (AgentTesla)", "value": "164a4788b7ea75b53c747c4db667c5f907efe1de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718209, "uuid": "cb7708bf-e8b3-4b3d-a089-410651242daa", "comment": "Malware payload (AgentTesla)", "value": "2ffe9b4a3b182cc7e7c50a8134cce2b8ef99085d06a3c6c1cc5986d0cb6a8c66ec36d54a7908a550b4ac7ee5ebffd88a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718209, "uuid": "6f8fa632-9c64-4ec0-8ab1-f77056a2981c", "value": "T1F124120752EFCCB29C527123F6A9A3A64B43CC5147FB6895A47ACC5B2FEAF032057250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718209, "uuid": "d2efc95e-7dab-40b5-a0dc-a82d0381462d", "value": "6144:MKv2S4yCHVWj3Xw3n7D1nDsqu4xYYvo4f0vc:MKeZHVIg3/1Dsqu4xFvHkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718209, "uuid": "70d008d5-3a37-4129-85d8-d6907768b34d", "value": 218132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718209, "uuid": "17c5e18c-1d97-4a2f-beaa-36595ab2262d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718209, "uuid": "45e4ba3b-b373-48b2-8f9d-008fd3ab756e", "value": "785b0132-e196-4271-5702-bc9b22c8a5af_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4e0dfb-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680700365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700365, "uuid": "f25dca4d-0d39-4b6c-9abc-172fa014ff35", "comment": "Malware payload (AgentTesla)", "value": "baef837e12c5deaa2459a73398749217", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700365, "uuid": "3f0c32f2-4af7-4cae-92f9-051c1bcf9cba", "comment": "Malware payload (AgentTesla)", "value": "f2227038e0ff26cbcf040a694c1e6e0fd3c42316179c97eb539744aebc4ec0f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700365, "uuid": "21f61f68-ce3f-4e91-8a14-559653ad5bcb", "comment": "Malware payload (AgentTesla)", "value": "157242e38eebbd0d84aa9d5568d99768d1610944", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700365, "uuid": "728e7d4a-ee01-493d-b4a9-6dc494248fe2", "comment": "Malware payload (AgentTesla)", "value": "cad4c0485055221416f854d42a4511bfd91da031ae173211a225e994ff53a1e00f0989dcb16024c1d2be6b6bb14efc0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700365, "uuid": "c0de0101-12ef-43e3-bafe-54348f9f039c", "value": "T12BE4125973FD8B35C09E1B7BF8A6311507F4F63A3092EB1E6DC196E84DA374098112AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700365, "uuid": "ac524cc2-fdac-4189-853c-02081192c7bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700365, "uuid": "9436f428-2632-46db-b15b-9a082d6fbc3d", "value": "12288:XxgKMupv8myT55upXd92/K4Hil8m5VOy9rx3SEo/:XBF8myTDmi/sl88Oy9rBSEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700365, "uuid": "3cf3c585-c76c-4340-8c91-24f47fbc8ca9", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700365, "uuid": "6ec2bd28-087f-40a0-83f9-ae1809b0372c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700365, "uuid": "cbf276ea-23a0-4b03-b1c0-bc78bd8c87f4", "value": "baef837e12c5deaa2459a73398749217.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae749f9-d3f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680726774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680726774, "uuid": "ba8b379c-15bd-42fd-80aa-0a37812c47bf", "comment": "Malware payload (AgentTesla)", "value": "6c1bcb28fa11d278923d9c9d205b9ba7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680726774, "uuid": "ba20e792-9b7b-401f-ac73-2410d68d1f30", "comment": "Malware payload (AgentTesla)", "value": "f375bbb04fb38ff87c1112755329594198795e41c54b9629e04ba5c6e92a5dc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680726774, "uuid": "41cb9d0e-f820-45ac-9edb-e4151671b792", "comment": "Malware payload (AgentTesla)", "value": "1dd5d1ffafc1fad4739722e51d31a20adb1fec10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680726774, "uuid": "d0e71d7b-4749-4dfe-a0f8-d1d191140fd9", "comment": "Malware payload (AgentTesla)", "value": "cd3e79e0ab01c6ac92407f2dbc466d14c7d19d3514a25a334159ccdb156c8785b2b954a64cee9410a27c6ec62a21f368", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680726774, "uuid": "71afd1c6-a9af-44a6-a85d-46d210fa5c81", "value": "T13E75CFF315C3FEE9E3A61D649DA716084E805AB7131CE48879CC0DBA7365922EF90DB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680726774, "uuid": "0fe65107-660a-49fa-a395-e1556e3a2694", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680726774, "uuid": "d2532a87-1ee5-4096-a24f-8b8b3e661e32", "value": "24576:F5Nj95lUT0omEuaVElF2EAyYgqhqwPN9dxJv8EkJA5MysoV0DlHwmPhHnEFyDeDJ:FPLoz1EAh7TZZdbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680726774, "uuid": "264c1357-5ecd-4e2d-af2a-ee618149b928", "value": 1600512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680726774, "uuid": "01ee3ff3-d030-46cd-8cb9-e709da929316", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680726774, "uuid": "fb9ea013-46c7-495a-b376-2f7f9e67900f", "value": "Legal Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f72c9a-d39f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680691602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691602, "uuid": "ddf4b3b6-1bfd-4ea4-823b-f4d04a4216f4", "comment": "Malware payload (Loki)", "value": "43df3fa5613f23e948f4225162c9ee4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691602, "uuid": "fd3c1d7b-96a4-49f4-9c1f-eaeb1fc6eac1", "comment": "Malware payload (Loki)", "value": "f3797cb6054ef9d5de1b4ecb2745424ef0481c5cb28ec2f2384d2591019e1650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691602, "uuid": "bbb8e745-9b2b-4209-a3bb-1aa9765a8a11", "comment": "Malware payload (Loki)", "value": "958ee9ff153db4135ae9cb071b8afee46f93d149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691602, "uuid": "8a2967e1-3e5d-4bb7-b484-ed6ba44927f6", "comment": "Malware payload (Loki)", "value": "e9d5e8953110b5865eeaafa9ff2bac3b187eb5dada1487a6dd4432d9aaff1ff1bb6ed03d2cb277e5ae3c153e270e93c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691602, "uuid": "004d9f6b-9d5d-4caa-a2c1-dbe5072cac6e", "value": "T1CDA31A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A18215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691602, "uuid": "e4dd3681-7609-416f-9e22-2096bdce7cbf", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691602, "uuid": "d6c33917-b364-4e9c-b45b-f5ded905b46f", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmda:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680691602, "uuid": "75980fcc-f920-4169-bffb-3155b251a2d9", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680691602, "uuid": "a2053214-cc68-433e-a46f-4e4ecdd5afee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691602, "uuid": "61a6c7e7-dd03-40fc-b6df-74053e2c9b6e", "value": "f3797cb6054ef9d5de1b4ecb2745424ef0481c5cb28ec2f2384d2591019e1650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e7d9e9-d402-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680734097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734097, "uuid": "b0335b13-f6da-454a-86ed-de496633084b", "comment": "Malware payload (AgentTesla)", "value": "c8aa684b3af185913e410c5ebcd9896d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734097, "uuid": "929c87c3-133a-41a1-a8d6-869c8185597c", "comment": "Malware payload (AgentTesla)", "value": "f42e60668233c45ffff84a02ef612fdca79c062db392dfcd2b3dd8a4e9f00c7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734097, "uuid": "788fe75e-0a72-4cde-9c05-664c06067521", "comment": "Malware payload (AgentTesla)", "value": "94c204bc78cd749492edda35032e3f9a4743a703", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680734097, "uuid": "34a616b5-d4c1-4843-9b42-785452eda1e7", "comment": "Malware payload (AgentTesla)", "value": "4347fa124467d660cee96cb48e59fe6f4f83ee797cb3b11c2fb84315e8abf9c5d51de3f3dc6362a51a1cd5549763df5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680734097, "uuid": "779744b0-d945-44e9-ba88-fd9b84dc48db", "value": "T125F4011033CDCA48C47787BD80E0D1B063369DD6E961C7274FCABECBB2DA75A562119A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680734097, "uuid": "a5189efc-8b8b-4f39-94fd-c0c4cb8bd5d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680734097, "uuid": "5496f799-16ec-4f0a-a84d-bfc9b7b5e7af", "value": "12288:9xlqHtYCP0imOMt+wcZS0MjrJilh4WKlsbC8jJ6fxPoxrde7S8etUVcHq:9xlqHtYhimX6S08M2WRWgYwQTeG8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680734097, "uuid": "bc9c2f50-c2e7-41d3-ab18-6b5d1d2d3901", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680734097, "uuid": "3b2bd4b9-8637-4377-a58a-6b9c2de42478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680734097, "uuid": "c987ad38-a500-4272-99d2-6f5f0071e281", "value": "9yzbkz9U2BOHoF5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e13b3e8-d35f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680664287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664287, "uuid": "20df4e9c-4a57-46fd-8923-af240d27451a", "comment": "Malware payload (Smoke Loader)", "value": "8000a09253ba9b07c4b7537629754948", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664287, "uuid": "cf1d62ba-72b4-4fab-84f5-5ea4351b19e0", "comment": "Malware payload (Smoke Loader)", "value": "f4f73fdbd57a6b49d01eda240aa58492dc3904fa6e2d11113c691fc26cd00e60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664287, "uuid": "539bb462-9441-462d-ae9c-dd681a65fa98", "comment": "Malware payload (Smoke Loader)", "value": "63352af31b395542c14266d191fbe60ff39c8cb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680664287, "uuid": "1bcc7b9f-7e93-426b-8994-1b455a59f54a", "comment": "Malware payload (Smoke Loader)", "value": "93dd453e7417073038c3987ce82e450a0d4dbf1e56a0917150758f76f2b79d6be97959b4c055adbc1d3296278ee2dfef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664287, "uuid": "0e7a1014-6d81-490b-b921-be844f844762", "value": "T129449E0163F06830E13B57318E6AC7FD2A6EB461AD65BA5E17B9893F1D303A1D23271D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664287, "uuid": "7fc7258e-e388-4155-bafb-03ac66cec569", "value": "347f2e8ea0dc4c8c2fb93a44134e1752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664287, "uuid": "fc2fcf8e-d7c6-406f-96d8-fe7d5c233eb2", "value": "3072:RV3SXYj1CrhTsvVUgzVrSETJwIiSmtQibunrOLeKNZT2D1PYBbYnkGqaJSNn:WIsrhAXxSEFdiIiCnrON2DxYZbaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680664287, "uuid": "20ca95ba-ad0d-4009-8712-d705c936ea8c", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680664287, "uuid": "0cb0a88e-e8f5-4574-9e2b-85c01a53e33c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680664287, "uuid": "9572fd16-3560-43ba-92dd-c20cd8065712", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4870cd-d3ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680710031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710031, "uuid": "961df37f-ede7-47df-95c5-0fcb21883180", "comment": "Malware payload (GuLoader)", "value": "524bc327ef4327c2510f5187856bac5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710031, "uuid": "cc0421e6-b8f5-4e63-b6cb-c717e4e93424", "comment": "Malware payload (GuLoader)", "value": "f582e0ab6415e885bf0a2036a2427fe0bc62d0316e26cd1b94c3b9066ed4a7bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710031, "uuid": "4908d3c5-5e10-49df-af74-fe583b2a02d8", "comment": "Malware payload (GuLoader)", "value": "0e9f6601e3b8e9aa3efe0d794c64d7dfa960bfe7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680710031, "uuid": "26817baa-844c-4e69-b3d1-056a1bbf23f3", "comment": "Malware payload (GuLoader)", "value": "eded8dbcc8e15d5c497aa6cf7067336d1afebe29fb4fc5d24ea2a267942f0db7d87d3c1107fcf746e8fc794cfc9583f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710031, "uuid": "47c4c3ca-59aa-4257-a6f1-5413a5062ce3", "value": "T1CF6412216111C46FE9D26F32086EF32D8FBAAE046054216BB76D794A7F737C2C62E117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710031, "uuid": "602bd264-dd54-44fa-aabf-f58d82ee7d86", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710031, "uuid": "2c56ccf5-0939-4341-beda-813b2a39d4f4", "value": "6144:bLsBN8xoIdFgPIvjmK1l3yaTF+7Uu2wTxSulL4V2WHQ4gYeXCnVqBzuqLXHlA:EBCKI7lieGUuRdJFPeQBJLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680710031, "uuid": "f45fafa1-d752-4320-8b94-693c11daecc1", "value": 337000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680710031, "uuid": "5055e4e6-f033-44ed-aeb9-0123486695f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680710031, "uuid": "4e08a65c-a571-4a83-9cd6-5a7a1935f26e", "value": "f582e0ab6415e885bf0a2036a2427fe0bc62d0316e26cd1b94c3b9066ed4a7bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71095b05-d3c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1680706759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706759, "uuid": "7c46c37b-f5ee-46fc-8232-5a119805bbcf", "comment": "Malware payload (Stealc)", "value": "a4893b8fcfcfb1f0d00d4572cf53edd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706759, "uuid": "28aa7065-50dc-4bef-a1cb-9caa73fce632", "comment": "Malware payload (Stealc)", "value": "f5b153d43f9a0c095b38d9849aa369c800518e0ca4cda965dc539e97e34bcbd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706759, "uuid": "88db6fce-1907-4737-b451-04a242668710", "comment": "Malware payload (Stealc)", "value": "5820a6e4dc25c2267140f66bf5e7025740a2f008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706759, "uuid": "45531643-94a7-4d83-9033-36e28bc2e162", "comment": "Malware payload (Stealc)", "value": "8aa12b4dd163456739e8c62f8cd72ba900fd3098858473f76615bcfedba3800644b81c99cd19e9a42c3bcc02950e9759", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706759, "uuid": "60824cae-5d19-493f-bf0a-616b3dd503d4", "value": "T13F83F83AE36291B3C812D5BC724C1AD6A53A84B5715ED183BF845F429CF01C2ADC9F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706759, "uuid": "a1182ab1-74a5-410e-b508-4c883ccac67f", "value": "dea7238b333040c9efc51e6ebcf59a51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706759, "uuid": "22c98d75-9559-40a2-aecb-ca2784febca0", "value": "1536:WMOvoJ5iHi/67i7iHrvI5Z96BLyT/h3djRYvlr0jtpIIt/:WMTJ5iHi/67keMf96BWV3dEripIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680706759, "uuid": "444b5b4f-9de6-4571-afaa-9508d26597ab", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680706759, "uuid": "095336cf-7746-4024-bffb-05587a989f13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706759, "uuid": "bc877db4-7770-4948-9cc1-605493630b96", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c50783c-d3bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680703583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703583, "uuid": "6421c246-0a91-40ee-accc-0ab1485d5890", "comment": "Malware payload (Guildma)", "value": "1a967c13485cf49e7b14e27ff77e5abc", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703583, "uuid": "08e84bb8-1d8d-4c07-ba89-fb3960cf779b", "comment": "Malware payload (Guildma)", "value": "f6f6134207ebeb23faff997bf0f7fcced709ec7d8300a665397ed1c505732d6e", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703583, "uuid": "2c8a5456-74be-4468-ac9b-62d12c9853da", "comment": "Malware payload (Guildma)", "value": "df0e1df1ebb3842f9e5b93fe8a52aa3898c0e3cb", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680703583, "uuid": "890868a1-fe4a-4c3c-91f1-f4206b4bac92", "comment": "Malware payload (Guildma)", "value": "3519c2587adf8871e477c020da52ddf886bdf23b8e711151b8acb5e1b20d88842d857588f2188d82acf50d7af5bce6de", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703583, "uuid": "c1a9984c-1fbe-4af8-bbd4-d1ffa24803aa", "value": "T11CE02D0E64E31A32200C206C3AF5869D0B1C7C304DEABC0BB716C2110D04C08863FFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703583, "uuid": "4497ace3-7c97-4a0c-be38-be47f68f48c2", "value": "6:SGIfGlkiDctnciyyksIjdbML6UOmkFmsXefIhvycSmzpYj23WgBAKSSz:QgkxL6jdbML6UOm0m7fIhBSmij2mpKS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680703583, "uuid": "5a711d66-b299-4379-a5e3-e1dcb7c6c889", "value": 337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680703583, "uuid": "76f49bdf-9bab-491b-bb32-f232296d807c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680703583, "uuid": "6dc300f0-50f2-47be-b7ea-ed67ca31ccc3", "value": "Curriculo_46892763921.948622.26491.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24bc10fc-d39e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680691169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691169, "uuid": "e042cc27-aae9-4c43-b106-23c326217b23", "comment": "Malware payload (RedLineStealer)", "value": "9b898510bc9f3c2b3a7b99fb973c9ef1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691169, "uuid": "cff9313d-73f1-4d96-bbb7-1fef6ce09825", "comment": "Malware payload (RedLineStealer)", "value": "f7b9af650a3156f41f49653a82b82ed87f60675bd58a63f8c148fb1bd55eb7e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691169, "uuid": "d1707999-f35a-486a-b073-a88dbf216b17", "comment": "Malware payload (RedLineStealer)", "value": "e1cb814409938c65d294e183b523ea8508de4f9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680691169, "uuid": "7553f661-585a-4265-8e29-d670476ca333", "comment": "Malware payload (RedLineStealer)", "value": "a348fe2af5ace92580d16aa90d58f8d6844a90ddb9ba2801aa46293372908e0957e7c1794dcaf1a5621851fa1866884e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691169, "uuid": "01f2db96-667a-4be3-9f22-a0e34eb752a5", "value": "T19104B51437BCCD11E1BA2A3F6961A05147BF98026852F25B7AC367CD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691169, "uuid": "dc73fb4f-e2ff-4cb9-a75a-75afbf625a2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691169, "uuid": "7fa67bd4-1b10-42d4-ac10-8fb8e9af3073", "value": "3072:yxqZW11a2kX8fqvPIeJBeGg9ShLrxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOJ:gqZkqvPZJ8Sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680691169, "uuid": "7a49e724-68c6-4496-885e-fdb0c31da4f4", "value": 179337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680691169, "uuid": "b61fb633-467e-44a0-8e22-4d7f5aebb936", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680691169, "uuid": "c621a693-4797-4671-aa29-7cca6472c176", "value": "f7b9af650a3156f41f49653a82b82ed87f60675bd58a63f8c148fb1bd55eb7e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45506bca-d3a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1680694230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694230, "uuid": "f4e637db-366a-4cd0-9134-edc2a6724d7a", "comment": "Malware payload (DCRat)", "value": "9a249d7b2b35232dbb3d8e37b217131e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694230, "uuid": "1971772f-3a62-4a1b-9a01-e16d60a9cb0a", "comment": "Malware payload (DCRat)", "value": "f7fd8ad79d8942b17fef73f4d5c8b16a12e024e0a33a62a524debe9518691a2a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694230, "uuid": "8688ce0e-fc0f-4c2f-8f90-df10657f2efe", "comment": "Malware payload (DCRat)", "value": "e26b41ea112c8ad1644115ed010f7c851bbfb965", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680694230, "uuid": "8a5be813-ad53-4280-87ae-9bfcb6b6b732", "comment": "Malware payload (DCRat)", "value": "f52117a4ef12b373c3adb38cd5dfe0d682bf32b2e3739e7c814ae96e3cecc21905aafe3e6eddd1577956ff7e59edbbf7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694230, "uuid": "2707ea2b-f5b4-497c-aaaf-2cd67c2fce4c", "value": "T15F24AE007A95C0B2D41381315875E6F8667EBC72AFA6D6C773AC3F6B2D322D16A36350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694230, "uuid": "43dc0b29-c7f5-4f44-bf52-e7acb22d4493", "value": "7e3b1e18e4b8642ee42be6e8ca53a819", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694230, "uuid": "acfcd642-8321-4807-a12d-e66386a3f868", "value": "3072:J+b+cHVpGJWHz/nwGldGisUgXyNjU7HG45sjuS7TNTw:Ibn1IgLwGGimyNjUwjrTNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680694230, "uuid": "63deed25-5468-4abd-b308-df5b10b0596f", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680694230, "uuid": "278c409a-d360-4ab1-be5f-9ddb978a24f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680694230, "uuid": "843ad46f-5eaf-4ede-b25c-d68de3e11e29", "value": "9a249d7b2b35232dbb3d8e37b217131e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a084bd9e-d3b3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680700396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700396, "uuid": "b1c8ba93-5e4a-48f8-88f5-f077182d0f8d", "comment": "Malware payload", "value": "b1d278073d5a3bc05bf2051d1ef5c5da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700396, "uuid": "dc1aca86-f1af-4351-b7e8-fc0cd9192d9e", "comment": "Malware payload", "value": "f820de2be806a1ab3151aa4c97efae9fbc330e26da0457a4f01356291bd7da4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700396, "uuid": "e826bdf6-1875-443b-8936-1fd40c77862c", "comment": "Malware payload", "value": "3cd9c38e0e44dce1326188a8f7aa4d53ea6a9409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680700396, "uuid": "900d1935-6461-4030-88f8-ddd2ca4f1cb2", "comment": "Malware payload", "value": "aa871da7f2468e780a1f62f52b475ee9e14aca1096f3a6de81f06ad258febfaa25561ffd0a49e9597f706597c9acd19b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700396, "uuid": "b7774ee9-cdad-4cc2-a14a-a215076b067d", "value": "T1D1A5AEF9D7E352D3F8326A36CB92527460323EC5A4E45DF556C8BB2C49301DEA21E92C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700396, "uuid": "578db675-fd15-42b1-b64a-1cae6ea63d22", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700396, "uuid": "756e55c1-3777-47c4-86a6-87baa094cdd3", "value": "49152:+AWuxppnjE0I+qcEcURLcJ8+o9kjFFiniVk:+NuxppnjA+gcUyVo9k/YUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680700396, "uuid": "9c5b7284-8f25-439b-acd6-52d8acec0dd6", "value": 2236208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680700396, "uuid": "701e0ff3-e38a-4cd6-94df-869131ca5486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680700396, "uuid": "4c055c1f-5de7-4823-b0db-4b5e57a0a58d", "value": "b1d278073d5a3bc05bf2051d1ef5c5da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ad97f1-d3b6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680701725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701725, "uuid": "37075824-59e8-453a-a36e-d687df1a1f70", "comment": "Malware payload", "value": "972bd0c53dbe2fdfcfbf0d34165fc879", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701725, "uuid": "f1988099-1191-4b32-833b-c8f8d116941a", "comment": "Malware payload", "value": "f8a344532b9c8dba36b351ce752ba35853e625ac627d231a9c0cbc6db980f017", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701725, "uuid": "38e03ca1-3676-4df8-8948-2626873fe3ff", "comment": "Malware payload", "value": "cca8afa0fbbf985ac6a0921e2fda9bb04028cf22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680701725, "uuid": "1220382e-4c50-4c22-95f4-cf7ebfb634d7", "comment": "Malware payload", "value": "c70759715f7de129de90fe74fc64512fe075f947afb35f00cc4c783992fe2b2c101486309b5f03b6af9012759e24e220", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701725, "uuid": "2bed9adb-6a53-4c91-b38b-60f47606699c", "value": "T1C425F114E2CE8649C405B23EA5D7D2BC6322DD99E966CBC37BC9BD8FB2BAFC41045141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701725, "uuid": "5ab29241-1bda-4d6b-9c07-e4b9bdb57a31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701725, "uuid": "5f251e4c-9b38-4f86-81c3-38269fc0116d", "value": "24576:RAimXBHJyYdjgIRrVVyAsAEuAedSwDInbFy7zf+:6yYdjgIRr+A5NJdSwoE76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680701725, "uuid": "6e2bb732-14c9-4d93-b11a-9c7507ece50b", "value": 1025024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680701725, "uuid": "c99e63b6-0a11-4bbb-bc6e-9b88bc42ea97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680701725, "uuid": "97310ba1-cdeb-4151-86e1-cc81ea0b9889", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4921c9-d3b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680699857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699857, "uuid": "70ddb016-4c5f-41c2-a020-c5ed0b79b518", "comment": "Malware payload (AgentTesla)", "value": "c8b5d9c2cfe9e5c6ccfd97d5412c1a19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699857, "uuid": "d8ecefd2-96c4-4b0a-ba08-2ad9cebd657c", "comment": "Malware payload (AgentTesla)", "value": "fbf65313c5df97b4605857a062c5f4161d189395369346927520cc2811a1a711", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699857, "uuid": "7d719eba-48fa-4692-98e3-d176a1f8a1ab", "comment": "Malware payload (AgentTesla)", "value": "0b9241d4935da2c799c78ee445d1b0d85e8e422f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680699857, "uuid": "cd9a01d9-e42b-4401-b7ef-cff6daf4a0a4", "comment": "Malware payload (AgentTesla)", "value": "0ff3d32474a5854e7479400b04873bc2b72aecb158bf4dade3a5d82fadab7c309669f9c53a3dfda7806a4cf02f76c22f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699857, "uuid": "a1245af8-fde3-4845-8e46-5c112dfdb388", "value": "T1BBE4122423F45B32D90E8FBDE8F5314483F5F92A1453EB4D6ED1B8EA5DA73408A006A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699857, "uuid": "bccf4bc0-e794-4fb4-b566-b2c3cf245a8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699857, "uuid": "f1bb012c-362f-43f1-9da2-3898972e571c", "value": "12288:uQZyKEbQ2PbXvV89W/68koZnHKIciMjxlt4nxXOw9M6NlBsB0:uQCbQWK9GNdncpNvUY6NHsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680699857, "uuid": "85f8ffab-b793-492e-86ca-90d180ab6342", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680699857, "uuid": "b4aae3f6-dfe7-47a6-99fb-2b50993a08d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680699857, "uuid": "bde92df6-1f4a-4e39-8dd7-a1c5bdb29fd3", "value": "Quotation request tender N\u00b0 052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ccf3a9-d348-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680654336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680654336, "uuid": "bc525aca-ee61-49cb-b178-30b79c7695a5", "comment": "Malware payload (RemcosRAT)", "value": "0e71408d394b8b78ae90813be74e3047", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680654336, "uuid": "060c5003-6222-453d-ad37-a528485ec533", "comment": "Malware payload (RemcosRAT)", "value": "fc2bcad21d96b3e31b27f0610209f0aa33fb1aa83504e8c346d390ac2da19504", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680654336, "uuid": "1be0806a-b30d-4414-baf4-10a28bbea3cb", "comment": "Malware payload (RemcosRAT)", "value": "966865cdbe92c4f5add92c7182ac5bfc1d54a03c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680654336, "uuid": "779ecb21-ae19-4044-8923-9471ddadfeb5", "comment": "Malware payload (RemcosRAT)", "value": "6d6e25bb3d8997d2157cc0a0f29c01a1611995c482e74d1c7f1848cf279f0e23bdb71944b8115fc4e32869ad2a752234", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680654336, "uuid": "df70f843-299a-4a74-a073-44faa1fb0ea3", "value": "T17315235E32286669C53D17BDE823B10507B9982970E2F36DADE428DC0E77BD4CDA18C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680654336, "uuid": "e29058b3-487a-4990-a5b7-dda390e75f7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680654336, "uuid": "0bda55ad-4e2b-4ddb-abe6-51e106193d1f", "value": "24576:NTn83l5n6i2YWGVjTJZHWFMwH52Sp7UkG:NT815n6hYdJZHWFMOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680654336, "uuid": "08b02f09-6984-4662-a8c3-2c175f1cdd89", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680654336, "uuid": "d5aadd35-525c-44cd-aa60-fb4aad789d6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680654336, "uuid": "f763dff0-fe23-4ef1-ace4-2f0eb47db2cf", "value": "0e71408d394b8b78ae90813be74e3047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765c1625-d379-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680675414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675414, "uuid": "68c6aaed-f818-48da-bebe-2ef7efaa22dc", "comment": "Malware payload (Mirai)", "value": "97a3cab0120ac895b6952af64f8e1c43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675414, "uuid": "a1f57bcc-69a4-46db-8ce8-5068169c4d69", "comment": "Malware payload (Mirai)", "value": "fc9572b4f4a7611a53796d598d0e7f7777615af681c8540c490b1786bf5b41de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675414, "uuid": "c3fae11d-2be4-4a6d-b39a-e424a80d753c", "comment": "Malware payload (Mirai)", "value": "b8d2ea4911320cbb4b1e5959bc44d4364aa9a1c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680675414, "uuid": "2e9b7f77-5950-45bf-937c-2c907fbe4c52", "comment": "Malware payload (Mirai)", "value": "952d032d6bcc721d64c98c14c7b285d87dca9805ce2bd306a65151ee118b91fa95268167028fed704775960098a86aad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675414, "uuid": "3bbbe0f0-e853-4611-a78a-964a4dd388b3", "value": "T12E934BDAB8019C7DF84BDA7B4423490AB530A3510FA31F3BA397BD67EC3A1A45C56D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675414, "uuid": "da0a416e-df7c-4068-9695-9ede4fea0979", "value": "1536:jDokKeCYB66lFfKodl97SybYmylH8gf7abADiQN7/OjCCW8JA437DTeTBnHz:j26jfKodl975Umyln7UQ5/I04DeTBnHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680675414, "uuid": "55300cc5-e5b7-4cf4-aca7-b719b270d5d3", "value": 93628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680675414, "uuid": "1fa8e1a9-64cc-450a-a780-f6f27eeb36be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680675414, "uuid": "f54c5653-5dc1-432b-92f0-bb2b09cadd2f", "value": "97a3cab0120ac895b6952af64f8e1c43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3409eeaa-d3c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1680706227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706227, "uuid": "3469968a-241a-4c0e-a700-4c1e26dcd880", "comment": "Malware payload (DCRat)", "value": "a26ae5eb4e86ca54a1d338220318c43b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706227, "uuid": "c240a816-6a3d-4c03-ab66-47b452b6a913", "comment": "Malware payload (DCRat)", "value": "fd687a05b13c4f87f139d043c4d9d936b73762d616204bfb090124fd163c316e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706227, "uuid": "b16e1c06-828b-49e9-b6b9-dc21e87c5397", "comment": "Malware payload (DCRat)", "value": "ba66b537f8b7289acf611e67e1f3b20fb5bb48db", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680706227, "uuid": "a588febe-06f9-4e7f-86f4-606f5cd6e49c", "comment": "Malware payload (DCRat)", "value": "490abda659a3189c8f272a6d4250641dc08cf9f716b1a66c74975bebadb58ccbe08a190fc3b9a1641d88dfce43bc2b86", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706227, "uuid": "6be75f04-7550-414b-94b0-20c7c0e760fd", "value": "T1FF64133F5FD882B3FABD057C8072956A41289CBD4508E26DAC4446F52B1BFF3625D2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706227, "uuid": "da8c86a3-50c5-4826-b603-3133be093382", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706227, "uuid": "de444c13-5a83-4c64-b5a7-514e1f0032c5", "value": "6144:1RmCttlxSX8YOKPnzxx7YyRRYz4OjnYDh+OHYQmrBQ4rQbFZUzEo1V:vmJMYt/czYDh+OOQMQbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680706227, "uuid": "6945069d-ee18-4b63-a200-ecf4cc790439", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680706227, "uuid": "70f44299-063e-44d7-8969-1bdf0f500dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680706227, "uuid": "3687b876-2e09-4063-8a52-cad6055f8ab9", "value": "a26ae5eb4e86ca54a1d338220318c43b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce01e74-d3dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680718214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718214, "uuid": "d1671c52-d59d-4bc7-9204-9d18690a9ef5", "comment": "Malware payload (SnakeKeylogger)", "value": "b1923cb1dd4ea630e094b656e84b4b93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718214, "uuid": "68aba67c-a775-467a-94d6-b3c92177d6c7", "comment": "Malware payload (SnakeKeylogger)", "value": "fdb92c62f94ffa5a8e8c9196783e198490990cbdde77bc84c1c342b6a165d59b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718214, "uuid": "a6acd68a-4b6d-4658-8a0b-38765d85b7c5", "comment": "Malware payload (SnakeKeylogger)", "value": "70beef5841f56ee6cf3466589637207430cf61a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680718214, "uuid": "8179759e-43a4-4bad-bcb6-5871c6fdeb5b", "comment": "Malware payload (SnakeKeylogger)", "value": "d38c6040dbe3f9a3b4e64ba3c4824e0756289a9a4bb51e786555ed2b6ace3b7cf4a9067e0c6fb9865a819e9c25192227", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718214, "uuid": "0bbb7e89-8ab9-471f-a842-63e78ffcb344", "value": "T15CD4120433F89B21D61D877ADCA7310497B8F97E2872FB4A1DD1A5E81CA7B00CD51AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718214, "uuid": "b388fcb2-30d2-4ca4-aa1f-8fbdcec5f682", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718214, "uuid": "415ec5b9-bf49-42bb-a7ee-096031cdc8e1", "value": "12288:8hYzHNWBk9Flc77udf2ptrL0YhgAToceN:8hQNWCLlc77uO1o+jTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680718214, "uuid": "074eae0e-0f17-4029-85e8-fb3a6d98bb8f", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680718214, "uuid": "89ca113c-da53-4fc8-b9ef-d063fd059631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680718214, "uuid": "1bab0630-54a5-4f90-b2ce-49ca5d599608", "value": "7ATBqdtuwVMYRm9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ee12fd-d3c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680709646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709646, "uuid": "20a48078-f6dc-4564-8300-cf8ca233fd56", "comment": "Malware payload (Formbook)", "value": "6df330374ca14f627335609e46268f9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709646, "uuid": "4f185549-f754-4092-9f23-a795acd4dd00", "comment": "Malware payload (Formbook)", "value": "fefcc1c20833cfcfc6dcae1cbe633813ec87db6a2fa102533a27316057720664", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709646, "uuid": "6d1a2953-9076-4979-8f84-635d00608a93", "comment": "Malware payload (Formbook)", "value": "c2115587742670c7f3890a3e1bf565c745f9e3df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680709646, "uuid": "d26b3a7f-6990-4df8-b9b0-d7f1b3b6fa17", "comment": "Malware payload (Formbook)", "value": "abaeeba6176ca6bf824decad7a97d38fa02cce05f0095497f40b0d46ce98080efd1ab073a6e24ded0fc3314d4464ad7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709646, "uuid": "43ab5c7a-f60f-427a-8493-a99c4b19872c", "value": "T144041303873C89D7D7CE6C7896B24867C68E7E334169E202E971964F17631F68EC8716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709646, "uuid": "d8fe6c73-f0ac-4b61-87c3-a381c44e11be", "value": "3072:+o2Cf941YfV3K3N1nAdiN/wCIQ2+QDW3icCuPVZAb:nf+79dAd0wCDJI7eVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680709646, "uuid": "819c3e5e-9dff-410c-91ba-05e19892e06d", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680709646, "uuid": "81a4c504-0c82-4ee5-bb82-c4b9cc62daef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680709646, "uuid": "22b01251-e4ca-4cd6-8209-689cc40cb639", "value": "fefcc1c20833cfcfc6dcae1cbe633813ec87db6a2fa102533a27316057720664", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0aa432-d34d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680656362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680656362, "uuid": "8bf79da2-7d40-4d77-b265-25b5bebec5c4", "comment": "Malware payload (Amadey)", "value": "e84aa4c7470890b9c26598037c81e83f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680656362, "uuid": "c1876d7b-0d33-44f8-92d1-e0815fed68f8", "comment": "Malware payload (Amadey)", "value": "ff11822f45497782fca1a26688b18e99128c919cf609e048ae862a330aeee7a4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680656362, "uuid": "32df460a-dde4-40f6-a83f-00e8a908c04c", "comment": "Malware payload (Amadey)", "value": "caa08bdc91dc1eb4c0802c63733bbce2a62ae278", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680656362, "uuid": "f4f05105-d8ec-4283-98e9-3da3c869914a", "comment": "Malware payload (Amadey)", "value": "4c494365b771b89f2596e3bbc35b983c9f11422da1837edb72b6e3cab2ede735f2f39e6b30c226567d6d3061e86fbd92", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680656362, "uuid": "d76518ea-fc71-4bee-ad3d-5693664629f3", "value": "T180352327A7D89433ECF20BF01CFB02A71E36BCE29C799717152A981A1C325B09975766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680656362, "uuid": "5ae5c089-8227-4c3b-82d9-0977f0a6d475", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680656362, "uuid": "cea09443-2edc-4b05-8496-363f17e68b87", "value": "12288:GMrdy90S+Ehrs5HTi8PvvRJCn7q7sgKhyUrULSVYsFqAWFWNWoKbcvS8x5DkhBYj:DyMfyHzhysm8YmnKb0wBYmrOgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680656362, "uuid": "5ee9249d-e1b0-4dc2-b35a-836affb98704", "value": 1063424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680656362, "uuid": "0426eb23-fc22-47a8-a7f0-14e5566bd45d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680656362, "uuid": "d126f9ba-758a-4edb-b3f0-e5bf1d1ee6ce", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }