{ "Event": { "published": true, "date": "2021-09-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-09-22", "timestamp": 1632355381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "7ee5bdc6-38ee-46e6-b970-eaf9ccfd8bfb", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cd0eda-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316355, "uuid": "791384a8-f10a-4f38-9b30-ddbb5129976a", "comment": "Malware payload (Dridex)", "value": "8e427b38a2aee86553428bef743f2c55", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316355, "uuid": "15dd9f18-17a7-4f2d-b1da-43ed865b238b", "comment": "Malware payload (Dridex)", "value": "0042ceef7efcdd2b574d7ec6ee65173df3c946ed0be5f39f8fef2e84d626df85", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316355, "uuid": "859e06ae-d901-410f-a2bc-743aa766bb06", "comment": "Malware payload (Dridex)", "value": "394df316397ea85e035589f5b6ab5de54b7448cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316355, "uuid": "37d83992-3890-4165-9fa0-5416d6e488d1", "comment": "Malware payload (Dridex)", "value": "710f4b4e44e5c3c7602dd46f92273be920e945cf6367206d88091ddd31f8b7e2b0a3cfdfc4021461d91f0b2ba127e819", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316355, "uuid": "9cf460b5-060e-43f6-a588-7a718a671704", "value": "T1A7E5E010FE69EDE6C6B99F3E9408352317B93D74130DA18CC392604F5EF82546E3E99A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316355, "uuid": "2365e609-f635-40bb-9a7e-f68ef2c57804", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316355, "uuid": "986a56b4-6aa1-4c94-9bbb-dc72e6a31fcd", "value": "12288:VVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1k6N:MfP7fWsK5z9A+WGAW+V5SB6Ct4bnbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316355, "uuid": "d60135b1-e973-442a-9298-a8d9e91be361", "value": 3162112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316355, "uuid": "8050d5cf-aee2-43d3-b8b8-8e0264104530", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316355, "uuid": "869fddb8-4905-43cf-a2af-a651dc3f7d67", "value": "0042ceef7efcdd2b574d7ec6ee65173df3c946ed0be5f39f8fef2e84d626df85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376b4cb2-1be9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344901, "uuid": "e915a11d-4192-494a-81f6-bf3215588c7c", "comment": "Malware payload", "value": "14200035a99ce493fde418a2a725f693", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344901, "uuid": "22563495-78b4-447b-be5d-0cb921b978ca", "comment": "Malware payload", "value": "005939a69a4214a908f1e2f4b4d064fe87105c411bb82c831245ad2dbe05f7ad", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344901, "uuid": "b0ea28e6-ac53-4d27-a542-4ff0e2dcc90e", "comment": "Malware payload", "value": "15ef8dff8bf1d7a67a3d04a63a40d611fa606458", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344901, "uuid": "24518aa5-ef13-4637-bb14-f86b5e937ea9", "comment": "Malware payload", "value": "a0bfa1a1dacfbaf368f982108db37d2a5380ece9c7ceee5a588c58f3de094fe89a49e616e46675cc8cbe30a672940420", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344901, "uuid": "6cbb5396-a233-4f1d-8e4d-33ab41b813ef", "value": "T17135332748D0BC0B05BDD558A2318ED851F7E5A3E717A548EA3DF810B65ABCFD46207C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344901, "uuid": "6601e94b-2e9e-4f4b-a3e2-e66483306505", "value": "24576:V3YNc6cRl/lXMR5KzLkZ9myrGS5yaE+SI66nNx6i2OeJcA4:V3OolFSKzLkXnrGSUy6kwiXef4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344901, "uuid": "7d1b05fb-1b4b-4fff-aae4-a68931353963", "value": 1081122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344901, "uuid": "cae2d976-f43e-4028-92af-0bfb9fb8c671", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344901, "uuid": "0b370b0b-0384-4a25-9fed-8bdc812c392d", "value": "\u88ab\u7ed1\u67b6\u7684\u5973\u5b69\u201c\u5c0f\u7f8e\u201d\uff1a\u5148\u52d2\u7d22\u540e\u5f3a\u5978\u518d\u5356\u7ed9\u6740\u732a\u76d8.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf40fc6-1bb8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BillGates)", "timestamp": 1632324026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324026, "uuid": "d2113f4b-59be-4ff9-8372-35ca96a0509c", "comment": "Malware payload (BillGates)", "value": "2615c4e9d9c2f500b78f79114314b183", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324026, "uuid": "bb0cabe2-03f3-49c5-8504-20022a673383", "comment": "Malware payload (BillGates)", "value": "00dc2c576f9bbc0002ca7d271a28141c5d91791ffe0e01ed4b74ad3bad49bfd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324026, "uuid": "f0e63e92-0d13-4e32-811e-caf1629fb02f", "comment": "Malware payload (BillGates)", "value": "e378a4237cd620a6a5b9b5a7f25021cd3299f6eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324026, "uuid": "dae887f5-1a87-4251-addf-5bb00eb6429f", "comment": "Malware payload (BillGates)", "value": "58fdf2775faa5502da35badd4e0ffd89fac127f1085743d021f52af01b5677d48a070359ae6fa76b01050f09b7d9605d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324026, "uuid": "cf2f731a-1bce-43f0-9c75-cba042c7b53b", "value": "T1A9456B12FBD0CCB1D84616F5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324026, "uuid": "c727d3fa-260d-4e35-856e-d786c7a1ad36", "value": "24576:e845rGHu6gVJKG75oFpA0VWIX4c2y1q2rJp0:745vRVJKGtSA0VWIoTu9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632324026, "uuid": "b8e55103-5eef-4047-ba77-b65b2f2a6565", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632324026, "uuid": "7b4749e2-a62f-4127-99a7-c608df9439ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324026, "uuid": "3571c56f-0bbc-4957-ad72-d539d2613312", "value": "2615c4e9d9c2f500b78f79114314b183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4f5743-1b86-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632302605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302605, "uuid": "a61a6a9c-0e1e-436e-8119-1fc961880f45", "comment": "Malware payload (AgentTesla)", "value": "f0876a5d91e17b79544278f8726fe4a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302605, "uuid": "73e92cfa-8112-4152-9088-1e4041a32278", "comment": "Malware payload (AgentTesla)", "value": "0115201f17cb83a2bcf49068ab1437103a63b9ae2895640ddde30f74dfcb42ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302605, "uuid": "d97ad6a7-4b06-48f0-af79-01077a317094", "comment": "Malware payload (AgentTesla)", "value": "d6ee4e7acf8c881bc4f4f3cc90ea66af8b136baa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302605, "uuid": "cee7c012-b152-48cf-ad9d-8daa1888fe16", "comment": "Malware payload (AgentTesla)", "value": "01a714065f001a1e9b159c625fde78676a93d8487dc0e679e2bf1683eb28673a64c63bedaa55987b8f9f458d08beed4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302605, "uuid": "66be1c0c-f37e-4aad-ae90-21397584fa59", "value": "T14D4302A711B17C7FF7C6315A8F4A4AF1D924DF028AC26074877403BCBC90AD6A7D1169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302605, "uuid": "209cda0a-dd28-4dea-b2e7-61f301ee10a1", "value": "768:75rCbg6Yg/uv+TOn1mCshSughkLyxykX04fNg0K8l4oFdzB33+wDU8tDh9s5FL3r:Mc6PGt1mCshSQ2Rxl4VwDNtaFDA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632302605, "uuid": "81161829-8f4e-40e9-9b59-2f033201274d", "value": 57328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632302605, "uuid": "e0e1fdf6-ef06-4200-a9af-8e3fc067de78", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302605, "uuid": "d39131ac-21ba-46b4-afa1-367a1abb45d3", "value": "Payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26598b70-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Osiris)", "timestamp": 1632316955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316955, "uuid": "401a077d-81ff-4173-a71b-c9f441f063a5", "comment": "Malware payload (Osiris)", "value": "afca14738e00c61a837d450b38a3f067", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316955, "uuid": "1f967601-6f70-4c26-9bcc-1cdfb7760ba5", "comment": "Malware payload (Osiris)", "value": "017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316955, "uuid": "91e97411-0f6f-4a4c-ba43-ce702f6aad7f", "comment": "Malware payload (Osiris)", "value": "bc07bcaa858fd87418563b54f1e3197a252c0ee8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316955, "uuid": "f48eef35-cabc-4ea9-bfa9-f9d1cd0a7e47", "comment": "Malware payload (Osiris)", "value": "4f4c3944033616ecf4a275cf65062b1087819d52d72cd283797ba403a34442f5db2a7eef4f25d9a4103acb4c4bfdeb08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316955, "uuid": "79e54093-6743-466d-8ea9-f9dfa20ea942", "value": "T19FB4CF384185E7E1D7B2C3349CEDF5CD8C74F1002579B1EA93AD07AD99BEE111E2A90A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316955, "uuid": "6485dec5-aec3-4dd4-b2de-d2b427ca0170", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316955, "uuid": "13f43128-4337-4640-ac66-2a71d85d624b", "value": "12288:I02PWw9C6hlSZ6g2G0yKHp1VbWabfBnXo:wPWwcOq6g2BVpxbVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316955, "uuid": "bb20e6d4-07a6-4e89-810a-f98368c98294", "value": 540449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316955, "uuid": "acf12295-e491-4b9b-9d7c-c337c636a6e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316955, "uuid": "75223f60-9c17-4f98-a429-8d9b11833e52", "value": "017a7ccf3e5eb12c679dad6b9897c1ea788975d6e5e90e4ddf59df981dd11ec1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772b40d8-1b76-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632295616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295616, "uuid": "24c7543d-43ea-4c64-b8b5-0f638b8853e0", "comment": "Malware payload", "value": "0b3e37f1b223ad8bb8af69e893c7c150", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295616, "uuid": "b9448b86-7f2c-4748-b62b-dd3671268d88", "comment": "Malware payload", "value": "022b70e92627f6ae9996f37014fcdb9b168028cc1a1dfa759f496207ee6a6730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295616, "uuid": "bf0d438b-0500-4726-8fc9-a8d111fdecb8", "comment": "Malware payload", "value": "b1a22d66a7433a1b91f8b66ffe473b52981eb378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295616, "uuid": "fb710f39-cb24-416a-89c8-80852b902ed9", "comment": "Malware payload", "value": "b638ce2833babb299377f904a1b20aa5b847ac1247c0f397ccadb4e92ce7fb27eb84bfc39802f24e4adfac838a05db04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295616, "uuid": "cc3a0387-ed5e-4ed0-b17a-face4708ed17", "value": "T12B74023AD7E966F8D655C6BD1C2230051B707A4ABA03DE2BAF42708D5E393425036EBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295616, "uuid": "f30d02ee-104a-46fb-af78-884c0b221b59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295616, "uuid": "3d5712c4-e2be-4263-95a0-7c30aac7ed9a", "value": "6144:9NYafhNmtiS3/NpZZaBcHw+zx/MAJDaApTMbFtQHGrvUp:9NY8mtiK5oBcQ+zCAJDpqbTQHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632295616, "uuid": "011b433d-824a-4861-b9e8-eb2dde9e3b51", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632295616, "uuid": "191e69cc-3aad-4f6c-a250-7249c8427566", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295616, "uuid": "51e752f6-11d5-4cdf-b92b-36f0851f367f", "value": "Purchase_Inquiry_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973bda14-1b9b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632311561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632311561, "uuid": "a254e715-1bcd-4cee-8f3d-58670a2b6776", "comment": "Malware payload (AgentTesla)", "value": "02c680df07dd7a6d2bebe319fc1d890b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632311561, "uuid": "4b4dac62-8df3-4e64-93a3-1d44a1400cda", "comment": "Malware payload (AgentTesla)", "value": "02394f7272b576614e9c52f717fc30d948f1678d5d167e268abc6df766bb1f32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632311561, "uuid": "0d3d919d-43bf-4e20-a5e4-db1b8d60f4e5", "comment": "Malware payload (AgentTesla)", "value": "ed857968f09acfa7ea7364b7294a5e26ed4b8186", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632311561, "uuid": "4b399077-e5ca-4d77-8d70-e7c04f1316ab", "comment": "Malware payload (AgentTesla)", "value": "30f0c9803d988d4fb518b52aabaf1173af134390c16dd86927e24d757ee52c823fd44725d13422fc3ca8243946ec9cb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632311561, "uuid": "7e6826d8-cb6a-4cbd-81b2-347edce9abe0", "value": "T11AE4233C8298AF3FE95C75F293246013177981A979C2FF03EA56A00E5B763E0945E78D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632311561, "uuid": "a837644d-0780-4f85-a0b0-0f6e319d17cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632311561, "uuid": "ff835444-5db8-443a-b8a7-0f418214b5b8", "value": "12288:EpLmtiK5oBKq6JL0YVhUMCnGBkMSt2cJxo8kOpVn93AJsYNLY8L3D6IR2:6+FoB56WYVInHMSIczowVn93AyYNLY8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632311561, "uuid": "5962f7aa-66d7-4020-a7ae-360820098161", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632311561, "uuid": "e6ad6c01-817c-416b-833d-f0a9079c83f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632311561, "uuid": "2ad6bf11-f188-4f94-a3d6-e04f58fb9a1d", "value": "Documents as Required.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8c624e-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DarkComet)", "timestamp": 1632316964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316964, "uuid": "a55ad8fe-5b4e-4c80-a6de-a12d9d5d206f", "comment": "Malware payload (DarkComet)", "value": "642a19d61f9d148344d263180d4e386a", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316964, "uuid": "dc8e0101-fc5e-47f9-b9b5-522d7fc2561b", "comment": "Malware payload (DarkComet)", "value": "02811b25e52053553af9b1edf031e2e83cdc7a80b68e45fbca1617872dee55d8", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316964, "uuid": "bde1e998-4f03-47ca-b386-e05c225efdd8", "comment": "Malware payload (DarkComet)", "value": "e5005eab11acaec13e0c6a2af0744d99727b1d07", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316964, "uuid": "70f9bad0-7e11-4175-8db5-9aefeacf448c", "comment": "Malware payload (DarkComet)", "value": "a4ab7c31d27fe0ad9abba3f8833bf8b9e3d090c388986633080b196779638c43093958030d934dc0e20f24655fd4314d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316964, "uuid": "55a1af2c-0db6-41e2-8a5b-e7a7664988d7", "value": "T15AB4D0B1F144FCA2E8D60DB1E11F36B117466F66C898392F7584BD2E7CB3B45C0A291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316964, "uuid": "3adf8924-9eaf-4877-8894-537d0d8861b6", "value": "f2d24d034ad8ae86f9dd9c6c9707e46f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316964, "uuid": "3ab46084-3343-4199-ac03-5d9bb4972a9f", "value": "6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbz:f9fC3hh29Ya77A90aFtDfT5IMbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316964, "uuid": "0ff085ba-11b6-4db6-8278-a8d0ace913f2", "value": 532705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316964, "uuid": "ae00b0ff-660b-430f-8ed9-75c62422961a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316964, "uuid": "f85f5735-f16a-45e6-8e5a-6322de9f4be2", "value": "02811b25e52053553af9b1edf031e2e83cdc7a80b68e45fbca1617872dee55d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebabf568-1b93-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632308266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632308266, "uuid": "b10437b1-f451-426c-aee4-499657929b38", "comment": "Malware payload (Formbook)", "value": "9b47f20517f883ea5d3893619c1d0cfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632308266, "uuid": "2388e7f7-2314-42fd-97e6-30954ecbbf93", "comment": "Malware payload (Formbook)", "value": "028243057c6d4a300f7aa0d8553039fc17137f4d552082771dbb036550a74a63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632308266, "uuid": "99a1c1cb-871d-4d05-908d-64686b146d89", "comment": "Malware payload (Formbook)", "value": "92354d35720c683513aef993a2b4d931b9e6e4f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632308266, "uuid": "317c9e45-fe14-4da0-ae5f-bf23db942129", "comment": "Malware payload (Formbook)", "value": "17abfe74e23da370a8727b0b8503a608136ad5ea54a74f10209278bde61ba97efeeb9db68e6906ea378837f51e9471ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632308266, "uuid": "05070fb8-1258-41bc-bf24-95a203ffb797", "value": "T1ABF47B9D326076EFC957C976CA682C64FA2174BB470BC203A01716AD9E0DA97DF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632308266, "uuid": "45ede045-f8d6-407c-92a5-3ef6e6694658", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632308266, "uuid": "b907c402-34f9-42cf-86bb-684650ce1f39", "value": "12288:/dmPhtwgj0MHcDr20ZXk3DIP+TYzUxi8CGz5Df6Y0kHlADUn4Xb5OFlj2ErM7XW:/C0MHcDD63DIP2hxi8HHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632308266, "uuid": "1bc28cb0-8dff-4dff-bbc7-e3403c1d8337", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632308266, "uuid": "84e106a1-ded4-41fc-8acc-dc03837a98a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632308266, "uuid": "9fedf464-aa0b-420e-9cbf-2155dfc9e2b9", "value": "SecuriteInfo.com.W32.32ce1c4bEldorado.29612.24438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a07e44-1b9f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632313108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313108, "uuid": "26ea16af-478d-4412-8b90-88412c14e5f5", "comment": "Malware payload (Loki)", "value": "36b23bed14ac34912b626dc60fa4b3e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313108, "uuid": "4f3fe651-97c2-45cb-82b8-dd84651c84dc", "comment": "Malware payload (Loki)", "value": "0299cf0c73ab95b9504ae3f1e17b4f4674fa09d5257fdc13de8766c9a2215ea3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313108, "uuid": "8e2ca706-0288-4b0e-bf83-6ddd647032f5", "comment": "Malware payload (Loki)", "value": "b8d74d5b6928b0cf9177acb04eaacd93c2cbae1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313108, "uuid": "254dcdcd-676c-45c6-b6db-8eb7734d1c69", "comment": "Malware payload (Loki)", "value": "d50a4f0b04129ece4bcd21741aef26a0f1890c96d2ac6b37cf0ffbf7aae428401a7682b44932471d3acdf74094163bd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313108, "uuid": "bc7338b5-95cd-4402-b2e3-ea5a46f03087", "value": "T10EA41238D6D852F5C558C7FC0D61745113A17586790ADFBAAE82B0CE7F2ABA24031CBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313108, "uuid": "5d582701-8619-4567-9819-4f4de1a6e6ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313108, "uuid": "e5129777-d204-4126-8f54-c8c3240f6bd9", "value": "12288:gZMxmtiK5oBcyLO164XWEkZEzXpdm2IwlLu:z+FoBclNioXKglL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632313108, "uuid": "f0ca0894-59ab-48b7-a7f7-187f478bdd2e", "value": 474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632313108, "uuid": "e7627fb7-5c05-45e5-842a-e83d4d030001", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313108, "uuid": "627598fe-67d8-4c7c-8513-9c15e0f85d9f", "value": "info_keberangkatan_0_129_1631845390.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1042d714-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632334098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334098, "uuid": "c155c240-1c76-4c09-a3e0-770a57668cba", "comment": "Malware payload (Dridex)", "value": "2a891556a1a126eecdca310bd88fe0c0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334098, "uuid": "de4a2910-27f3-433c-9f33-5bcf5efcee6b", "comment": "Malware payload (Dridex)", "value": "035b872c1cb731d6df2dfea0c269828c3687c4e543c66d4803d85591f1272f4c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334098, "uuid": "b308bfdf-d185-45d9-975f-d18860b8b0df", "comment": "Malware payload (Dridex)", "value": "ea0e39259a0bdd8a237bed914356aa5e4b564f42", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334098, "uuid": "f934a427-2e51-4be0-8031-9b83ccfeaae0", "comment": "Malware payload (Dridex)", "value": "bbd4b3ce2a861ac1786a3754afc7bc66e891a853bf5ab9ddc1fd128b618b59cfc6ad6d0fa3a913f8fcecf0095a8049a7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334098, "uuid": "c521d8fc-e9e5-4583-8bfa-5fa34758af5b", "value": "T10E14D013A6B931D3E19B383F92A1E7B16E386F43C338C45BD6D4F46899312A354A5332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334098, "uuid": "c3761c05-fd06-4579-a603-1de8ca6e94c3", "value": "bc9115da123ae49443de76ad96ad8e1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334098, "uuid": "25dbc849-621d-4121-9ea7-05629a52ac08", "value": "3072:8wd4sevPYabz9RLhPO8f3zRCyvD6meTuxn2ZjflxomQYIE5XbiK/n1:BsvQabz9C21Pmb82xnwiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334098, "uuid": "e94f9ce0-10a3-4d20-aedb-178f04b47d07", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334098, "uuid": "f82f03ee-1571-4148-8ad8-e84633630f15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334098, "uuid": "91c8163e-d0c5-4db7-9bc5-9d3b2a45b4a6", "value": "2a891556a1a126eecdca310bd88fe0c0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb7884f-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316642, "uuid": "99fc3562-ac81-4f07-b3cf-448d723c77be", "comment": "Malware payload (Dridex)", "value": "82b89d830fd0b3c8cabd9553da7aded6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316642, "uuid": "3e6ce374-e001-479a-a074-f5eb0809cbcc", "comment": "Malware payload (Dridex)", "value": "0399f40eb9daa1495ddd1f1858a8bc933f4d4947b47e780ee447b078ed96345b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316642, "uuid": "9d924b7f-d4f0-449e-80e0-e5123f97a09f", "comment": "Malware payload (Dridex)", "value": "bc89c3cc9fa6958720de5ebd0e41e7da244aaa36", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316642, "uuid": "dd785ae5-789f-4e57-aa16-a8d0bc93ea4f", "comment": "Malware payload (Dridex)", "value": "1bd62f55ed096b35637444d935cfca3942c73ffd9219bddb66b205b1f36578b5dfcf9afc70f3758957ee6a1c181d0ac4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316642, "uuid": "872a963b-c4fb-4669-80e5-ae7482a31fa8", "value": "T12B85D020EE69E1E6C6B89F3ED408352717F93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316642, "uuid": "0f8d0aaa-cc9b-4fc4-b52d-5dd89acb7aeb", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316642, "uuid": "448d3cd9-096d-4df0-bd45-b71049eb1856", "value": "12288:JVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ofP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316642, "uuid": "d5682c0f-ce8b-4003-8b4d-ad22a7e8b90a", "value": 1798144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316642, "uuid": "9732e7a4-e047-4041-a149-cbc82f6c12f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316642, "uuid": "a7c48e38-1bcc-4ab8-810e-8580286e11dd", "value": "0399f40eb9daa1495ddd1f1858a8bc933f4d4947b47e780ee447b078ed96345b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa09ac2-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316809, "uuid": "29690801-5045-4796-b6f5-770c435e669f", "comment": "Malware payload (Stop)", "value": "db76809236dcdb0dc86e698c50f4bf1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316809, "uuid": "6ea2878e-5420-413c-92d5-4e7186e27a88", "comment": "Malware payload (Stop)", "value": "040088959686c4a4c06c72fa178e55a732557e2b40501f4f7d13b28928d40809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316809, "uuid": "f2e5ac06-dfdc-451c-b2db-73202152ac8e", "comment": "Malware payload (Stop)", "value": "f514e1aae379dec43b7a48c87e25de0c364673ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316809, "uuid": "da6a4a87-4f92-4c87-952f-f93e9ddb6844", "comment": "Malware payload (Stop)", "value": "4d9573192350bb3938b2f555b42ad5f1acf08eba4d5bb135b19a3fe898cebcf3ac96f51f55782f968da9e2e8d5386a4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316809, "uuid": "726b963e-ee7a-41be-a04c-b31d3d6224f2", "value": "T1BDF41212B2C1E067D5E206316434D6F45EFEBCB21A69880A7659FB6F6E703D08D7231B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316809, "uuid": "9e794cee-e986-4a5e-9e9f-a05f342616af", "value": "9c3501e221e7e06d3e51bfb52c2b6518", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316809, "uuid": "dc1adada-8ad8-4b31-8df2-89e5b504f191", "value": "24576:4UGKwJPPbQHpB12rfZsmDMCvrpQ8nmOAi:4UGKwJP0Hd2rRMY8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316809, "uuid": "6d573c95-3768-4315-96a1-893404856c5a", "value": 788608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316809, "uuid": "963248f5-5ef1-4052-969f-b0dfdaa70aad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316809, "uuid": "645932f8-3403-44e5-a7ac-c12e27c0cebb", "value": "040088959686c4a4c06c72fa178e55a732557e2b40501f4f7d13b28928d40809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea42a285-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316854, "uuid": "aed00834-794f-42fa-af31-847dddf49422", "comment": "Malware payload (Stop)", "value": "33af34cfaf8738b575cdc9e76b053ca5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316854, "uuid": "34439054-d011-4578-bc1f-66543031a7be", "comment": "Malware payload (Stop)", "value": "04830b32044eed19c43dce1d544c530532d60114d64970fafb7dcfb0f37f58c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316854, "uuid": "4db25564-4d9f-4951-8ee6-803080d58aba", "comment": "Malware payload (Stop)", "value": "fbfb7751073b51d2c4740c06c29ba14d66a9c913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316854, "uuid": "75d2ce96-3ba2-4a9f-b704-c0723b05a4c2", "comment": "Malware payload (Stop)", "value": "92cf0a2ba826abe451b8d7ae844fd2c6cfa59b166bec5be194cf3b7ed2b4c5289329aa6b40623cfac0a5ff043deb373f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316854, "uuid": "593e9749-5800-4031-a990-95f53749b35c", "value": "T111F412017590C372D27741B08B71C3F16A76B922A9709B9B275BA37EEF203C13E29746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316854, "uuid": "6ca39987-d3df-4726-8915-766c25ff18d8", "value": "019bced73b51911db702af2d47c34cb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316854, "uuid": "65e322eb-f898-452c-961c-22fabb813165", "value": "12288:12k+akBIApr/CLHaD96SB9pStmipHQxFgrKcZ3ahcTtbFNN3eHAywmBai:16DfeH5ApStmipwxFwKcMGTtb/dywmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316854, "uuid": "1f82241e-5f2c-4fa6-bcd9-1209c0179482", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316854, "uuid": "13d08840-0e3d-4ee9-8d51-45b3db20d25b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316854, "uuid": "fd101648-34ae-4dff-b2cd-2206847bf1ab", "value": "04830b32044eed19c43dce1d544c530532d60114d64970fafb7dcfb0f37f58c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1fe877-1bc5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632329527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329527, "uuid": "994f5788-e124-4003-b52e-ca4eaa32a085", "comment": "Malware payload", "value": "532e096cb980a0cd5d74d0e6ced1a726", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329527, "uuid": "9ceb954c-4a39-4712-82bb-17638fbfa43b", "comment": "Malware payload", "value": "04a61562d6f4a1a478c34f4487e343a0eae38c5f6a9cf85c5a9ba1037755f608", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329527, "uuid": "73e7a19e-ea52-4af7-a25b-25d8784e2e60", "comment": "Malware payload", "value": "f1d731de2e6521bba841913243bb89d2a18fce96", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329527, "uuid": "8736ca94-e7a6-46a2-bf2b-78e246a8b697", "comment": "Malware payload", "value": "533f7da337f9849cfdb8de157991fdca4cd162bada2805b17fe72b5eb7868c472456402fe1a2496de0257907dd684178", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329527, "uuid": "91af8486-859d-4aa2-b788-b8d107040d9c", "value": "T12C93027ED301FC0CC5F38A7C861B19F5802992542AB2966E49D7F6588CF7343AF4219A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329527, "uuid": "aae3c859-906d-43e3-af54-7fad8aaf1fb9", "value": "1536:ZF8/ZpW952lDu6myd270HHKtgLDP9MGwEJzpViGC631liqf+VMJ2XHQdo3mrkACz:4/ZpW9q7270HHKtg37zpViGJ3PmeJ2Xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632329527, "uuid": "70fd8d82-36cc-43d1-870a-f865476bb28c", "value": 95352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632329527, "uuid": "28625b43-6b6c-475c-8a7d-91c09d6d4a70", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329527, "uuid": "2c04f74f-bea9-4769-ac1c-084c83d8efe7", "value": "SecuriteInfo.com.Trojan.GenericKD.47001735.13352.15386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ebfad8-1b79-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632297110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297110, "uuid": "a53959e4-7821-414f-862e-616061e523e1", "comment": "Malware payload (AgentTesla)", "value": "92adcd835cd80cebad327cf3db1df491", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297110, "uuid": "64bd70d3-6391-4136-a400-ab7fc86b704c", "comment": "Malware payload (AgentTesla)", "value": "04af8ef549b08575545404cb20dd9c5db2df112f46c6bb05ffbbe1fc868d87f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297110, "uuid": "d10c8004-a02d-471e-9ee0-5cc7c4f988a9", "comment": "Malware payload (AgentTesla)", "value": "7555806f0358f5b9cbd57ebc8275fe0b77a99054", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297110, "uuid": "301be133-53e8-4eaa-a7e7-6477fe6568dd", "comment": "Malware payload (AgentTesla)", "value": "19af20750e04cf1f7ed95b2607b32de27bfed900864ff73cb9817f4e439ea472592f38dd19b27a8c00dfb19b913b11ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632297110, "uuid": "89057a1e-db0b-4c88-a5c3-1dcfe8f8be37", "value": "T1B4C41339D265C3B0CD6A8BFD5161815647B1B6C97903E73E9F81B08A7E1B3A01039DB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632297110, "uuid": "06a48967-0a4b-46d5-bd84-f138b09fe92e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632297110, "uuid": "01a0023c-411c-4d60-83c5-0eb5f96427e1", "value": "12288:qoU0mtiK5oBnDMz0K9F2DDTTOkLSzVF/65xW3/FhtWqBoh4zCsX4:R+FoBnDw08cTakiF/cxWvFhwh+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632297110, "uuid": "039b5602-6201-4dda-8e59-af05d59afb96", "value": 574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632297110, "uuid": "a0179eec-c5ba-4485-b66b-45c840c376eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632297110, "uuid": "b55cfe0d-5da7-4fb3-a5c8-8fefa9e37dc9", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dfafbb-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Troldesh)", "timestamp": 1632316679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316679, "uuid": "56caf0de-c6b6-4f3f-9926-03596bfa8f60", "comment": "Malware payload (Troldesh)", "value": "19a869e05e196f29fa3dd1b43a7e70e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316679, "uuid": "3dc09cd1-4929-449b-b48c-2199b009f310", "comment": "Malware payload (Troldesh)", "value": "058499891d9c3fa31f1d45e7965786c17984d0394cf8db77a18f2947653ff6c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316679, "uuid": "8b66dfad-2891-4511-b837-92a9c209b977", "comment": "Malware payload (Troldesh)", "value": "912d229e8175863a2794c2312dfb785f20772ccd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316679, "uuid": "4d2adcd2-b046-4348-b2c7-3a13fa566d4d", "comment": "Malware payload (Troldesh)", "value": "75ffc23fb4c4c96a718a2ad8f6fb8ee17164e51b3315bdfb0fde89d6131944e1840feb95aa59a4fcefebdf605128a0a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316679, "uuid": "46702cac-5d24-422d-af11-48e71a9208d0", "value": "T1826522997AF3B221C86772B0D96E8C09F134D747292FC8513D0C7A95AF211B8066BB9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316679, "uuid": "b05534f6-07bd-466f-abea-257d0197015f", "value": "136f0dbada6bb4a05762d95693589abf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316679, "uuid": "4171c719-1da7-418b-9e9f-0ca29b91a88d", "value": "12288:8ZaQfL1k3zmpVqt2k+kG7t2ZYkWEhkTl+igHs02lRjE0SST27r4PYDb5iSA6iea:YaQ+3zk+2V77kKTlbwsh3/ywADQSPiea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316679, "uuid": "2aaf653e-3e49-4e83-80f1-12ffa4df3c6d", "value": 1444021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316679, "uuid": "3da34eeb-f81e-4bc4-a3fa-6e7623750adb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316679, "uuid": "138b8132-0a85-40e7-a072-9d47a3bf651a", "value": "058499891d9c3fa31f1d45e7965786c17984d0394cf8db77a18f2947653ff6c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c52e28-1b73-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632294192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632294192, "uuid": "660dd714-f00a-4b72-ae3f-6f3dae9f6ef7", "comment": "Malware payload (NanoCore)", "value": "61e66a9bf53a7121e8a8fcc5759c59e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632294192, "uuid": "8e70c588-ab04-4730-be38-134c33dcca38", "comment": "Malware payload (NanoCore)", "value": "05f6fed4d58c2e98db4cdf47efdcb42a083140410a3bc71092eecdc4fb1328a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632294192, "uuid": "9e3aa40d-7e2d-49b6-bbfb-c421fe308233", "comment": "Malware payload (NanoCore)", "value": "4219098d8244c351462d5c19abdc9e115e2274bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632294192, "uuid": "a7066882-1748-447e-a3b3-88bfe090e2bb", "comment": "Malware payload (NanoCore)", "value": "f8097e4663b9e3491adaf65ebdb4f375676704a8016f2376f611cbda11bc9d310677ae1b1a0bd67aa5ef969b9f3a0d20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632294192, "uuid": "af941baf-e57b-4b0c-ad89-1ba20fe8e424", "value": "T113159C394D2682F787EEC66CD08C1FCEDAA6A4837B919F1AD496D7C2025770FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632294192, "uuid": "2ac7c201-17df-4e7e-9554-56d8dc58017a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632294192, "uuid": "4753dc10-76d7-4ade-8a5f-ff17913aeecb", "value": "12288:CxG9Yj1UBBeTQKXuLiC5D9sCz1gte93/:Uj1U/KXiDCCa+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632294192, "uuid": "7be6bbbd-84b0-42cd-8a6e-6753ec834b4e", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632294192, "uuid": "aa95115b-4758-49af-94e0-4d117c55362e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632294192, "uuid": "373f1089-c361-451b-ada2-2c3a5ab7b81c", "value": "TT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62f59fc-1baf-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632320256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320256, "uuid": "c98fade8-8686-45b8-8dd1-9efe0a45a662", "comment": "Malware payload", "value": "4744f0f41a7491a2c1716cd03d06c828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320256, "uuid": "0710560d-8978-4ab7-9dc9-b74cb5778081", "comment": "Malware payload", "value": "062cdd63e49b8d260979484f2c209aa6ccb0eeca583bc4b8cc21a850634e4cd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320256, "uuid": "042e75c9-2053-4181-a9be-143475514e61", "comment": "Malware payload", "value": "cf7678775f5990c5ef309c3af9a32166fa7aa7d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320256, "uuid": "8bbe6cc2-917f-4626-9419-b211271665e3", "comment": "Malware payload", "value": "b716555d1b6e90c77d1b6c6ac6607c8b1ed110b25bfa1bca6c177de90a4075bc92b1f2ee7e78e9224ad95fce9d186c8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320256, "uuid": "0901ad71-0679-42d7-a169-895c0717846a", "value": "T1B973BF003B0BAA21D4341BB2486DB3D103B6E749B167CB6F389E2579AE6178F1750FD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320256, "uuid": "438422eb-2f3e-407f-a26f-08d4346cdf72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320256, "uuid": "17208f8f-39e6-47dc-a6cc-f3b988c18976", "value": "1536:9zpgvjlS0Cy74CT3TrYz6vDpMQ43+41xPNfadk:BpERS0h0CTXYmvFMQ4b1LfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632320256, "uuid": "2bfe5422-401e-4511-894f-83ea82ffd942", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632320256, "uuid": "75122e55-c97b-4a8c-9126-7f80a6ecaa85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320256, "uuid": "690e881a-81a9-4b79-8863-fb43033bbdcc", "value": "Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6205b508-1be9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344972, "uuid": "9f7f86b3-56f2-4839-93e4-907eb024a595", "comment": "Malware payload", "value": "0889ac4ebfcc906fa3dc17f3a97862da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344972, "uuid": "4f700627-d8a2-4ff8-87b4-5b86423c4f0f", "comment": "Malware payload", "value": "07ebb19e273995bef00aa19ad538b5cacb5eb0527288c3f5a31be66bfc1d9bb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344972, "uuid": "a33ff63f-9289-4166-b452-a535f5736235", "comment": "Malware payload", "value": "dcf4239b4535a3bc4a2a83fadab113984421d086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344972, "uuid": "4745c854-446c-4193-9c69-56bed5c41c33", "comment": "Malware payload", "value": "8e7e013fbddf390b6666349d04a4d9fb1f65d99d7199625d8e9c94147111fd2402405a6aae001127e2117c0f597a8ae3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344972, "uuid": "81c8b66c-5338-4006-af0b-6bcba84acf0f", "value": "T152959C21BA849876DAA72674612F377851BDA4510B308ACB73507FAD7C31AC15F3A38F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344972, "uuid": "51ea3c3c-cf1f-4a18-a01f-ee163fde1ffd", "value": "05170c3952c47a73573887e0f56a9cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344972, "uuid": "d1b616a1-a0a5-4c0e-90a3-4bc4527b6abf", "value": "49152:2gFhzxpIa6Ed6kd81GR+UxNwtuFOH2+7LmxdDepPo34ITmmRiaE3bsgDVujNobGX:fFzl6Ene1GR+c90czT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344972, "uuid": "81d279ab-b9bc-4345-aae5-b61d7580672e", "value": 2060288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344972, "uuid": "bb7077cb-66df-44ce-bc04-101b806269a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344972, "uuid": "074ff4fa-5e07-4548-964a-e7fa07da3a11", "value": "\u884c\u8d3f\u8b66\u5bdf\u3001\u7ec4\u7ec7\u5356\u6deb\u3001\u5f00\u8bbe\u8d4c\u573a\uff0c\u652b\u91d16_5\u4ebf\u7684\u201c\u9ed1\u91d1\u5e1d\u56fd\u201d.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d440bcf7-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316388, "uuid": "5a6daa17-7d73-4729-8804-ae2b9b9d718f", "comment": "Malware payload (Dridex)", "value": "72ce8e60776bb6480d624fe6739bd556", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316388, "uuid": "2620a81b-caa1-48d9-8396-7234646d92d7", "comment": "Malware payload (Dridex)", "value": "083c3b16dcd8d8e08545426a97f67fadb8453827536b5b475b9f6ba0f926ebcb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316388, "uuid": "5ecd6e59-2a82-4323-98b4-492fb8fad0f3", "comment": "Malware payload (Dridex)", "value": "de765cc39d6c0efc3f40fdaf90d20c85dc4965b9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316388, "uuid": "fc6a1630-e685-456d-81ec-1f07940c021b", "comment": "Malware payload (Dridex)", "value": "3e45b4cb4eb0be7172f1287ce4b6c013835990cefb6f627eb544efe7503782cfd077ba1a13caa4e3cd00593e18e30fed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316388, "uuid": "ff269016-2f67-472f-9e9d-f6526b727e92", "value": "T1B8C5E020EF69E1E6C6B89F3E9408352727B93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316388, "uuid": "36308260-da9c-49d0-8fbe-73e025d9f978", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316388, "uuid": "1f9b9d68-e243-47f7-b744-eed6c0fb68c8", "value": "12288:qVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:3fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316388, "uuid": "dee2c787-c908-41b2-8a9c-538bb9454384", "value": 2560000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316388, "uuid": "2f5e45de-1431-4567-995a-feb97e848355", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316388, "uuid": "d5d5006c-3136-48ec-9a8f-456437538d39", "value": "083c3b16dcd8d8e08545426a97f67fadb8453827536b5b475b9f6ba0f926ebcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20a380e-1b78-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632296681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632296681, "uuid": "54ba5b67-1a90-4598-8605-eacaa2373d36", "comment": "Malware payload (RemcosRAT)", "value": "794bfcbbef15294c85c25eb815e88eaf", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632296681, "uuid": "2a69bbc6-7859-434b-b0a4-20494a42b86f", "comment": "Malware payload (RemcosRAT)", "value": "08dea6bb572a7af97d8814d5b65a205f87e4a7e989c90aff99045698053d1a8c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632296681, "uuid": "9c3a4469-8eca-4ce1-8e6b-2c455d604e19", "comment": "Malware payload (RemcosRAT)", "value": "673988accb192e692282ce99e7e96bb5f9431d6e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632296681, "uuid": "9380cff4-7755-4603-b1ac-27a112bfbbf6", "comment": "Malware payload (RemcosRAT)", "value": "339cdff46f00bac7b3da8bedc93f9dcae2ff000ca3babbb13195b2f761c8aa06c23594ed7d90b0d1f424f3f66444363a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632296681, "uuid": "d99d4344-700d-49aa-bb75-3aa9a5664f42", "value": "T13DE4237B64CC4B1C3C3B55C53BAE3AFDAC419A33A0593FD390A2D2805A53AF6047B691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632296681, "uuid": "2f7bf740-b137-4072-8836-37996b0bd8ee", "value": "12288:RCJAFkWXohl+uGYOAY6VNzWpWJ6Ddf0XqzvkkHwNi9Kq5pq:RCGkFIfYTVNb65Tzsk2i9N5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632296681, "uuid": "cdaebe35-0111-400e-8328-8473e0998c70", "value": 695398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632296681, "uuid": "aa3a0ae9-26a1-40c7-9114-972a59ba4483", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632296681, "uuid": "fd63be59-ce9c-4dc4-b08d-b36d20523554", "value": "AW QUOTE 21505 HQ1-Scan-068703_PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fd470b-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316597, "uuid": "7d23de54-7245-4db2-a3c2-b302bd99fe59", "comment": "Malware payload (Dridex)", "value": "9f1e31fa028d78cd9558ce3ff1174e1c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316597, "uuid": "bf7f4346-cafb-4b84-a686-81810c406c74", "comment": "Malware payload (Dridex)", "value": "08e286abf10c2c83d06aa04192be2e662dbd5736bd2c7224cad71d7fc193aa56", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316597, "uuid": "4fee2b75-0720-4809-847f-92e21a99f1d6", "comment": "Malware payload (Dridex)", "value": "afd4c4cfe23ecad015cd134e3ebcb83f6b0d7360", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316597, "uuid": "3ecc13d3-0345-4250-b046-3138e06465b6", "comment": "Malware payload (Dridex)", "value": "8485c37e2063fc29b5a9776df3d7034e57374b6de87e52d4d4ce24928ccea0ffb86546356c73facca12d9cd71b6e5aa5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316597, "uuid": "75218e00-2c30-42a6-b416-dfdb3cc8623c", "value": "T183A5D020EE69E1E6C6B89F3E9408352717F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316597, "uuid": "400c1aff-0710-49f6-95dc-204ed73f4f7c", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316597, "uuid": "cde101c0-91d8-416a-9d07-69fe9ec48ef8", "value": "12288:KVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1f1:XfP7fWsK5z9A+WGAW+V5SB6Ct4bnbf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316597, "uuid": "22045bf8-734b-4259-9b29-f266083e4017", "value": 2142208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316597, "uuid": "a84d62b6-57e8-4197-9e1d-8617d26e60b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316597, "uuid": "fc8d9828-f008-4a9e-a8ec-7b6071ab2201", "value": "08e286abf10c2c83d06aa04192be2e662dbd5736bd2c7224cad71d7fc193aa56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428145c8-1b8b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632304547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304547, "uuid": "7cd47341-382d-4c82-94f6-f6027bbd0f2c", "comment": "Malware payload (RedLineStealer)", "value": "f1605eda6ee89c9d60fc6f3ce0d91724", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304547, "uuid": "5558118e-6391-4d10-864e-12c2f5c4000b", "comment": "Malware payload (RedLineStealer)", "value": "08e77ab27dbc575f868d1e5bb151fc53ad11a9f25ae39d5cdcf23971568b2e29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304547, "uuid": "f46b77b1-b7fd-4377-bb9e-d59610fe9b95", "comment": "Malware payload (RedLineStealer)", "value": "f9c975f8007db83ba497d1ccfe3703b1a68d52ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304547, "uuid": "9489cb77-dcb0-480b-ac82-f43274cd498a", "comment": "Malware payload (RedLineStealer)", "value": "eddec435881d38e81a5e97103fcb12b3bf00e540487ac4b57b1a487cb981e04097df36e74c47371d6520ad4ba4590988", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632304547, "uuid": "ac95006d-20e7-4e6e-828f-7476770ff1d5", "value": "T14794BF6CFBD04B22E7AE8730C4B30987B628B8559407D36F654D03354C177A9EC66ABB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632304547, "uuid": "bf38624f-bf75-47a9-a282-415aedfed7be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632304547, "uuid": "8742748e-e45a-417e-9563-9a2a32a4507a", "value": "6144:O8106+VUzPBHpx6+GSO7dqF0uOCH24rv97SsT2U2AXgi:O810VVUtHp1FnOEhrmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632304547, "uuid": "9d51dfd3-e2b0-4737-8481-a35b4f20cae4", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632304547, "uuid": "6146583b-0d58-4759-b499-9917180c07be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632304547, "uuid": "3c0a6096-f30b-4b0e-b8f3-aa8595e99016", "value": "f1605eda6ee89c9d60fc6f3ce0d91724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d357af68-1b6e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632292334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292334, "uuid": "be3e0ec7-042b-47ef-98de-987ef9dac2e4", "comment": "Malware payload (AgentTesla)", "value": "c5b8eff1e9f73c6c365876188326f2e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292334, "uuid": "f9060176-ee09-42d8-bdae-c5048681b8ca", "comment": "Malware payload (AgentTesla)", "value": "08ff9ba01b2bb91356079179b857992f65f4e0bcef5183e4c72295f6316bd571", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292334, "uuid": "fc25a139-62ba-4f34-9529-509908adecf8", "comment": "Malware payload (AgentTesla)", "value": "255a9ff2336c26eda352633788eff8757134a7bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292334, "uuid": "3feb39d8-a85a-4f0e-a44c-2582e8a95c48", "comment": "Malware payload (AgentTesla)", "value": "d95fedc8986fb1c5f0a5d340881bee77e3ceee0ea7a156a94fd82df0cc4cc71c53d9fa63c9ef8c52479f9d6b95a8615b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292334, "uuid": "3be047b3-ce94-4ad9-b92b-8b6e38e40ddf", "value": "T17BC46C1063945745E4BE9BB859B450145BFBB842CB7BD32DBCB401EA4F73B818B27B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292334, "uuid": "f4b986db-f17d-42da-b988-af6cb2871c9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292334, "uuid": "3162b13c-0f7e-4297-97e2-2139ba06cd9c", "value": "6144:+K5q6p25LSN5M+13Y6GptqTpn3dwZIEnnyU+gwB1p3FrO09HIeCXnZuVNG2N:+K5q6pXovUJeZIEnVIB1Trd9HIZ7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632292334, "uuid": "eb10f17a-ae3c-4412-b168-2d2796588377", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632292334, "uuid": "213f8598-228c-47c2-af75-2ad4de2310ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292334, "uuid": "efad028e-3679-4eb3-8174-e0adf0b3f3ae", "value": "c5b8eff1e9f73c6c365876188326f2e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9999b2-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Osiris)", "timestamp": 1632316996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316996, "uuid": "1d7221eb-1359-4c80-b440-82c3dc1ae024", "comment": "Malware payload (Osiris)", "value": "b5c160ef4bae5e1103f0c32a133de542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316996, "uuid": "addff4a4-3cb2-427a-b376-1247fabc27e9", "comment": "Malware payload (Osiris)", "value": "0905e3a59d5e98d625d3d70d0148b1c18523d230f4e6ef5ef0d9147e25c8f506", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316996, "uuid": "fa726f1f-7f3c-4064-83d5-98db4c750844", "comment": "Malware payload (Osiris)", "value": "ff2e659ac88514fdeb2a884f1ded6b1bd5932b5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316996, "uuid": "e9a7f795-f0b9-41a0-a7b6-7a1e16c7bc90", "comment": "Malware payload (Osiris)", "value": "4ccbf0ed4b08dc3be64cca2dde725e9dfe9b97a4de0121f2249fb34695f6c287c0c482bb9fa260361dac69e2dd092776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316996, "uuid": "3d2cb1b9-c53f-447b-adaa-a89c9334cd07", "value": "T12F94BF22F581C036D6B102B0CEAD7F3B96FDE524033599D7B78809951EA44E67339B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316996, "uuid": "10fbfe74-f38a-4d00-9343-30f1983e63b7", "value": "cd3fc0dde37bf2787f0f054ef3b5a350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316996, "uuid": "e79e9adc-0a14-4312-a455-c3f08414472f", "value": "12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK9SATTsx/SA/WegYfdNbrqnuq:rXh6XcBXo8TsL8Y8m/ATTySA/DrfdNbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316996, "uuid": "50c066b0-9c15-4b2e-9004-a12f910cd31c", "value": 444938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316996, "uuid": "08e0b72c-055d-46db-8643-8cedb7778c49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316996, "uuid": "54de079c-8a7a-4d92-b847-772e4ac47ecc", "value": "0905e3a59d5e98d625d3d70d0148b1c18523d230f4e6ef5ef0d9147e25c8f506", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d80ce30-1b7a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632297156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297156, "uuid": "5b5cb62f-a645-4938-9cc4-ceefcd155dd7", "comment": "Malware payload (Formbook)", "value": "3b2e0266bc6fb85ccec0373abeb8527f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297156, "uuid": "3d3ad412-e06f-4af8-81ce-240a31861a03", "comment": "Malware payload (Formbook)", "value": "091230bdb21752192badda687f5def8c29d988ddab761901ed5c6594062c1e9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297156, "uuid": "8dd06f7e-baad-4d22-b12b-24091875459f", "comment": "Malware payload (Formbook)", "value": "a0f24e41bdf0a9560114e2bbbb56bbaf0cb3c1c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297156, "uuid": "aef3b282-92fa-4ba0-92dc-bec2920ffc93", "comment": "Malware payload (Formbook)", "value": "83f4ed6026a95febd620a228fc578088add45b105c08b6849c7df55177488dfb2f50d11f35e4a513d1218e1cdba52785", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632297156, "uuid": "95be8ef2-08ef-4296-a29c-57660416731a", "value": "T11EB4223997389B38C6AE47BF723650494F31324A7B53DB29AFC1B4CA3E1B7451028976", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632297156, "uuid": "19093fff-5788-4fca-958a-cf85714e3caa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632297156, "uuid": "80445656-012a-4832-b8a9-4a556c8a8864", "value": "12288:mB0VmtiK5oB/BrMx5VpNMOMDjp6ktb7/rMrhCKY6:p+FoB/ex5VpNMV8ktbzgtCKY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632297156, "uuid": "2634a379-7e3d-4f6e-a5c4-b6e34748b910", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632297156, "uuid": "41b7bbe4-6b44-4d30-b0b2-846b24651168", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632297156, "uuid": "ccbc0be0-5cca-434b-b734-3850d9daa825", "value": "IMG-009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0209a8-1b82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632300721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300721, "uuid": "90f01237-99d8-4b04-848a-796d3ae2e271", "comment": "Malware payload (AgentTesla)", "value": "304d7409ccb7a2187e5f056aea2dfa85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300721, "uuid": "6acfef91-b18a-4b48-9b5f-5961526a7772", "comment": "Malware payload (AgentTesla)", "value": "09e8cdd2f041543bcc3829af583566f5406a89898e100457f8160c937bbf2bd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300721, "uuid": "90b69174-2689-4269-8d89-317509e96e3a", "comment": "Malware payload (AgentTesla)", "value": "de8315109f82e32c72a2f44d5ce241119eb2eecf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300721, "uuid": "4c4d6347-0826-4eb2-9c9f-8936c7bd64cc", "comment": "Malware payload (AgentTesla)", "value": "ddf0431f464635bc2f8fcb0892d4b4898e30cfb0ab2a0ff7111f04cee287a25025ba61b782c7d234977ae828adf8d0b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300721, "uuid": "19ac6674-6c16-461f-b41e-8bd47697c84c", "value": "T155D302ACA6F5CA48E3EE4172D1581B07EAA57E038208577658E7733EDA3B8C14E343D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300721, "uuid": "ea5d6c52-6186-45b0-ab99-271e914fb480", "value": "3072:O+wAZA1VvdJlWhwke+H7+aVAJwGTRNDgjJ9WVw:ubJdJs4+isAJwuA0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632300721, "uuid": "42cf66e5-b8a6-439e-ac1f-183ad478d7a4", "value": 132376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632300721, "uuid": "cd02ec5b-1b45-4907-8054-00daa0f3d689", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300721, "uuid": "31d153f2-39de-402c-be56-9804f1dc2fdb", "value": "PRESUPUESTO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf65af5-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316345, "uuid": "f8dc3661-fdcd-4eb1-b9d7-dd81d22b43e7", "comment": "Malware payload (Dridex)", "value": "99d825363834b265bc02ea77e04f7365", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316345, "uuid": "ba9c1e21-ac7c-448c-9d49-7e050947f6a8", "comment": "Malware payload (Dridex)", "value": "09fbe393e0d84acc45fc087d558358dc1ee4fb01bb5cd3615c15d810ac300ef3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316345, "uuid": "de76f97d-5bb4-43d3-8826-8e6d6fc90f39", "comment": "Malware payload (Dridex)", "value": "9044123dd19b1460673157f9696a35796508b5f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316345, "uuid": "f2b5edf5-c4df-47f6-8944-ea2d6b891fcc", "comment": "Malware payload (Dridex)", "value": "de26e085f14cfe2cde90f9f0937a6a262243f35fc25c087f623645653dd50a712c739750aa9f3ceb2a7f83d69f1b1eb3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316345, "uuid": "8def454b-bd65-47e8-a9cf-ccd40c3f788b", "value": "T15EE5D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316345, "uuid": "e2ad9658-7210-4d9b-8d08-98c27c6b2215", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316345, "uuid": "e97132aa-1247-467e-9342-56f874590800", "value": "12288:+VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:jfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316345, "uuid": "cfce48f7-6f2f-42ac-8bd4-a80fd5b9d8d6", "value": 3231744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316345, "uuid": "6c1328ec-7829-450f-b278-66af3a97d91a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316345, "uuid": "490835b6-fc1f-419e-a284-43b2defbdf4f", "value": "09fbe393e0d84acc45fc087d558358dc1ee4fb01bb5cd3615c15d810ac300ef3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458c49e5-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632317007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317007, "uuid": "432c20ba-5d31-4e0a-90cf-b0a6de2ad7e8", "comment": "Malware payload (njrat)", "value": "347ff437bff7fd078a6aa65c04620b84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317007, "uuid": "314e5b57-2bf7-4d0e-b0ed-ceae403c7328", "comment": "Malware payload (njrat)", "value": "0a9eeb784f09d322d2a05a74a75bf4233052a66325b14b166d6273563217f41b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317007, "uuid": "6646d461-454d-469f-8257-cc311fd1e72b", "comment": "Malware payload (njrat)", "value": "4c5f2b093cc9be24b61c4d83502f409b1e757f20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317007, "uuid": "125857c6-268f-452d-96ba-7edb1899079d", "comment": "Malware payload (njrat)", "value": "950cd1110a064718195688b03c640d1c4c2f1a1e0c6c24a7864486b09b12ba8c5fbf564fe001f4e247ce422016f6c1a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317007, "uuid": "78cd1a73-0ec3-45f0-aa0f-c7ad272e7932", "value": "T1EA5428C7EAC4C599C6792136C89AEFF415617CFDD843CA87A0943FAB31B3147A9A050B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317007, "uuid": "1a855f2f-de65-4b4f-b9a8-b8dcc7426de2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317007, "uuid": "eb0f9ba3-94dd-4287-af16-660d83cd7120", "value": "3072:kHYoziv+yJleL0V8ZT/5mLT1CcZ1w7vvWGym2B16xwK98+M2:yYo1Du8NYxCcZ2jvWGZq6mQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317007, "uuid": "b2f81461-c0d2-4c7a-8977-114459b5d2c0", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317007, "uuid": "8d888de6-3afc-4e58-8e3e-98aa02d33d69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317007, "uuid": "a3e65737-7e62-432b-9d4a-9a681f516c84", "value": "0a9eeb784f09d322d2a05a74a75bf4233052a66325b14b166d6273563217f41b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12fb18ae-1c00-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632354718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354718, "uuid": "532c03ba-9b4f-404d-bf5f-2e2b14b53b3e", "comment": "Malware payload (AgentTesla)", "value": "ee5991228ed973aad50893d5141d507c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354718, "uuid": "e1f124a2-9764-40aa-940e-fcb43b87c966", "comment": "Malware payload (AgentTesla)", "value": "0adbb07bd261f70ab0a0fc4fa25aaa4d4284255eaefb10588cd64e62c3f4ebfe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354718, "uuid": "dcb56bec-3fb3-4005-b4f3-3b176835cbcc", "comment": "Malware payload (AgentTesla)", "value": "770fba44a9ea9d58ca16844b306a573a4718477e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354718, "uuid": "4dcc7b3e-fb87-4e11-afe5-b6594059b67a", "comment": "Malware payload (AgentTesla)", "value": "b9c69dbc82bcb88798fa9513428f8b730ec6d6a45a502ccb7afbe958443d470a183a17136bd5927be33bba20e51a3950", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354718, "uuid": "6a2a94e7-7ab0-4b85-b388-bd5c3b4b5021", "value": "T1150516394D2682F747EEC66CD08C1BCEEEA6A4837B915F1AC496D7D2025B70FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354718, "uuid": "7d83fa5b-4d81-4135-8865-7f21fa43083c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354718, "uuid": "f9efe5ae-2e2f-4bf2-a33d-c69fd011ac24", "value": "6144:yrpNPCFXUC/IsByCutWO0Fx14jSsz+bGJQuTyAT+8Lt52BtsVxOu9RNHvst4lc:yVyXl/q5Kb4+szMB0edu9PC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632354718, "uuid": "090c0802-32f4-4937-bc12-4b4a20e3e5d3", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632354718, "uuid": "7c0e13de-c343-4f67-a34f-caee86d1717b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354718, "uuid": "2a08ed86-7f4b-42a1-ac2a-8b65936bfe30", "value": "Statement of Account _xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b8744f-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316788, "uuid": "af078dbe-ba96-4621-bd55-a43a8bab143f", "comment": "Malware payload (Stop)", "value": "fa1edac57296359722d7a06b8c900670", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316788, "uuid": "17c33678-513b-475a-a2a4-cecc811ab0f2", "comment": "Malware payload (Stop)", "value": "0bb1bb35ac005983362f66e71e0213a98efb8f97955b10c280ba4ec854fe2876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316788, "uuid": "2613af74-ba01-486e-960d-0869b30f22b4", "comment": "Malware payload (Stop)", "value": "fdce3039d7e4ada1cd44bf132b5bcb76dd404f10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316788, "uuid": "5042bcf0-1a33-4f65-a20f-c0af2c4273db", "comment": "Malware payload (Stop)", "value": "b96b1eef7b809b43865f8c95ad9eb00f5849f8108e53b906d757ac413aca49cf194857846f6507cffe08a65ac01adf01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316788, "uuid": "ceff8405-30ba-46a4-abba-db4533e9d7d5", "value": "T13905F130BA91C035F5BA05B848B5B3B8653A7EB09B3455CB62E52B9E92341F4DC31B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316788, "uuid": "9d2b87a1-5436-4620-9cd8-1fbc87776201", "value": "96b0c0b056f44468723aefb84fe936ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316788, "uuid": "6d1f676a-e1ef-4551-82da-766bf25ea6fb", "value": "12288:oo+nxKJG0GLwdy4ZrsAl3k9ER8wx4GiFS+bHMKz12cWgsiUTMwUdJEzG58dQF9Ci:79JG0Gq3k9EEBSXvxOFyQiAhcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316788, "uuid": "11bae58b-7839-4d49-88fb-0b36acc5b54d", "value": 819328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316788, "uuid": "f79ffda5-23e4-44b2-88b7-937222547656", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316788, "uuid": "61f63ecb-3424-4b15-8661-b6fb29baf92b", "value": "0bb1bb35ac005983362f66e71e0213a98efb8f97955b10c280ba4ec854fe2876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da8c819-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tinba)", "timestamp": 1632317021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317021, "uuid": "05d034e9-8a5f-4eca-a815-9542715ec6b5", "comment": "Malware payload (Tinba)", "value": "3a880a9825a0364a06a8144e63f4be48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317021, "uuid": "10e4b16c-4551-4d59-bf05-703dff75d8cd", "comment": "Malware payload (Tinba)", "value": "0bd9422f4e15cbfdd3c3365545ed88a0e0d95c7aaa51bae0e651dc22981c4395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317021, "uuid": "57371a5a-91b3-4518-b1c3-67c1d97e826d", "comment": "Malware payload (Tinba)", "value": "af5ae30a2e6fae8559cf9304d7b447a34d59396c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317021, "uuid": "19383daf-0200-4d02-ae5c-aae80b281c59", "comment": "Malware payload (Tinba)", "value": "a9ccc0d027b567e82aa8ae494e6f4d83e037ee893610cf96cabf6a2947745c8f846a7a90722fa90a2d2937e9d7b78984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317021, "uuid": "39178d5e-4193-49df-9931-38d5f0598b4d", "value": "T1E7044BB1F204E48BD957D8F2991ECD3168623EBD99A0450D32E97FAD68B37D20059F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317021, "uuid": "99ca246c-a065-424e-977e-5efd66a46c10", "value": "043271249094384096fe3a6b9e4520d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317021, "uuid": "9394107b-69b3-40c3-831f-391c589fdc18", "value": "1536:ctwyCPx+riFFG1kF/m3wEYQqjh+rmKVsMiVPkSNRA:XycYqdFEgjwqWsMMsaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317021, "uuid": "bf728fd3-6912-49dd-8fbb-06e63eed4833", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317021, "uuid": "b4710290-a60c-4257-8d19-e90c2e1ccdc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317021, "uuid": "37a722d3-bbff-42de-b7fe-01083a4c1acc", "value": "0bd9422f4e15cbfdd3c3365545ed88a0e0d95c7aaa51bae0e651dc22981c4395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55b47d1-1be8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344790, "uuid": "ee39ad5d-ef36-496c-b8b5-eb890e65d846", "comment": "Malware payload", "value": "090c96fc363153255f5fc3996522df3c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344790, "uuid": "672fe2e2-02c7-47f8-a79f-b4e7aec1852c", "comment": "Malware payload", "value": "0c7d3b3bb30dd430323c16e6197ad7d99d0e6e730c513f0da4da5bf0dbde35af", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344790, "uuid": "6a54abb1-5f56-4a4c-bd39-870f900e6931", "comment": "Malware payload", "value": "0ead2f0785f5650dd62a709110f21db16a404460", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344790, "uuid": "9c387b73-5cce-45ea-b209-972f65895c62", "comment": "Malware payload", "value": "175022ebd6d8b67c9d0dad93d13bd0cb25ea750fc9d406f7b3e405a36aa7b24cea24c70bf257ffbd40c80b55e0de3c4e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344790, "uuid": "a96e18eb-b654-4751-b510-eea998460623", "value": "T1519423B7A6D9E155FA7EB6B15A78D8E130D26951F33082DC00BF92DC42A90D0F5F48D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344790, "uuid": "3c5e9ad6-fc95-44dc-9e46-6ea27324761f", "value": "6144:LvP6tbv83jdRRwxg300+iGD9NQ9AuKqF3aw7/qmUQT2qb8My1xHz62zIm4wNnisn:N3jdRRrEkd9ZFl7/qmUOyrE/GW6c75Vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344790, "uuid": "f01f7131-6cfd-44b6-a56d-b8aabaf4ad44", "value": 446604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344790, "uuid": "fe99e1dc-098f-4b8f-a68f-dbd22c982cfd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344790, "uuid": "0667580f-ac11-4f6d-8f2d-fa04af1d1848", "value": "\u8fea\u62dc\u5973\u63a8\u5e7f\u5206\u4eab\u81ea\u5df1\u7684\u5f15\u6d41\u8bdd\u672f\u5168\u5957.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050347cc-1c00-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632354695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354695, "uuid": "540dd4e7-9d93-4c12-a835-f088b93cae86", "comment": "Malware payload (Mirai)", "value": "1589b96db1490efac2c8525d146ea704", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354695, "uuid": "3812c551-1a10-4dfd-93ac-2224b4df18f8", "comment": "Malware payload (Mirai)", "value": "0cd2f6e767cd9513fc0a03ce6f4e984bb8eaedd0717d0e8ee824cde646e4000e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354695, "uuid": "c0672e62-141d-4596-8e7e-06202305ee2d", "comment": "Malware payload (Mirai)", "value": "b48abc7553bf39e2d7dcceb9cfcf8b38294963d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354695, "uuid": "97ffb443-45a8-4ad2-aa36-966103f2bf5a", "comment": "Malware payload (Mirai)", "value": "09bbf4846811367cb4d931bd810e66ec6f5c60d0b3dc3d4472659f0406c5f806282a0b3ad10383ed8e4bcb4687526e62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354695, "uuid": "0b4dd60a-020f-4bc8-805b-220c10d712da", "value": "T11773A50ABF610FB7EC9FDD3749A91716288C551A22A93B757E30D828F24B24F15E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354695, "uuid": "442f94b7-e8ce-4ab8-977b-cd9c7faa6a7f", "value": "1536:aqJw3YsMzgJzUflVYbBSsZjZyDZXxhaGAhUzD:aqJesMJzUPEyDpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632354695, "uuid": "478ee3d8-de34-4a14-a66c-feaca47583b6", "value": 80052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632354695, "uuid": "a7f2db70-b4c4-4edf-bd63-48d57e25ec5c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354695, "uuid": "a4bbd460-49dd-424f-a96f-9875056126d5", "value": "1589b96db1490efac2c8525d146ea704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940414a7-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632289651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289651, "uuid": "0977aedc-1add-4b75-a5b5-4881be536525", "comment": "Malware payload (AgentTesla)", "value": "e3a739195a0f8b08050615fd58d2945f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289651, "uuid": "b1863530-0d08-47dd-adb4-ff8b721108dc", "comment": "Malware payload (AgentTesla)", "value": "0cef3490907265f098d99aac6de89889f530570ea7137291144e6e7f730f27d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289651, "uuid": "dfc44b43-958f-4f36-a7be-85eaa4afbe51", "comment": "Malware payload (AgentTesla)", "value": "f9280269f9e6e65b08eb53434fd9b78dccaf8b3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289651, "uuid": "d2e22547-34cf-467c-a197-d471faf77365", "comment": "Malware payload (AgentTesla)", "value": "d16ccb7f61dc1ac8f7f9e94ae08c25a2fd113cbb51d6cab3ac03a868a387fae0d094f5cca6dde1ed740986d5b3cef21d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289651, "uuid": "7f1cabec-c3e8-42a2-9646-b189b0149d97", "value": "T1F9D3017AC343A79AE45323B86DAC94E82DD34DBC1CCAF3A791C576C8807B84D418567E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289651, "uuid": "6d337b85-b459-40bc-94c3-b1e167543f35", "value": "3072:/a6np4quRe89+PkTttJk3z163SFjQRgSr9wY:3nerRe8975bk3uSFkH9wY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289651, "uuid": "f57f44eb-b673-4819-8de2-077a36b78cfe", "value": 132472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289651, "uuid": "375757d9-7194-47f4-8421-9fc6ee9e4635", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289651, "uuid": "28794bea-cbea-4020-82d2-10c6cd2ca7ea", "value": "RE 134PKGsDOCUMENT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6fc1a4-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Matiex)", "timestamp": 1632289481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289481, "uuid": "388be8e1-7dfb-46d3-a589-4087c1c0ae8f", "comment": "Malware payload (Matiex)", "value": "fe8171a07860b995e5b676df7af4917f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289481, "uuid": "b0af9f42-a551-4a16-94be-e9c3b03f483d", "comment": "Malware payload (Matiex)", "value": "0dc02738b4f4ff0ec647c5db409d884b67275abae3f3373931e03aff4d15c705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289481, "uuid": "3525143e-75e0-4352-8031-b5ee6a3a2fd1", "comment": "Malware payload (Matiex)", "value": "05143b3155f467d7d2c859199edc1f3b5fba86d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289481, "uuid": "0cd75ae8-74c2-421d-915c-d6c54c698981", "comment": "Malware payload (Matiex)", "value": "c3399d4b734cad642924c208526c7cfae1cc8fc7764ccfc25fce329fe3b2cf402b00fea10f47d78c3ab8370cdf77f29f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289481, "uuid": "31135bff-67b9-434c-85f1-a3ba3b319e9d", "value": "T16D541202F1E0D8E7E1928530026F7E38F326C7098171695347B4F6BD69B3ACB4676D96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289481, "uuid": "143002d8-6af1-442c-b76a-34ac7c31f312", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289481, "uuid": "4ac9ea32-8227-4172-b476-260159adecff", "value": "6144:b8LxBqi+1xGphbvcran75VWae2bTOn51IsxvImV7SwMTeJrCV:niKA3r75Xevn51pI2zMyJrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289481, "uuid": "6daa2b67-0a62-46cd-927e-1b53090e23f5", "value": 297580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289481, "uuid": "3a52ee71-b03a-4317-95fb-8919741d4310", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289481, "uuid": "c55ad1c6-9a61-4ca2-b03c-ef966a770a66", "value": "n545687654589b87656n9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c46b63-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632316746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316746, "uuid": "95883119-a6a9-448a-ac5f-3e92496397b1", "comment": "Malware payload (RemcosRAT)", "value": "9fc2632afc0436ae0e5e57b726c9bb98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316746, "uuid": "8a287ed6-f53b-4c90-bd1a-1625264fa910", "comment": "Malware payload (RemcosRAT)", "value": "0ed7656021073d58f73292d2a99b7723c6a67a2e67d952d8fdf3afa6701bcde8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316746, "uuid": "77bcc906-52af-4d80-a058-4001607afd29", "comment": "Malware payload (RemcosRAT)", "value": "092cb95516b2534cada79bb04f5ae8490d7ea942", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316746, "uuid": "45f1c02b-22a2-4d9b-a9f7-068d3125c4a3", "comment": "Malware payload (RemcosRAT)", "value": "b559baf61abbbe8e673c933023eb9fe0d539ea26888ac38cfc013375c17938eb7096f484a41c8e65cbf38b288ff56e34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316746, "uuid": "c7fe3936-653d-4984-9049-4b9ac1e7b9b0", "value": "T1BD35C0C17D47D89BF0DF5AF398AFC12012646E8D9161C73D26827A2B59F3352309BA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316746, "uuid": "82aee0e5-f7cc-4876-9c37-7d06ee878dec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316746, "uuid": "4a24471d-6eab-4dbe-a448-5b8132600299", "value": "24576:PBU7mjTm6q+FoqbNmFmgYIlBvZr/hCPfOUvo5x0BdIpMdASZK:S6oqbNmFfBvXCPfMwPIuWyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316746, "uuid": "2bfd4110-7e1f-49d6-bda3-8aeb18842e09", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316746, "uuid": "be660984-c57c-46af-bc82-ebdaea355f6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316746, "uuid": "f29ad2b7-565f-4186-bd17-75b502eb1920", "value": "0ed7656021073d58f73292d2a99b7723c6a67a2e67d952d8fdf3afa6701bcde8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8846c477-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Troldesh)", "timestamp": 1632316690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316690, "uuid": "5fbc546b-d36b-400d-8ab2-eb77d5e0306b", "comment": "Malware payload (Troldesh)", "value": "64213e0f66738792dafd21a9d45f9d5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316690, "uuid": "73938804-18fc-406e-8a6e-d4ec040c9820", "comment": "Malware payload (Troldesh)", "value": "0fd2df2e477e32ea67ae753d401f8b760a9d44e8f8198f6e4c71fdd136bdd17e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316690, "uuid": "586d5fb0-bb0e-4e4c-aebe-f4985bcd0be2", "comment": "Malware payload (Troldesh)", "value": "70ebd893b56767ac910a8f045fd60eb089de1bcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316690, "uuid": "90b0a6d4-2837-446b-8849-2cde477887c6", "comment": "Malware payload (Troldesh)", "value": "d66a93fe91ee526e663ef0d010813e5bdc2688ec0b8b7d0df4595c40da8d8833f51f87523c2fb4e0110ee5a43306db72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316690, "uuid": "e7661c8a-01a5-4fb0-959c-4ea6de030853", "value": "T1145523350040B107E5FFFF39209C7ABDA8156640237D4E8FDB784C465B72A60B5B96EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316690, "uuid": "f59d23f6-47ef-4043-8454-a0e41a35ca65", "value": "7f5bc360b889d00502e2590e4514e224", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316690, "uuid": "72aae934-4e97-4c33-9a72-84880792479b", "value": "24576:zMJm6zq5rr3fhK8LOT3elmV3skfSt9QXGASh3huhS:6zq5rr3JxLnS3sRrAC3w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316690, "uuid": "0697929c-0c25-4b8e-8e4c-8ce3c55fd29d", "value": 1405709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316690, "uuid": "b8eec111-59c6-415e-bbfb-908f908c4adc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316690, "uuid": "24254f10-c2c7-49ee-9440-56553b8aa2ed", "value": "0fd2df2e477e32ea67ae753d401f8b760a9d44e8f8198f6e4c71fdd136bdd17e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be013eb-1bc5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632329581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329581, "uuid": "0b9d8a83-78c3-42c6-bb59-df89d37eb66b", "comment": "Malware payload", "value": "f7eefb2f68fe193d21779f6fa832448a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329581, "uuid": "db645eee-0407-4673-9fbf-aeb362a09894", "comment": "Malware payload", "value": "10a94d8e04e57e4cf38d94e749e6655864a27b9bdf72f2e0bed9042fc3e97532", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329581, "uuid": "dc5e406a-8a3b-49ed-a738-f9dbfb34f207", "comment": "Malware payload", "value": "37bd5dd28d906de4d4218bb89dfb1fa6a579b8eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329581, "uuid": "2726d433-ad3a-4bfe-a591-959374c5d436", "comment": "Malware payload", "value": "7d43b566525d54a610883c92dba4f18e71a3ff8cb28fe678368b3bc2dd7db54a7e919c810fefcb0ded7436d1ca5d0020", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329581, "uuid": "9a149a14-bb21-475d-81d1-570dd701d69f", "value": "T17C55F15A6A886E52CE5803B88161DDB89272BE543CB2C71F14E9BEB73B773D24C014D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329581, "uuid": "a5dd2955-0ffe-422b-bd49-7c8684ba35ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329581, "uuid": "faece348-e737-41d8-bf16-5483ad6172c3", "value": "24576:nmMKmKgwpPuozoIeLYhHlToymk73kA0+08PY6id:nmMBwpPeaJto+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632329581, "uuid": "f9288ccc-3421-44b5-9d5e-363f5a70ddef", "value": 1316864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632329581, "uuid": "3213fb65-5e1d-4273-9c44-71478d07288a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329581, "uuid": "d6a1e6b0-7912-407a-9f32-9f8d285a6370", "value": "Config.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418d63b1-1bf2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632348783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632348783, "uuid": "319e2d66-239b-45ac-9668-441536c10fdf", "comment": "Malware payload", "value": "dcf0af8133ef8884811ad04f6c4274e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632348783, "uuid": "0a02c538-52ee-41a3-b93c-319f6d85497d", "comment": "Malware payload", "value": "115716164b2092df207c750d11a2b4ce05bee204b7f21f1f62d93a5b7d78afa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632348783, "uuid": "e54f845e-3189-4f93-937b-e2acf37d34d6", "comment": "Malware payload", "value": "65c24521f2670260e9abe932c639f51b0847971b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632348783, "uuid": "de2249b2-c52a-43d6-acd4-59142964b645", "comment": "Malware payload", "value": "c809c274f44a88c3c3cce3901720f9d0b744493aa628cde9063a25cb03ac42c2b49b254d8ec90275181f1a37afe915aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632348783, "uuid": "fc0f10bd-078f-4a8e-a05c-4c9f133c1946", "value": "T152F47AC56D588A13C3904632DC5D6245326C2D4A3723875BDBE93EB73EFE2C7852C98A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632348783, "uuid": "d211742d-55cf-444a-a051-f482af3fe6e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632348783, "uuid": "c8832ba7-29b6-4784-9e87-5d849676a473", "value": "12288:wsmtiK5oKrgYkqkI0XczD+VuJblQn7GLJ/He16WgZa0k:D+FoK8DHIAuvbliyLJfeIa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632348783, "uuid": "bf674018-c138-4427-a344-a5306b40e8ed", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632348783, "uuid": "e450efbb-391b-47d0-9711-2f4159363571", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632348783, "uuid": "4a768044-a306-453e-a960-32059cdc1cd1", "value": "onxyPs4yG1MUPbN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce522ae-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632289666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289666, "uuid": "3d663958-184f-46eb-acfc-fa98df4468c4", "comment": "Malware payload (AveMariaRAT)", "value": "eea981b0094a7862e8a028e211d94cec", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289666, "uuid": "21a933b8-26e4-4821-8784-bc903f291fbb", "comment": "Malware payload (AveMariaRAT)", "value": "1180903c2619dc733621ae04bda732dd1c437f60dc3c2dad0317d52531f72c21", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289666, "uuid": "16515aac-f3a9-4405-97ab-16c11bf3ed8a", "comment": "Malware payload (AveMariaRAT)", "value": "bb482c5ac253dcae4948f1c6ad728c20b40251b0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289666, "uuid": "5eed7829-0117-4b77-90c9-335308c39d7f", "comment": "Malware payload (AveMariaRAT)", "value": "985375bb0867e58d9d7a77d91744fb0980d0875548a7b2ea962a5f2432e0e034044b3ca4187f3cbcf10b8952bbebd7fe", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289666, "uuid": "8239382c-53d3-4630-8d9b-49288976ce79", "value": "T18E957CAC3310FACEC567DE3585642E649B6074A70307F343B52B64E9EA4E49AEF440F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289666, "uuid": "e940e463-e84d-438a-a2a8-0fb9c66b777b", "value": "12288:aDcyVtfbE0Nuf+nvWiql+58iok2gKRu4/e5FHlIdUW94ysdWjPXjXb2C0NEAllvd:anVtfbzNnvel9Ru4/e5FFO3Ar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289666, "uuid": "e7a84d97-283c-45b4-ab97-b5b7e77352fb", "value": 1900544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289666, "uuid": "b7774086-f847-4b36-ae5e-850a974b2364", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289666, "uuid": "40b460fe-fac1-4fb2-bd55-187ec5cbedcc", "value": "DOC51098.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff224d7-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632334392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334392, "uuid": "d7fd682e-b470-47f0-a158-43dac1ee7e37", "comment": "Malware payload (Quakbot)", "value": "07c2a3506de6e79a9ffe7557a22d9aaf", "object_relation": "md5", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334392, "uuid": "db3bedf8-c9e5-47dd-adac-0298c3145d98", "comment": "Malware payload (Quakbot)", "value": "118379fcbc08532a97ff77ecc62f6ddad34b7f91f77002b9eab98a405ae12ca8", "object_relation": "sha256", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334392, "uuid": "e3d15ff1-e256-4dcb-a012-302be7bdb934", "comment": "Malware payload (Quakbot)", "value": "daf6048df60bc6716a185db8acf9fa21d293be82", "object_relation": "sha1", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334392, "uuid": "773150cf-6b75-4a65-91bf-b146e7c45a91", "comment": "Malware payload (Quakbot)", "value": "8536a64e0dcc966d6cef7fa54b23be35450662e34cf94a1b61e8a0f657df5a623680271233302ff8d5a39f7a124c712a", "object_relation": "sha3-384", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334392, "uuid": "1e1aa47b-46c5-4a1a-915c-9db15021d913", "value": "T17BC4AE19BEC3D1A1C83C187488A1C8F27638B865AD54D6473AE93F3F5EB31C25C560AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334392, "uuid": "96a94d6c-1188-4558-9752-c6ee62b3ab07", "value": "c900f0b45b7574481cc6a21428393566", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334392, "uuid": "3d6f05b5-24e3-4b76-9641-b51a6417fa91", "value": "12288:z1ghp5DubQ+ErdxA+zM5miTrqZj1kENwNmhxOgNU:Adrv05T+ZjHNwKOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334392, "uuid": "b67b608f-e7de-4603-b3d8-35da68a23b44", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334392, "uuid": "73a9a3c6-ab73-4078-886a-453327167508", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334392, "uuid": "2f78cb1d-34e6-48de-95c7-e1022f466c0a", "value": "07c2a3506de6e79a9ffe7557a22d9aaf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d394f8-1b82-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632300875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300875, "uuid": "f21f6d2e-d7cb-4b72-9d69-9ac0a3293f59", "comment": "Malware payload", "value": "c15ecc2aecbfe7f003481bd47b433e6a", "object_relation": "md5", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300875, "uuid": "2a0d1805-2ec8-47b7-afda-753f8516b49d", "comment": "Malware payload", "value": "129cc53d766b2d3bfb393a346db3d9025757850f668f7226c3a75a696c502d5d", "object_relation": "sha256", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300875, "uuid": "d7353290-49db-43d6-b2f8-7023c7842e30", "comment": "Malware payload", "value": "caec97f44c547d59f55987d7d4b9b294b776d361", "object_relation": "sha1", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300875, "uuid": "e3ae1cae-8ca8-4dff-8de9-24438f4c2020", "comment": "Malware payload", "value": "23f020aa677910585acef8637633de5d89918332aa4a8d39a9356f805d605fbf719b065c2d70327bbcf17bda4ea94cd8", "object_relation": "sha3-384", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300875, "uuid": "339f1767-998b-4165-9948-9fe3e0328f64", "value": "T118443B5A3FF14DA6CDD81FB3C0F25A248F75B0201A96D7399670299A2F033DAE54B94C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300875, "uuid": "23cf3efb-c2cc-4929-bf88-4b806091baf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300875, "uuid": "107e46b2-74c8-4cb2-b1f7-90288af95720", "value": "3072:YoDfQxu4CG9az3+92I54xaO1/gAGRmI/B09ssid:M5CuazOYu4RYPpnnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632300875, "uuid": "d5833429-d88a-47a2-b50c-e65aeb2b7fe3", "value": 254456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632300875, "uuid": "0cca05e3-d6c8-41b9-a91e-44fe6cc14481", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300875, "uuid": "a199ae1e-c76e-4ab9-b81e-2f8af4966540", "value": "2690094.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ed9366-1b7c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632298090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298090, "uuid": "364d1efa-8164-4e42-991d-3a6fa4b25e28", "comment": "Malware payload (Loki)", "value": "327472a0c08de24a8d8f4063ddf166b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298090, "uuid": "b07e789d-1542-4c14-b9d9-de43e346ba20", "comment": "Malware payload (Loki)", "value": "135ecfd293ccd2b23f29fe2caa223df6d827ec6a11669608361e61ccee2b99e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298090, "uuid": "639bba13-7fc9-4b6a-81fd-84943ed6d7a5", "comment": "Malware payload (Loki)", "value": "69947c9d43a38505b1b7f3ceee5ac6a0c863a361", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298090, "uuid": "8554bf5f-b90f-4c36-98e5-bada5210780a", "comment": "Malware payload (Loki)", "value": "d04a669b46e783b4529d7e34ead48f3e0514b900fab272601603529c030ec125e7cb2f1a34ba1ee8a924a577d445774e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298090, "uuid": "1d5a111b-d0a9-4fd3-b4aa-c8037fa7534f", "value": "T11EA41234D3E886B8CA69DF7D6450864207B1F25DBB13D75AAFC470C92F0B3A510399BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298090, "uuid": "3eb0b806-7af6-4fc2-8ec6-7aa01f838504", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298090, "uuid": "2ca14afb-26b2-42bb-8d38-4544ddb0ce4f", "value": "12288:8gVEmtiK5oBUUZsm+fF7AokRHRDhR/K0frvPt:C+FoBfZslkokRxlR/Kod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632298090, "uuid": "16affcef-d693-465b-bdb7-2b6e808f593a", "value": 455680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632298090, "uuid": "c441b5e0-dead-4fe1-b036-f2dda6062a9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298090, "uuid": "04bda574-742c-46e1-bab0-718fd776ff7a", "value": "327472a0c08de24a8d8f4063ddf166b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187a4c1f-1bca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632331534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331534, "uuid": "90a3c9bf-d5bc-4f43-81cd-d86556262628", "comment": "Malware payload (njrat)", "value": "faadd040a36132904b0b44ce8acb801a", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331534, "uuid": "cfa31342-7e7d-4b2e-b12c-e3ce203d7a28", "comment": "Malware payload (njrat)", "value": "14c3d06f79c7518433e2baef8a920a310393b394b219241ff8e88a7ed7c7a07a", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331534, "uuid": "c9d7535d-4f1f-4872-b3b4-c8a528301c03", "comment": "Malware payload (njrat)", "value": "34e16916fce2e1a3465a8b571ca0d970509317c3", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331534, "uuid": "5d8c87b7-c6b7-4dc0-9919-0326301aaa56", "comment": "Malware payload (njrat)", "value": "ccfb2a00da898ccb824dc9b61d9280c351f1ffef139b0ef3c58e8c46227bf384af0f3c602243e5b6b3f166c730a972ed", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331534, "uuid": "262a1b23-c8f5-4ecf-9186-9f5342629c84", "value": "T14EF12F3CE60376ED741D5E2D09CB77295A10C0B5C953E6F9C710FAAC69EEB40AB51238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331534, "uuid": "e2fedcaa-b1ac-44ba-b9b3-270e905a64df", "value": "96:PrNTJhS9INIKMVGQRX8+HLz9spiINIVIWjnCQRX8Lnaa:PrNT2INIRRX8+Hm4INIVI8xRXAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632331534, "uuid": "181c5b63-4a55-4d00-92f5-ff8b9ff35a28", "value": 7770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632331534, "uuid": "f785f944-9c26-467b-b37c-ff7a7cf541fa", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331534, "uuid": "096d9b85-1c8b-463d-9038-bb4f434ed94e", "value": "INVOICE PAID.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a216aac-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632316908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316908, "uuid": "6863c407-5786-46a4-baf0-f1dbe2e64b3b", "comment": "Malware payload (njrat)", "value": "9cb7206aac1b4dd6f1238a743d7d0f1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316908, "uuid": "f52b7d40-e44c-4f36-9194-12afa42cae7b", "comment": "Malware payload (njrat)", "value": "152229e0ea69a3ed5c581ba3f74d032673388727b53ba63215a036a8950a07a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316908, "uuid": "7888b9bb-877f-4a5e-ad3d-ebb57666ee24", "comment": "Malware payload (njrat)", "value": "eb5ea71d3ca1f56189f413410a4ff47ab450db7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316908, "uuid": "fa25c677-022f-49bc-a7ea-7f1588b23c46", "comment": "Malware payload (njrat)", "value": "a3a6a0edd621290451bfc237dc2b82fccd15c3d894fcb0383be50810f795e79c5421a61f3e4a28f3f7e51dafc8887238", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316908, "uuid": "4e91ae76-98e6-425d-a10a-01faed265067", "value": "T141D4235237875371CAE6143158DF063043F8E7539637EBA27E488BAC9A427F24DA1AC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316908, "uuid": "a83e5540-c94c-426e-9264-938eaaf7c944", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316908, "uuid": "ea34659a-30e2-40cc-b81f-23af89db3311", "value": "12288:NEP/DEv6qoypy66XfZlQ8t+zhaDPjh96IAzoSnlnzkjWQA:m3YyUpR6ztPjhkO45zkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316908, "uuid": "be498363-4a49-4f2e-b129-4bacafbb1cab", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316908, "uuid": "412f0723-ac39-4ffe-8290-90909916b82e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316908, "uuid": "3d8b76ff-0443-4b67-a637-03223d1a68bb", "value": "152229e0ea69a3ed5c581ba3f74d032673388727b53ba63215a036a8950a07a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3324230c-1b9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632312681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312681, "uuid": "24e7f87d-57d2-485e-8fdd-914b087102ac", "comment": "Malware payload", "value": "242e1df035d732a2fd130a34e7786e79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312681, "uuid": "07bedef4-44d9-475a-91df-46bf8fd906f6", "comment": "Malware payload", "value": "1593e0b3d2c6f4640e3d7a8ce3eccf444c034a80c874723a17ecbb83e52b9023", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312681, "uuid": "f4b513e1-33a6-4d15-b76c-0ed6bf4e9f14", "comment": "Malware payload", "value": "57eb43ec83ed7ce07fa40b078332beb2d87d7e9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312681, "uuid": "e62c902b-6be8-46b8-8594-e385c55f7d21", "comment": "Malware payload", "value": "57fa448d57cd2feafcd7a3fc821e37c83937a5464f02e582a1ee92e1cef9375d8701dc5be3ff76481b8a88f84b1b431e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312681, "uuid": "af00ebbe-200f-44af-bf1f-f4ec62658e27", "value": "T11A83BE107B17A921D4341F7288AEA3C50372D74A7067CB5F3A9E113AAE627DF0760BD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312681, "uuid": "c2200aed-fb32-4806-9b50-dae5437f996d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312681, "uuid": "4f69a626-6652-472e-96a3-22fe93149d73", "value": "1536:Oa2xS0Cy74CT3TrYz6vDpMQ43+41xPNfad3:OaWS0h0CTXYmvFMQ4b1LfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312681, "uuid": "8ccb7f6b-2df1-4088-8c98-56497f74f3b9", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312681, "uuid": "7c41e890-50e4-4a86-bf6c-fb4a8f8c2587", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312681, "uuid": "f10a1a6e-8763-4be7-913f-eb8779e49f97", "value": "Shipping Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65cce7e-1b5f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632285951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632285951, "uuid": "914c8829-6d28-44f9-b62d-6a94a5c67a24", "comment": "Malware payload (RaccoonStealer)", "value": "7dd500d4bcb51676ebb9e3bc5d30d29a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632285951, "uuid": "b4180198-2514-433a-be17-88f80ca7833b", "comment": "Malware payload (RaccoonStealer)", "value": "15b6eb4f4ace0ca6e400fe08a3fc1ffac0875c2da9202e7e61cc17e617cf64cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632285951, "uuid": "71113f83-17f9-4f0c-acdd-07567de2c724", "comment": "Malware payload (RaccoonStealer)", "value": "07d5192eaf8dfdb96b19012ad73b56c04ef4367d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632285951, "uuid": "62b86044-f434-4d34-8736-c350c5fc9218", "comment": "Malware payload (RaccoonStealer)", "value": "43a17c1932708bbdd902465fb6dd61adcf8d0298d2c268325b5aaed1b7e2fac85f0c42dd25d81652a09f11a8efbc6a0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632285951, "uuid": "a9b7f515-c63f-485b-a3ae-d2e9e34f21e7", "value": "T1DE746C20BAA0C035E5F712F849FA93A8E93D7EB19B3450CF62D526EA16346E4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632285951, "uuid": "8a3cc54e-3732-442e-b293-ba90c34439ae", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632285951, "uuid": "16d600ee-7b79-47d2-b41e-21c16a118fcc", "value": "6144:vUHbtE4qx5hCoby23Ld9kc13LO3AKEdU9VS2:UbtE4i5G2bECWud0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632285951, "uuid": "3ba18934-35a0-42aa-abcd-dc37ac3004db", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632285951, "uuid": "50e19e4f-4838-4c2f-a6a9-ab5fb06cf226", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632285951, "uuid": "2896188a-2a78-443b-b6ec-6230ba36524b", "value": "7dd500d4bcb51676ebb9e3bc5d30d29a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ba7c11-1b6c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632291127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291127, "uuid": "5cebd70c-60d6-4755-b1a6-dbfbf1a7f06b", "comment": "Malware payload (Smoke Loader)", "value": "bb984f268476f2015fa56111d4b23572", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291127, "uuid": "983d0645-4c1d-47e7-963e-4b2b896504d4", "comment": "Malware payload (Smoke Loader)", "value": "15ef176bf900ae4df96ffd0a309f20dfa3e38119e778712de3634e6acc2eab4d", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291127, "uuid": "95e5cd4f-43f3-4d05-80bb-f490e6621596", "comment": "Malware payload (Smoke Loader)", "value": "de35c7803d0cc52639f63d0c48eb97bf452504e5", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291127, "uuid": "8c194b74-95a9-4908-a841-139f3f2eced5", "comment": "Malware payload (Smoke Loader)", "value": "05a55ed23d7bb038b5512996c7537984e8b74f46553555f15187d038be9a09bde7a6510d9e42d692092903b4bf373d80", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291127, "uuid": "e74f0b28-88eb-4aae-b4f1-0892e90f3112", "value": "T169647C20BAE0C035F1F712F989B99368A93D79B1AB3490CB62D516EE66347E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291127, "uuid": "ea3075d7-735b-4032-9d44-686ddc2057a3", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291127, "uuid": "214d72af-79de-43f3-b20f-0e71db23acac", "value": "6144:qB6mwjKoIZd5yadxFvltMnRfxX2Y1LVi3kh:hmwjKoIX5vxVMn73wk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291127, "uuid": "52642d61-2a31-43c7-ad02-661c64d97b84", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291127, "uuid": "0a41d203-31f0-4c3a-b664-4de54ba46399", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291127, "uuid": "7a686a43-b95d-4a1a-9694-6d1134d22967", "value": "bb984f268476f2015fa56111d4b23572.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84f0196-1be9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632345171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345171, "uuid": "a68294da-769e-454b-95e4-e900335790e8", "comment": "Malware payload", "value": "89bb1d0b8bced6ac53b1f8fd4f4fecdf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345171, "uuid": "67c73bf1-4747-433e-9b14-2841bd99aee3", "comment": "Malware payload", "value": "161cf65dd3b72fb88256bd92ce6ab00e7d0029083b03be1913ce0f491912ec09", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345171, "uuid": "47440b13-e32b-47de-b97e-4aaa0b12e136", "comment": "Malware payload", "value": "16d99716fcf3a85661575590dd6ea8695b8b523c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345171, "uuid": "0c8049c7-28fd-48a6-8804-f2af9a301f52", "comment": "Malware payload", "value": "9a9016ac6823d3334360e067be5fac649e7bdf7de2250ecaa25cb0fb781fe37b6e94b2e7d81a91d2a0dcc0ef00fdd0bb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632345171, "uuid": "05053ea2-3100-4452-84b6-115da6486e08", "value": "T1E155335F87F873A18746B5F3D11309901F29D2896E0A1D319EA9B383501EC9ED7CAB1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632345171, "uuid": "23d0afdc-bf78-41bd-b482-13e6481c0633", "value": "24576:ogtt67WID++o6zJDq8/r+ECsNFUdeBUHcFJh1TD4mI3Gd/aR7wBFDrZY:ogWKAo6lDn9CTeBUHmJhB4JiaRsBFPZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632345171, "uuid": "6d01c75b-64d8-4487-b3d2-b744e12d4a4f", "value": 1373732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632345171, "uuid": "74678618-7d4e-49ec-8d65-35b6f32b4e61", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632345171, "uuid": "2fa61ef4-d0d0-4273-93a4-582c4a45f010", "value": "\u300a\u6c5f\u897f\u300b\u4e00\u5973\u5b50\u906d\u9047\u201c\u6740\u732a\u76d8\u201d\u9a97\u5c40\u534a\u6708\u8017\u6389700\u591a\u4e07.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2269d7d-1bc9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632331416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331416, "uuid": "3ed6eace-c790-4361-a045-24aec701f511", "comment": "Malware payload (Loki)", "value": "a4906a4f5ece9910c5d49e2cfea35ee3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331416, "uuid": "2aa2f783-6e22-474e-9a22-f155c5208181", "comment": "Malware payload (Loki)", "value": "166fc5432ac8ce1024a26b55bdff22553e972bce7eb0a15b8d7347482e2c93f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331416, "uuid": "2caabda1-3c6c-44dc-a39a-1539c7141245", "comment": "Malware payload (Loki)", "value": "9fc176545c95b406441b55af3e77beba0f53d7ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331416, "uuid": "3dc436f1-c6ee-404c-9a32-59e909ed6fd9", "comment": "Malware payload (Loki)", "value": "bdeb7c437bdd7826078a82be32c480a43862d25d66e9fa5d191608e3d105f688dad5d024d42d3992017cf2b0b36a438c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331416, "uuid": "be3eb634-b718-4e8b-99e3-b13934d36001", "value": "T131F48BC85D894613D7A44276DC5C624A32682C0A3723939BCBE53D773FFE683C22D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331416, "uuid": "ff5107a8-9efa-4210-837b-a53c60cfefe0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331416, "uuid": "1f7b2b8b-0e87-44dd-b44e-a34da9e1b0ee", "value": "12288:PUmtiK5odJBtVWGcDoWur9GLBHIskd8vYiNN9zGYhQk:c+FonBtWErKlkcYMfGYhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632331416, "uuid": "4a8c1ba5-dd59-4f7d-8150-c8070ef6d56f", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632331416, "uuid": "ecd366df-486b-4e22-9f5a-f9d12c5b0e4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331416, "uuid": "5f93c150-081d-4d77-822d-0cd3de7b6d1c", "value": "a4906a4f5ece9910c5d49e2cfea35ee3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8748d61e-1bc5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632329573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329573, "uuid": "b488fb9f-4b02-46f8-be18-dd2c25a15d5e", "comment": "Malware payload (RedLineStealer)", "value": "5a806f938def17c7dc13130bc02255f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329573, "uuid": "67cfea90-9b99-4406-a0fb-34a19233021c", "comment": "Malware payload (RedLineStealer)", "value": "16c3925debeb733f58c941bf756a6c247992dafa4dbfa8f7f1d5337b0f96fdf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329573, "uuid": "3f1d2654-8646-494c-890b-57ef75895f6a", "comment": "Malware payload (RedLineStealer)", "value": "69e7ecc9043b076fa29b1769c3e918bc46d29086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329573, "uuid": "d2e21f1a-483b-46c9-a290-4068792f2b61", "comment": "Malware payload (RedLineStealer)", "value": "247363b8e7ca2ec0823a820a84283ea2750d91a5e14535982b52b71ea4137ad680ac52adb3da08c440ed4f1cc8cbe26b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329573, "uuid": "3af60322-0dcb-46bd-8abb-5408cb81fb3c", "value": "T13C94142864BFC01985E3EEA52DDCA8FBD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329573, "uuid": "5ac5e187-d5f6-4822-b4bf-9d7ee04ab7d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329573, "uuid": "54ddad43-c7c9-4e40-9ee0-ea6324dc0c12", "value": "12288:VklT97iiOr9i5gjh7/SriDzrC78k1MthX5Rf8uOt3himAT7s3K4olg:Yojhea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632329573, "uuid": "a6b10ef6-8d96-4176-bdef-7fd9c463987e", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632329573, "uuid": "2c9b5139-eca3-4418-84c7-94b6b48d7fe5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329573, "uuid": "265e4bb9-f86f-4dac-a5f0-cf84039bf673", "value": "Loader_Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1645d2-1b82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632300647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300647, "uuid": "822338c7-f080-4fee-ba59-30b123ab6194", "comment": "Malware payload (AgentTesla)", "value": "7072a3ba097fae59804f123289ccf4c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300647, "uuid": "47b45a43-2f25-4cae-a525-badeb58012d4", "comment": "Malware payload (AgentTesla)", "value": "16dd2fa5ef070435058d08afeb54457be857cf4e675679c2ff7476e19d85782a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300647, "uuid": "e9e045d8-9945-4d0d-853e-33513f1ffde8", "comment": "Malware payload (AgentTesla)", "value": "e352695b99e7219efba99075ed1bb5b9d15c7976", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300647, "uuid": "9ce7e433-bcd4-44f3-b4b8-7768733b6d1f", "comment": "Malware payload (AgentTesla)", "value": "1270b2dcd3fa1e75fd2a3cdace281ee4c92138e840298c0799d8fbffd6b65a519e7fba4a6e9c919a085f646173a1e25f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300647, "uuid": "3e1366d5-0975-452c-8ead-0164f21ab8a2", "value": "T1FB324401A6BD2F03C0B157F484A317549BB6662D38B1EB6E1CC349D63666F88C661F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300647, "uuid": "62dd0798-946e-4754-8e96-b414494047ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300647, "uuid": "83492e41-5cc2-40e5-8493-08b733bfebe6", "value": "192:dRcmwwy16cvyB8uowDkujdxfuZIbQprpYcoPOBLws3tIJqlCPX7jN3U72rreMTIr:dRkoALws3MXZR5cCvFV7dI0r3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632300647, "uuid": "d070ec62-c7f4-4599-9c7f-1d487ca5532b", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632300647, "uuid": "85440709-4bc8-43d0-999f-a1292c1ac232", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300647, "uuid": "a99f3308-d734-4cec-be59-a51e493ba1a0", "value": "MIKPRON GROUP - MATERIAL-REQUIREMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a2b9a9-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (MassLogger)", "timestamp": 1632316762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316762, "uuid": "0049ce8f-8e4f-4d42-ac3c-c516f1cb9f3d", "comment": "Malware payload (MassLogger)", "value": "d5b9412743deeb656331e24a3a38e986", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316762, "uuid": "85bfbdda-1a4b-4e38-87ca-ab594119ab2a", "comment": "Malware payload (MassLogger)", "value": "177875c756a494872c516000beb6011cec22bd9a73e58ba6b2371dba2ab8c337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316762, "uuid": "38c84611-167c-4e45-8b6b-3439952fbd54", "comment": "Malware payload (MassLogger)", "value": "720f09059a4eb496b2bcf1b2a8b248bdc67e4243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316762, "uuid": "b87a9ade-35f3-4004-a5ad-fedc26c56f77", "comment": "Malware payload (MassLogger)", "value": "7b68be933d44d74338576163ac283298da3577fd964bbcee84b91e7142b479432dea8d7e3767feba7414e57b1fd91ba7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316762, "uuid": "4783fdf7-b902-444a-ae7e-57325f6d85f2", "value": "T117151914F7F855A5F06EBF30747099054A39BE43657DD74A2BA690890F6B3808CB2FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316762, "uuid": "69141c70-2e93-4e5d-8b83-8491fed353f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316762, "uuid": "c5a83c2b-1c06-4acf-b410-861bf76a7b36", "value": "24576:VLcziHVcYBjF3ZLNfBzVHps1LusJLK1lkKoLE:KziHVcYBjF3ZLNfBzVHpsLk1lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316762, "uuid": "930f5723-d38e-4b4b-99e2-3d346a238a9d", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316762, "uuid": "10424015-4c64-4668-bc2c-a2d1fe95c38e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316762, "uuid": "7e48c1b5-c7b3-4d8e-bb6d-6022214f655a", "value": "177875c756a494872c516000beb6011cec22bd9a73e58ba6b2371dba2ab8c337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f9c9ef-1bcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632333684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333684, "uuid": "8a387df9-31d6-470e-a882-462bf7752482", "comment": "Malware payload (AgentTesla)", "value": "9752125619eaeb8479a632a70c2c6c55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333684, "uuid": "ac96789a-45ff-4fd3-88da-80108acc26a6", "comment": "Malware payload (AgentTesla)", "value": "178983958c8a247b4c7cb50afca6b3306447466bdf57113d1ba6b4de29eab6a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333684, "uuid": "c53d0515-fd90-4e7e-8f90-1f83e1e3554c", "comment": "Malware payload (AgentTesla)", "value": "2ba38b3d1ff230e1d5cd494ad3c6168195775270", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333684, "uuid": "62eb92e5-0530-429a-812c-1fd5881f70f9", "comment": "Malware payload (AgentTesla)", "value": "feb08ebadacdfa62d39371ae3b282293226d69a154494c630e986d9372959eebb66c317e46321499121e3221b40273db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333684, "uuid": "a48ecebf-8630-4c72-9973-3f97ea584c7d", "value": "T1EDE48AC49D895613C7A44272DC5D620632691C4A3B23938BCBE13CB73FFE683C62D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333684, "uuid": "305e87f9-dddf-46db-812f-489c784bd676", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333684, "uuid": "65a6adbd-4531-4e1b-b867-2de47fe68040", "value": "12288:IlZmtiK5ormMHcK/GP6BIXQze2cefaZstcdPPk:kZ+ForzHlIdVsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632333684, "uuid": "5efe4c11-98b6-4de1-990a-3779a589d978", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632333684, "uuid": "186fb1c5-c5c0-4ccc-b226-e9a0cc222d69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333684, "uuid": "e64cd605-c0f3-4626-948f-27c60ba82bb7", "value": "9752125619eaeb8479a632a70c2c6c55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fb8f61-1b82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632300657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300657, "uuid": "c0e1bd54-d24d-4461-853c-df6bcee93840", "comment": "Malware payload (SnakeKeylogger)", "value": "db19fb75cfc8ba8ba9601635594bda08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300657, "uuid": "a842b6d6-5b90-48e8-8cbb-142dd46ad77f", "comment": "Malware payload (SnakeKeylogger)", "value": "1833ccd4e1eaabab8e62142df4a24963351c3a29eca19ce3455b5ad004d843a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300657, "uuid": "12c51722-40a7-455c-8106-680271a7cb68", "comment": "Malware payload (SnakeKeylogger)", "value": "5849f9ed44c91573317a2b5b47f62384fec72b75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300657, "uuid": "e7bc8812-f0ad-433d-8d37-64aa4f7551f9", "comment": "Malware payload (SnakeKeylogger)", "value": "90c6657584f9a346479f809b8bde749a772ead56d6e26e6cb9ec170f951bdf72fd669949bd8e80386ee8e2e87e4a008a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300657, "uuid": "2f8add20-42a7-49c0-bc83-6f278b8a2c86", "value": "T17CB423424BA045E3C75B4B395BE1A16AF329CB165040AF0F6BDC1F1FABA70C7A15D6B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300657, "uuid": "3afd5f7d-16ec-40f2-ae2b-60f248bda9ca", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300657, "uuid": "ebaa4225-856f-4583-afb7-5afd7f9783ac", "value": "12288:FTUSUJ+9WZve8zvRKtvHGxOLEbGxjVWvftb7OCsOa:dUkW98ZHGxOQbahWx71S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632300657, "uuid": "afe60347-d142-4e58-812e-ce28b5ae70f9", "value": 529364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632300657, "uuid": "31437e55-c51c-46f7-9347-99cdabf8c3e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300657, "uuid": "a75ce88a-1029-4f03-9492-10e5b90cad45", "value": "db19fb75cfc8ba8ba9601635594bda08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776c419d-1b3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (YoungLotus)", "timestamp": 1632270705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270705, "uuid": "655d0bae-21d6-43de-8332-242e2732155d", "comment": "Malware payload (YoungLotus)", "value": "3bc85a852420f351bb22b006ad59a785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270705, "uuid": "e768c225-a749-44dc-aac5-f1636415b0c7", "comment": "Malware payload (YoungLotus)", "value": "18984d5f98b9d1955336d1838ff42f2837a1f79cd4ed6f407c94aa86274da706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270705, "uuid": "1962c63b-0e3a-48a2-8134-bd075a285b3c", "comment": "Malware payload (YoungLotus)", "value": "bc8c6b4164ca9900218d9b300354e4b06c42567d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270705, "uuid": "df98b3ab-8d67-474f-a68e-2ee0d606c3fb", "comment": "Malware payload (YoungLotus)", "value": "20d1237c2a6418f9754bdce4d0f509475ec838ec78de2bdb57dd817397116a4545fa052707d710a7f52f4735b5b9b499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270705, "uuid": "57bf8c08-e93a-48b3-8c63-17a3012b3e7c", "value": "T1E1956C266ECA8C75D2BA3131141D32BD90AD98B02F7085CB07B4F7A9ED347D15E7B24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270705, "uuid": "2657a01e-49fd-48e2-80fa-3c0f8dfe46a6", "value": "e2afc946bb1a7942e18b4d1a8f444ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270705, "uuid": "af1c05ba-c01d-4b8f-813e-eb41b45e6995", "value": "24576:ofnAFlGkImnJcb23rmQpg1WGM3W82UVpg0MFfRRBH4WuyK5d3i++dJs0spJH:onIAkIqJBqWGu2UfgNRRBYHJi+uJoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632270705, "uuid": "05bd08ef-d277-4f63-8d5a-590476298deb", "value": 1953792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632270705, "uuid": "95687b09-caee-44ff-9ed3-336ee865bcc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270705, "uuid": "e1699fd3-a78f-4c6d-968c-09225065e0e1", "value": "\u201c\u8001\u631d\u91d1\u4e09\u89d2\u7279\u533a\u201d5\u540d\u4e2d\u56fd\u4eba\u8f6e\u5978\u4e00\u540d\u5973\u72d7\u63a8\uff01.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb61ce54-1bc8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632330976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632330976, "uuid": "37e4a092-de7c-42f6-99b1-fed87f1c7b05", "comment": "Malware payload (Quakbot)", "value": "92115a5237c7e2414d2df57ca3c8943e", "object_relation": "md5", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632330976, "uuid": "606f92d7-1dbf-4ff7-bc07-bd3c0a61f26a", "comment": "Malware payload (Quakbot)", "value": "19ae193c8698ca457835e8cae6a4298d73e0ac202daa657933322ac418e9191e", "object_relation": "sha256", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632330976, "uuid": "46bc5c0f-2aa1-497f-b617-7f9b1bf56e2b", "comment": "Malware payload (Quakbot)", "value": "f6ade9ee4730ad2b320ea4c19ebbce1db6d1f3b9", "object_relation": "sha1", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632330976, "uuid": "39b8afee-b462-4353-b6b3-1841cba9f60f", "comment": "Malware payload (Quakbot)", "value": "61c874994e681acfacc9e6e6aee87b43ddd7dddf06a5ee2d2c269fdc5993e4a7a95f253185ec501a024fadc037a81a9e", "object_relation": "sha3-384", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632330976, "uuid": "328801ab-5c7f-43bc-ae05-a98dd538c420", "value": "T11C940248B2A1C917D55A27385FE287A72F77FC156F6B4207762AB31E08B92BC0C0255F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632330976, "uuid": "6a74414a-b8c8-45e3-9a2d-9a6becd78315", "value": "6144:Sk3hOdsylKlgxopeiBNhZF+E+W2kdAQTwapS+jS82DPz6ST4+e3G0SbwduSgcVw7:R5t8etSkuSgcfP8JjZwrcND7fsXo/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632330976, "uuid": "39a7ae23-d701-4652-bf5e-28c322e0e157", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632330976, "uuid": "b452e061-fe9b-4150-8cba-30b3cc9222c9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632330976, "uuid": "ed7de5b5-1dc5-4311-bbd5-a4ccc7a0543c", "value": "Payment-1408525582-09222021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22582fc0-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632289460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289460, "uuid": "8f8da050-97bc-4d97-8e3a-40f055788320", "comment": "Malware payload (SnakeKeylogger)", "value": "3a538b7dcf1baf2d9127e76959749a81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289460, "uuid": "3cba34a5-2e53-4bac-9fa2-1927803597a6", "comment": "Malware payload (SnakeKeylogger)", "value": "1a76e5683118fcb342653898788fb8e643bd71dbd97947fa3dc683841c905d07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289460, "uuid": "8c76d540-b58e-4790-bb2e-f9e83d978d1e", "comment": "Malware payload (SnakeKeylogger)", "value": "847c8bcbd4a36a0825755afcc2bcc7853e515ee2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289460, "uuid": "c4a2f1af-4f4e-4bc2-9100-9f2886537e53", "comment": "Malware payload (SnakeKeylogger)", "value": "cf71c57a04b426091fd3aa5a16760f27bf82cf5ce11e178ab61510363eb98d99a7edb7e6278e8e7b93b50935c2dfde5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289460, "uuid": "c5285c6e-0000-4fd9-a9ea-78865f6a0af1", "value": "T1A7A41238926A1635DE5F9EFD51A044830BB4928F3943E77BEF5AB0486D0B7F24464CB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289460, "uuid": "2e6b9cdd-e337-4aa0-a0d2-923b08f52d80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289460, "uuid": "682d712d-4880-4f66-bcff-141e845c1019", "value": "12288:a1AolmtiK5oBsqVJOsikkpBfPrJ11QzxsgSSNg:wl+FoBsqVJ6HfP1gSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289460, "uuid": "ab483053-56c9-4654-9367-b52b422414cc", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289460, "uuid": "b4954c81-c39d-4809-8061-74f5bb25556f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289460, "uuid": "5ded2414-b1ac-4ddd-a5c5-6b3f672c2a0c", "value": "SWIFT_COPY USD 13420.60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43309f0-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632334400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334400, "uuid": "a0c5dfea-b188-46e3-a81c-fc312bbab220", "comment": "Malware payload (Quakbot)", "value": "a1524b6cfb35364e70fab0c317e49f0d", "object_relation": "md5", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334400, "uuid": "22074bca-205b-4357-81d5-6a30731fc286", "comment": "Malware payload (Quakbot)", "value": "1b1ddb8520b8cd70023535854bfe614f99e001d69b22f5bc6890137262cefb0a", "object_relation": "sha256", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334400, "uuid": "270902ba-b964-4e09-bfaa-4f441e61bbc7", "comment": "Malware payload (Quakbot)", "value": "8e21e7be3f1f784ea846c2aff6091ff9730bb2c9", "object_relation": "sha1", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334400, "uuid": "f49fe5fd-606b-4641-83ae-cc130c024c49", "comment": "Malware payload (Quakbot)", "value": "3c81b80ce113b4eba766f5359b0c371444e1feef1827f19495f06e8fcdf828d08e899a012fb2c0416f6dfb38d856497f", "object_relation": "sha3-384", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334400, "uuid": "983a5050-da37-496a-ba8e-6f8c0eac706b", "value": "T1E7C4AE19BEC3D1A1C83C187488A1C9F27638B865AD54D6473AE93F3F5EB31C25C560AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334400, "uuid": "de9366a0-38aa-410a-96f8-8a287baf6646", "value": "c900f0b45b7574481cc6a21428393566", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334400, "uuid": "d20556e4-9134-487c-8c91-aa4d98da92b4", "value": "12288:Q1ghp5DubQNErdxA+zM5miTrqZj1kENwNmhxOsNU:/wrv05T+ZjHNwKOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334400, "uuid": "9b40ae3b-2214-488f-aa34-2dfe3a35bb27", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334400, "uuid": "3ea52f19-deba-4b6c-b883-d08dd7c9bd69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334400, "uuid": "271fd12e-c38a-4d5b-baf3-5763ba94d6fa", "value": "a1524b6cfb35364e70fab0c317e49f0d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d604b3-1ba5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632315721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315721, "uuid": "b86f6b3c-59e6-41df-a293-d17d6411cb22", "comment": "Malware payload (AgentTesla)", "value": "2aea6536bef3a2c24c770a59b9ee696f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315721, "uuid": "112a951f-04c3-4a61-add8-1f45e473d6cd", "comment": "Malware payload (AgentTesla)", "value": "1c681cf76b6e98ac26dd63ae611b0457a3e5226676bdf8f311d8e040c303874d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315721, "uuid": "bad5278d-efed-4eab-b8ff-f5d3b263683b", "comment": "Malware payload (AgentTesla)", "value": "74d570b378f663f5330b8af4350281222e578b88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315721, "uuid": "82a758cf-1a1d-4dca-a998-773c0f484b61", "comment": "Malware payload (AgentTesla)", "value": "4e4f9b380a6a084ccabfbc7dcb2c283c3479017fdbbe8b94d5c4af21c491496821f72e3ecc27e242cf2ba90091bf3ede", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315721, "uuid": "f5632191-998f-44fc-b0ed-bfee05805b42", "value": "T143E4022C73A0B6AEC923CA37D9641D10AB60F16B670BD307A453619D5D8E6EB8F150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315721, "uuid": "cf03b309-e2fa-4d39-b0e8-6fb564c5c6e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315721, "uuid": "006f564e-01ba-4b79-9fa4-5dbf1defff01", "value": "12288:gZmtiK5oB9f0WNdfZJYGjQyBBBvY+juxzkagaNQIIKdpWOfnU6X:A+FoBaWNdfZO0c+6k3IXLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632315721, "uuid": "00f8b573-d1e8-477b-becf-59c728933180", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632315721, "uuid": "5f15fcdf-4ead-48eb-9fb7-5d3e3243a44d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315721, "uuid": "f25174c8-8a79-4f11-91fb-42e9c37ca065", "value": "2aea6536bef3a2c24c770a59b9ee696f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1f7c23-1b6e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632292351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292351, "uuid": "e5ddc777-a891-4773-aeab-3a688ec1a4cb", "comment": "Malware payload (Formbook)", "value": "5fba600f248106e4a87cc4307776cf77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292351, "uuid": "45e29044-1534-425a-9413-db066eea90d9", "comment": "Malware payload (Formbook)", "value": "1cab3a395f0da98681e97fe13c2d17415d49be182f5eb8719a5f260afbd150b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292351, "uuid": "4c8e0906-7049-48f4-990f-6901c3ec4375", "comment": "Malware payload (Formbook)", "value": "dd609e4ba07407e38b568b29a5d425cf74630ee4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292351, "uuid": "eeb339d7-0f2b-4935-a06f-5aea268ef798", "comment": "Malware payload (Formbook)", "value": "a9b6a79bb171b1b2640e62540b5760167f5b731bfff3a5a5b26164d77e79a3a60fb95b02471effcc0c525c90c75ad1a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292351, "uuid": "6300544d-e6f0-4a5e-9b3e-b677d8bf4486", "value": "T1B9F46B9D325076EFC917C976CAA82C64EA2174BB530BD203A01716ED9E0DA97DF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292351, "uuid": "02072b8f-cc62-4f23-8d99-b45420fcb558", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292351, "uuid": "2312c487-24c1-4082-96f0-9c73327c299a", "value": "12288:OmBxA91Ugj0rQBheLR3PzUuNGgyeaIaOqe48lUvbswRg1C/olrj9o3uEwIepHEwq:O2I0QkLxzUuBymrqeHSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632292351, "uuid": "da4f9345-8eb4-4e85-9a27-c7efb569d406", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632292351, "uuid": "7947201c-ee37-4233-af84-ef37e2f1bba5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292351, "uuid": "3a8d47b4-e53d-4eaa-96ed-1ba33cf72fe6", "value": "5fba600f248106e4a87cc4307776cf77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5707e56-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632316309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316309, "uuid": "4f3b00c1-daac-460a-af9d-43afdc302263", "comment": "Malware payload", "value": "d66c3e2d3b7344088ccc79902b429278", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316309, "uuid": "174d4612-27f8-4478-b354-ef610d52ad07", "comment": "Malware payload", "value": "1d24587481999f46212253ab33f2c4a90823f2765ddd290269c812eff0963c48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316309, "uuid": "a9831527-9510-4dfa-8e0e-d89a582ef1b2", "comment": "Malware payload", "value": "a037caa915dcb492be737c986d375b5d9cd7e14f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316309, "uuid": "e48283f8-3b49-4670-815c-69cc1f66b5b0", "comment": "Malware payload", "value": "52ff5a94375f5ebdcbf6329b898e271cfe0186e2577d6c9a1cf28791d9f5dcbea1b5ff10b1d5dba3cb47fc7423d89bc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316309, "uuid": "159e611a-1f54-4ba3-9fe9-1f7642c5fef2", "value": "T13F061210F744C0B6E46301B17126D7BEAA687FB0126F9887B7D41F587A346E9FA28707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316309, "uuid": "07d99d06-c2d6-4556-99df-11a54579a6a8", "value": "337804e527a143f26af77d8bd177a8c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316309, "uuid": "4c1c287d-f3c6-4bf5-8f87-41b3fa997985", "value": "49152:9IO/kL8FQ2L4nmaEDeedf+ro4daq2xV0rWAH71jLc+9F05yto9tFAzW:2O/HFQ2LAmaUe4gNsq7byii5yt0mW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316309, "uuid": "b5e99f4e-fff0-4783-8a70-43822d6baa76", "value": 3776517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316309, "uuid": "e91f0b92-a311-45e0-a4d4-796b6398caa9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316309, "uuid": "07bf4591-224f-4800-9024-6298bf0b2db7", "value": "1d24587481999f46212253ab33f2c4a90823f2765ddd290269c812eff0963c48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d85ab62-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Troldesh)", "timestamp": 1632316698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316698, "uuid": "0ff7c52b-7bf5-4da7-8dce-3d59dc196e91", "comment": "Malware payload (Troldesh)", "value": "a55b0248a80478410b13f8223efd7ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316698, "uuid": "dc69503a-ce6f-4a36-8435-24a5214edb3e", "comment": "Malware payload (Troldesh)", "value": "1e43c5be3ac264cf5eba9bc4647d2004012e283050924da06d5c1da18255a3b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316698, "uuid": "2c4cb855-af96-4581-81ac-d2df2b262919", "comment": "Malware payload (Troldesh)", "value": "24da9e1762d5a44a74a5abcab8877205f05340f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316698, "uuid": "90693a79-8513-4bbb-946d-ed622c779415", "comment": "Malware payload (Troldesh)", "value": "db9e36af2688da518c888d266bd10d7e3ddce209fc4b8f6364fc9d1fe61cb92a99fd737ae1ccc94874c160390fd21901", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316698, "uuid": "a699afa1-3135-4967-b10e-976a3c6471a3", "value": "T122552352FE984C83F5AEE3BCD8760C1FE5849658630F00D563908BBE2B6A7D195EC8C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316698, "uuid": "9eef8a17-14cc-48f1-9e59-93077970c10a", "value": "1e4af33a455f1bcec8b99573e8fd991f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316698, "uuid": "df1e9012-c875-4fb9-a346-eda1fd89b11d", "value": "24576:8pxExrAZgytP/tqLSuPDVGOohaEklrE4oSG2coNqu8tj1q4:2xE2ZT3orPDgOohuPGuNzi1q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316698, "uuid": "fa9c36aa-a996-447e-99d8-6d2024c8a2e9", "value": 1319117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316698, "uuid": "49254888-ba47-4214-b20e-b696a194a3b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316698, "uuid": "91422b95-b24c-4c96-a78d-273014f7bfe1", "value": "1e43c5be3ac264cf5eba9bc4647d2004012e283050924da06d5c1da18255a3b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4aa11f-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316805, "uuid": "96e8df00-d8fe-48bb-9951-286430f62716", "comment": "Malware payload (Stop)", "value": "180c9123f988275f2dddab0c3febafec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316805, "uuid": "e71d0844-3aae-43ec-ae57-12f3c0846360", "comment": "Malware payload (Stop)", "value": "1e6c55bf6880e72c4d3e13e1e8d350cde8ffe28da1f56e4f9c897e80027e3c0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316805, "uuid": "1df27160-75fe-4032-a496-0b84b56414ee", "comment": "Malware payload (Stop)", "value": "9ef790ca3358d95b6e2ce7b566b3c88950346b34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316805, "uuid": "f8da751c-0b22-4351-9afc-d81872ce0b56", "comment": "Malware payload (Stop)", "value": "ef0a24d905d6d0bb5987f1604004e197509003a8c099d90a36e100ae61f8278f3f194f8cc5ba1e56b6f28d690ffb6d6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316805, "uuid": "c8b7d390-f8b1-4463-b524-7c3183f03267", "value": "T10C05013066A0C039F5BB11F86DB68378B52D7DA2976481CF92D52AED1B346E4EC32353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316805, "uuid": "a5fc2f9a-f199-4b12-b31c-27cb5f395479", "value": "69664ea36ab9a3e93e02fa2b7fdf56ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316805, "uuid": "1c53fa69-9291-4c65-a13b-2da0ad71d59a", "value": "12288:cBjaS55brDDyW2ET/npRt3mMo93qSERGL2SL1/8yq2AuJZ78kplEwGtSzZQpmt:+uwfbvpn3mMS373LR8dK78kp2wGtSz1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316805, "uuid": "e88e317a-b224-4b1f-b244-53c6c733cb13", "value": 801856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316805, "uuid": "9d866a03-1199-479d-9bae-3b94bda45fd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316805, "uuid": "2ce33be7-f3ea-4bd2-89c7-ef5833ca887c", "value": "1e6c55bf6880e72c4d3e13e1e8d350cde8ffe28da1f56e4f9c897e80027e3c0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97159be6-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632289656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289656, "uuid": "8eca948d-3417-4019-b028-5aae5ef97b9f", "comment": "Malware payload", "value": "72587e7cd686d92bee1a860ff59e1b82", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289656, "uuid": "0c608667-2c97-4dfc-98e5-4bae546da4f4", "comment": "Malware payload", "value": "1ece7b39c5963ec9537f92b89bfe39f2b050865988d04b009aae6dd6c4d40081", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289656, "uuid": "a37f123b-4f40-40e3-ac12-f0d8e38c5b09", "comment": "Malware payload", "value": "5ced8d54688577724a554eece7ed77366fca1d72", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289656, "uuid": "4c7f25e3-6ba2-4493-a310-a33cabc1cac9", "comment": "Malware payload", "value": "0344286a6c3558cfd715a66d91874571854290a90c939fe3b88b9ce5afddf3806091cbbf02c760bccea89cc4b83e5fbc", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289656, "uuid": "c8d09025-1822-4af2-8db8-954783e26cde", "value": "T12CD312D258A16B41E9B23ABC37005D6723C0ECD96B30EBCFA43F7AC99039D62525F591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289656, "uuid": "f85dbd1e-0050-4c21-8526-c532ecb29511", "value": "3072:CS1h/2e62Oaz4ljGt/hQ37RAHcTQ/OaH5Q+UwV9OOmZ+aCrMD/6Fm:CSOe5W2K7RAz2+TV9OSO/6Fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289656, "uuid": "a434a602-0cc4-47d4-a63c-fd51a6f0725f", "value": 132488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289656, "uuid": "d16704f8-3be7-47f5-86c4-97078df84b06", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289656, "uuid": "474e9005-9dcd-4621-906c-7ede86b2849a", "value": "OBL_SGN1194474884.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafff475-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632316828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316828, "uuid": "80dae042-0ae8-4436-90c7-7d9dc3750357", "comment": "Malware payload (AgentTesla)", "value": "906be35e7ba8ebb678db982e531e5a19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316828, "uuid": "6e0b1beb-6058-4179-90c9-3bf70ad3b4cf", "comment": "Malware payload (AgentTesla)", "value": "20f09a52fe64148515141a312791701a1251b91c0afd2b8ff9de17e5a7485684", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316828, "uuid": "56ce9e64-a908-4fcb-9390-fbf5e70f6092", "comment": "Malware payload (AgentTesla)", "value": "113b99d05dadf0eee80cfc200df3407dfa299d49", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316828, "uuid": "e789b108-4983-44bf-9a38-2fa7d9b90666", "comment": "Malware payload (AgentTesla)", "value": "182b2c268254d5297f23f4694cbfbcfd8d389bd202fa96c71459e64ceaafcc1f5c8147516d0152d3cab2c497c808aae1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316828, "uuid": "8ef97ab1-970b-4562-b631-c3d9d73feaa8", "value": "T126C42338C3A99635DB2A977E302745060B70B3CE3913F65ADE8BF0CE6D8B7944016976", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316828, "uuid": "b59988dd-c8a4-4b26-850c-50106abe5301", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316828, "uuid": "cbcd1096-0b9d-46c3-9d14-1fe233fb3db3", "value": "12288:m8wmrmtiK5oBUoVGknCGLZ5DkIyRA9IdmpwWw//Aj6qDl:Br+FoBUoznrZ5DkIyRA9IItwXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316828, "uuid": "41079da9-2fd6-42c0-bd5c-eb0682419029", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316828, "uuid": "12672719-85c2-4c39-b357-b8a8940e5fe7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316828, "uuid": "5cf39f40-754d-4fcb-9715-0cb31c5df374", "value": "ZAOI984543.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aee2d81-1b51-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1632279677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632279677, "uuid": "450bcbf1-b228-4095-acff-a54d65ad4ce8", "comment": "Malware payload (STRRAT)", "value": "ebc52b93712aefa18f2753e89dc0423c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632279677, "uuid": "591055a5-c8ec-4992-9cc3-f1a93deb684c", "comment": "Malware payload (STRRAT)", "value": "213c775b371b55c48308650f29ad041a889ef24bf58069d380b4be6e558b82e9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632279677, "uuid": "0b43d4e5-df51-4afd-aab3-b5e1c6fe5e3b", "comment": "Malware payload (STRRAT)", "value": "7d8780d7c0f7e8cc68592934c9bad41a2dd96534", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632279677, "uuid": "df9f1b9f-4f60-4424-8bd3-8fd6c9f3241d", "comment": "Malware payload (STRRAT)", "value": "acf3399c92502d72c7499afcbbed589fb547b7b8c0f0d174632720b14162cb8db63ae1b55db3e0568a4647dc975c28e0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632279677, "uuid": "1bb49fbc-ffc4-40b5-a5c1-6b7d799c5378", "value": "T1B314BE138BC0FB84CE59751584290E0F7ED9420F190934C5BAAE58DCABA335DB1FE5EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632279677, "uuid": "9689017d-156a-4a4b-a9ae-d2d530563b72", "value": "3072:GepytWFteGuSs8j4DjBB8ZwobiGGEx8xbmvKRi8Gmko/yv/Q5OoEQ2/EIMRVvGku:GepytWFt6f8jkB8Zwop1x1v4nGrmyv9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632279677, "uuid": "d057fb8a-dd3b-4b60-b490-30655add47ba", "value": 192180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632279677, "uuid": "bf3d56dd-fe51-4cb9-aa04-8cb3ea363975", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632279677, "uuid": "a15f2477-8a12-471b-ab2b-3b72e463cbc1", "value": "INVOICE AND BANK DETAILS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d289fa0e-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632334424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334424, "uuid": "b8965538-a996-4457-9fd3-063093184f77", "comment": "Malware payload", "value": "80d4827e62475077ee1a0a69086544c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334424, "uuid": "0ab86b95-55f5-4567-b477-c28e64e5339f", "comment": "Malware payload", "value": "21548418c3ec21891adfc5d31cfd4ece08d11b5429aacfbb67ee028e94389155", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334424, "uuid": "b7e2ef9f-3666-4ef0-81fc-63a5d0d82825", "comment": "Malware payload", "value": "7849f4fb610c831b5934706a2845f5a30f44492a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334424, "uuid": "c2257cbc-3904-48ea-8c57-bf36e26cc37a", "comment": "Malware payload", "value": "a2e7001ce3ec73ee73d2b90bad7965e23724b4fd0c556718c9631697aac3e499f2cd240d53c26613ca1a3a520b701f47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334424, "uuid": "b9c33bd6-4623-4d40-8576-51827ee3fe62", "value": "T1C4D3A267402194A6C9BD1734E8690F0B7E6CDE280941B6DCE04EB2FADD7CA4D8EF4365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334424, "uuid": "7e541950-4840-46d2-b835-1cbf908ff170", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334424, "uuid": "42fedb17-07e2-498f-bd7a-e0768c2bc539", "value": "1536:iUZBkp+dzQfobI0FY+kNBE3u5xyex6oN:JSkQEIo+xxye0oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334424, "uuid": "bdb5c5a2-d42d-4685-9873-35192aec1c7f", "value": 138240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334424, "uuid": "f6e0cbbe-686d-4347-9d16-6bd16499a66f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334424, "uuid": "3f7e79bc-29e9-4701-bbff-633ce7b4f175", "value": "80d4827e62475077ee1a0a69086544c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e7219d-1bff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632354426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354426, "uuid": "fee144ef-9f15-4db6-b384-c0c5d19355c5", "comment": "Malware payload (Mirai)", "value": "e9462fc2f9a8dac38f39d26692e92a5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354426, "uuid": "fcac2bb6-8f7a-4230-8153-afba636f78c4", "comment": "Malware payload (Mirai)", "value": "2175dd50c29c4c357269b361eb1c2366c7dd408e28a910dd755bcf98ab3dab26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354426, "uuid": "913bae9b-1eb1-45f1-aa32-24df64656e08", "comment": "Malware payload (Mirai)", "value": "8465dbc55884419e604eb938c697249f894022d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354426, "uuid": "5383ee61-4f41-4dd3-a4a6-fce595dbf6f2", "comment": "Malware payload (Mirai)", "value": "9116bcd30e82796b542937fececfc5955f1355582a8d0efe666e9d0248067cd8ae4804058c8fd3bf36731842cd7304e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354426, "uuid": "5b1d28a6-bb04-4f81-bc9b-bdfa97273cd5", "value": "T194433A02722C0A47E5961EB4393F1BD193BFE98020F4F584694FAB4A4275E372586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354426, "uuid": "53ccae64-1e90-47d9-a5e8-940a9f4a5fc0", "value": "1536:EAyte19QO0+lQNMgNrzTamziLWNIUFKmUzw:YHO0u7gNTamz5NIU6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632354426, "uuid": "5ba28f4d-a2af-4306-95e7-fc51b67ff4b3", "value": 58456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632354426, "uuid": "92afb60f-9748-4683-9cdf-ba3ca05e6a8e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354426, "uuid": "d7f3f162-990d-47d0-9e71-a43fa001bd4f", "value": "e9462fc2f9a8dac38f39d26692e92a5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed82677-1b9c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632312003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312003, "uuid": "2ed7fcc5-1a21-450a-80fd-ff4c0ca43c27", "comment": "Malware payload (AgentTesla)", "value": "5698e96ffcc5607c78e5708bac591ef2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312003, "uuid": "8ee69c71-392a-4cbc-8d91-3e3504a54c3e", "comment": "Malware payload (AgentTesla)", "value": "23d268075dfda982951085f1cc40e7c771ea91432f25a021341d481461b38f8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312003, "uuid": "978d6de6-4485-4b52-9e86-6aa7b112b362", "comment": "Malware payload (AgentTesla)", "value": "561d11dede19bc4be7e73c61e0346e6aad2551c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312003, "uuid": "65524cda-5fc7-4723-bb36-cfe63d0b1609", "comment": "Malware payload (AgentTesla)", "value": "59d0b2423853d103f124f99ffe9d7c4232f84029d5622306bce09a17faa5b9e3260f03e4cc42e82ce033ba9d42983f64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312003, "uuid": "62947d4b-4cc3-4896-9640-2f8b9dd65d00", "value": "T12D3231ACD05702E88F88ABB4672B5F49118D7A6EF7449933367C57352BE2DBA400387C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312003, "uuid": "f8ecc566-8818-4306-b1e7-a96b7f439ee4", "value": "192:4gzyXs5GOfl5Q5GZhHpIIWSjFCNnS5R/OXvdxknSiUZ9+Q9NwfUUhp3ktLw7C:4xhOfoU/KIWSj8dSfEvdxkShZ9Fs9ktd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312003, "uuid": "a9b8c416-cffa-4b12-b94d-7870d81b8b48", "value": 11095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312003, "uuid": "51110ac4-df92-48c3-9a75-c245d36d0138", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312003, "uuid": "352b94db-f3d6-4ba1-a88f-e966b4bf4ed5", "value": "DHLAWB29721.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b2510a-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316796, "uuid": "9e149291-4686-4eba-80b1-735780521f8f", "comment": "Malware payload (Stop)", "value": "7bf350b51060d91b753c82f9dd2105e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316796, "uuid": "7472251c-8251-4061-a482-d5fb8cedf81e", "comment": "Malware payload (Stop)", "value": "24e01f6ef65d42467608a1db86f06cdbeb114ba6b6da744d5133c7d933adaaad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316796, "uuid": "d9b3ea3c-5ad7-414e-9697-449e0c6073a2", "comment": "Malware payload (Stop)", "value": "8f2e2c6b0b3eccea09dd5035282a4615e4278f5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316796, "uuid": "837915d5-7ca5-4330-80c0-0e6b91a4ad8d", "comment": "Malware payload (Stop)", "value": "ec45df9f313858a10430436d764c5fa03d7ff7d75034ed697b5683af2d1c405299de73a67f5ed2b29a643460a9078dd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316796, "uuid": "04dbedb6-1273-4c88-a3c2-571222f73e54", "value": "T10B05F120A6B0C036ECB716F4597943A8AD3E3DB15B24D1CB52C5A7EAE6306E4BD31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316796, "uuid": "fba40981-4c43-4082-93f2-f2982acffd8a", "value": "3a5e62b58b4a57118c6dbb55f27570fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316796, "uuid": "fc7600df-a248-46d1-bee6-df0096b5acb2", "value": "24576:35CL1Lo+HHIlu1TstMiPDjlomXNj4Oi04:+Nol6stMoDjlXXS304", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316796, "uuid": "11cbf9d9-f741-4fc2-979e-e06d9c33ade6", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316796, "uuid": "d7a090b1-0c13-4d46-b192-85421d4c9b91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316796, "uuid": "643d739e-a6a3-4b74-b638-1d9b851e07fb", "value": "24e01f6ef65d42467608a1db86f06cdbeb114ba6b6da744d5133c7d933adaaad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdff3ae3-1baf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632320216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320216, "uuid": "c7cc8426-cb71-457c-9bcc-3edb66ce5c8d", "comment": "Malware payload (AgentTesla)", "value": "6ff3e53ec4c03f1618df96ec9fb5fc3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320216, "uuid": "7e14d874-4f1b-4984-843f-09c504b99665", "comment": "Malware payload (AgentTesla)", "value": "253d6ceb0811099d6063244ad1f839fd987c527edc042bc4c2f9e245b40de5a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320216, "uuid": "604bf91a-61eb-4807-b0a0-6b877372e940", "comment": "Malware payload (AgentTesla)", "value": "625bb814c68082f7cf96941303fab83fe3d52d1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320216, "uuid": "af374de5-1413-4b01-be10-bb9cedf6e746", "comment": "Malware payload (AgentTesla)", "value": "1a57591519476a34693a1566859dbbe64535172f67ed9f926318dc232ba34814d51518ae14cef8bcc4d65c9cd4a566f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320216, "uuid": "12f6e812-de3b-4b7e-a205-157af016626b", "value": "T1FA0548394D2682F747EEC66CD08C1BCEDEA6A4837B919F1AC496D7D2025B70FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320216, "uuid": "091daf97-0ebb-48ec-8bf1-73c379838aae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320216, "uuid": "6e42b800-18ac-485b-9edf-6600ae1fa420", "value": "6144:v9URcn4tTQgQ11eCSQSO6JVqWObixD5FqE2tYu2/V0rphZ7I0v+8e5pTDu0:v92t0gQ1QhQSFq7REGYj/VgI8+8qpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632320216, "uuid": "0f55174b-fd78-4985-8d41-d76bee4da231", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632320216, "uuid": "aa847ea1-6705-4543-9236-a38f73c7c190", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320216, "uuid": "18cf388e-4f98-4d1d-8cce-65970ee83ac8", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db192456-1b9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632312963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312963, "uuid": "b7f05c2b-c9d9-4554-b667-b8be643071e9", "comment": "Malware payload (AgentTesla)", "value": "653a9282fc584082addf3c40bfe55df0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312963, "uuid": "2a5b9e19-c569-435e-9dee-955970f14bea", "comment": "Malware payload (AgentTesla)", "value": "25637cc97a6bef02861ea219ebce72e3a3d51b7ddb4bfd48014c0ea6dc14e52e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312963, "uuid": "d3322b93-0dd0-4756-92c8-a38911535604", "comment": "Malware payload (AgentTesla)", "value": "8cb0838a15a0b61a56656f769bba715679f4b641", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312963, "uuid": "9613d16e-c9ee-4819-b427-14a270fee550", "comment": "Malware payload (AgentTesla)", "value": "355e38776befe12733b5afd1dccaa2c45907e10db2e5285d1499406765fbb7e4efd9039db8f2072060138edc6f6a9de0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312963, "uuid": "d4f24702-a9bf-4ad1-bb6c-9bcfe1cb32ee", "value": "T1F955333BAF482378C6688BBE61B218C84775E1D57543F7A96B4D70CE2C8E385D0988F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312963, "uuid": "fd6f7261-1c96-438d-b2a4-a5ea7858d0b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312963, "uuid": "6be91917-076c-4167-9c69-274736d3ca7b", "value": "24576:kf+FoB4VsWQrgQuRsiq6B5IT6919tLUExwN/YFvaNCLxczpUTayg0In:kf6o8zQMQuRsB6B5I2919eOwivaNCLxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312963, "uuid": "7a80968e-08f0-4a4a-9bad-86c2511a76e4", "value": 1362432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312963, "uuid": "7b96b29d-b4aa-4803-a3e8-504be964de9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312963, "uuid": "f4779a83-c1c7-4ec3-b290-f794999a9e9f", "value": "TransportLabel_4957786341.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e92540-1bba-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632324687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324687, "uuid": "523b80b3-6705-45eb-812c-fdb57000c3fc", "comment": "Malware payload (Loki)", "value": "e50df54836bd38c86239e7f49917cb1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324687, "uuid": "d6006888-badf-4277-ad1e-72f499b3070d", "comment": "Malware payload (Loki)", "value": "25ff1ca479a76808bc6375b28d9c0905aece5d31a98f27ef39afdfafa060996a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324687, "uuid": "6bdd76c9-2bda-4803-ae7a-603c34cc81f2", "comment": "Malware payload (Loki)", "value": "d238087ff8824d8ead4715e0fac7416f418009f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324687, "uuid": "a26d14a6-3a06-4df3-9134-6123e11560ad", "comment": "Malware payload (Loki)", "value": "9a3f14efa5af995d9e1fc64c2196841d76f4c8f45899b88eb207b6167bd1bb8fbba8d10c9ed540940b28ceb1d36419fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324687, "uuid": "414891a1-b2a6-47c4-a1c1-7853caa65988", "value": "T17324CF1138A0C832C696353179B3C7BC567EB8F2DA7D924B37983BAE6E312D15635306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324687, "uuid": "eb1e06d9-ad18-42d1-8f2c-fe2cb42f5c9b", "value": "410705447b2186b51cd6d6e90a878e3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324687, "uuid": "07b3ff52-79f0-4cd0-97da-abcddc029403", "value": "3072:OokgnLIbp7Xh1THa2ok6bhL1cIGo54IVLSQEOJH4yhJuIJB:LkgnLm7R1T62hqhL1pMIz5JHHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632324687, "uuid": "36964631-a65f-4c1e-81c2-4c78660bc816", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632324687, "uuid": "65eb56cf-e1b4-4e96-be93-3db08ce4e696", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324687, "uuid": "2d1ae764-9f74-4c12-9b91-cc49077fb5f4", "value": "e50df54836bd38c86239e7f49917cb1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b23937-1bcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632333951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333951, "uuid": "ff5d3b22-4d08-4439-97da-7ee1dfcbeeea", "comment": "Malware payload", "value": "8271195920c77f921f94a39b31816d13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333951, "uuid": "a56e6a00-9df2-4f64-a459-b91d22c8779b", "comment": "Malware payload", "value": "265c76c28fff50aa2768ed58d0117e4186c44ace29559856012a8cf434ea843f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333951, "uuid": "04d16f16-5b20-4b1f-882f-527135223e7e", "comment": "Malware payload", "value": "e0d7ac52a720fdebcfc4b68bee634776c612d397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333951, "uuid": "59e593ca-0797-4100-a611-1b7463c204f2", "comment": "Malware payload", "value": "a4ec59b912372a639fff6f27a4ced5511ceceada4ca64141f7de12f09ca0313e39f6716cf567b8d0466c8b9a4870f585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333951, "uuid": "b28a676b-86a8-44de-8bfd-66c6bdff030c", "value": "T1A0E35C7AF4C1C837D3A31A78CC4E9078D4757A912E1A648A7AFD1E488B3E3C176991C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333951, "uuid": "a2d7fdad-c80c-4939-8af6-2cb6233109fb", "value": "3072:2ZaXSesza3CpXTW1uajp04gdHbXCTD/RRqREYUZWMHsg82xhFxrR4:2cXS5aWD0urbTBQsgdhFVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632333951, "uuid": "38b715bf-0ab8-49fb-b7b2-0019a8656f80", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632333951, "uuid": "9cfdc648-7615-454f-ba69-57a95132e3af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333951, "uuid": "caa1175b-a5fe-469b-8c1a-3a53f55d9068", "value": "8271195920c77f921f94a39b31816d13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada433eb-1b82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632300861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300861, "uuid": "e9041e5f-9746-478d-afc8-3a415fe60a31", "comment": "Malware payload (AgentTesla)", "value": "9929a6f9746cc5f48abfc83bb9ad9ec0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300861, "uuid": "990ae680-9800-4ac3-a4c8-03b1c881859f", "comment": "Malware payload (AgentTesla)", "value": "26a9e5f1b291b69302eeea49335c44c3eb8ff880bbff48eac3f878c800c4bfcc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300861, "uuid": "3a61df4f-f597-4e16-aef0-00c7255e86e7", "comment": "Malware payload (AgentTesla)", "value": "c1337d9c464a49c8ca5a0f35496b4e033ce2a6bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300861, "uuid": "e0078575-0ef9-462f-a7fe-e9b606f75a60", "comment": "Malware payload (AgentTesla)", "value": "23021b6bfbb8ec7cf84075a32d99023513571ec4d47acc452991d95132af0ced71d04b7ae7bfc1fc535a7b061a40f67c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300861, "uuid": "621c3e82-bd24-4693-a51c-70b2ae9e8a97", "value": "T12B35DDF0A143AE9ACA1D69B0033D3DE9F476985B9A3EC75BDA91006078170F9ED7D183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300861, "uuid": "78924b72-5c0e-4926-818c-45533e80457f", "value": "12288:xJW3JcUcf3k9nNjbRIvpkpR+qf1s0vvrkxcP5BH:HWZBcMdNmRu1XvvrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632300861, "uuid": "5d142354-bff5-4d69-a667-03088f5f4503", "value": 1132403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632300861, "uuid": "b7542261-19b4-4c77-a2b8-261d97c66430", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300861, "uuid": "05662fd3-7ffb-48c7-964e-42bb9a1fd11b", "value": "order comfirmation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174604dd-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632312205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312205, "uuid": "71f941ad-47da-43cf-a87e-c5861a7682cd", "comment": "Malware payload (GuLoader)", "value": "adae6549fcd4c307f5418d8b10e2813d", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312205, "uuid": "d4b2de8d-71f8-4e09-b2bb-aa2dcaa4b995", "comment": "Malware payload (GuLoader)", "value": "2771001533219c30ec24046a9fba6c67a665c9c48f01947e2040c65318b83f7e", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312205, "uuid": "7de4923e-66a8-4e11-b807-b24423bed10e", "comment": "Malware payload (GuLoader)", "value": "ee2935738a63aa18e9551fde071dd90c3b4a3bc2", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312205, "uuid": "e06b56ef-aed1-42fc-a9aa-1fc5bbb83944", "comment": "Malware payload (GuLoader)", "value": "56c8fd3ed2bce349bca956d1524c35653cfbf37c5e5b535241b2e52993ca66bd7702a83e0e6033ebdb50c911149fc58e", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312205, "uuid": "4264a3f5-4422-4b62-b37d-4e8eb79f1df5", "value": "T18E935AB16DDFDEA7E0FC6570D2BAE9F07210AD00F40B8A272C513EDA3A74F409596264", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312205, "uuid": "bc9da684-f46b-4fda-9b6d-be920b165325", "value": "4b82967fdfc14d4519122dc367d279d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312205, "uuid": "7295d76b-6afc-49f2-ad27-a370e4b9e0bc", "value": "1536:ZHFSlb2r5Q7wRM6ZjvHrTAjbhoKx/vQoW/:Vclb2r+U+IjfrAbhoKx/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312205, "uuid": "b9576fd0-2626-44ad-8ae3-4508a4076541", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312205, "uuid": "655cf1b1-662b-484b-b5ff-353a86767720", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312205, "uuid": "afc739d5-b3ba-467a-931f-c0ebf5675c2a", "value": "CONSTRUCCIONES Y SERVICIOS VAZQUESUR (OFERTA 222109).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5022ea-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632289502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289502, "uuid": "5bb94802-ef58-49dd-a537-6b36afe91a87", "comment": "Malware payload (SnakeKeylogger)", "value": "a33e2ebe821c25114b150a9b4fa3c513", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289502, "uuid": "4e1142bf-af5c-4ba4-8c25-df8239cc4c8b", "comment": "Malware payload (SnakeKeylogger)", "value": "277c627a3fa40c8ba4a2eb49f7ef49ab60ce782e5ff3394d6721a93505ad70ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289502, "uuid": "9024d317-a051-479c-bfdf-65ea134dbb0a", "comment": "Malware payload (SnakeKeylogger)", "value": "1f38d616aa86bbeda6f42ea9277434e02ff51efd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289502, "uuid": "bbacb87a-9aeb-4cf8-91e4-7268263fa287", "comment": "Malware payload (SnakeKeylogger)", "value": "dc6d5c11e753c10bc9ea6102cd00e50aafe5dfb95c4618a6e7bbc8115d2b8ff9a3271e476cf06b6fa2f1966f40f87a6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289502, "uuid": "d6fa9299-d651-4bab-80dc-da96ae7272b3", "value": "T12754E01675ED33E2D4AA0FF89D65B2001738BEA15807EF6A4E8070CD4976B0166B2F5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289502, "uuid": "f96e0fd9-2a65-4174-b857-341bf61120cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289502, "uuid": "d43e71fe-0bee-4246-9635-fb2700e3cdc2", "value": "6144:zttvJ/xapA7MSMSWroKxOGxoJ5OJgi0JpfVvfKfxnA:z3FxkDSMSW65OJgi0D9vfKfBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289502, "uuid": "08553fe8-ffec-4d69-8a0e-2d2483792a05", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289502, "uuid": "dec564b5-6652-4b26-b3da-47636de6396b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289502, "uuid": "de8fff3f-b973-41b1-a01d-1b67cf813cb2", "value": "OrderList.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689575ac-1be8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344554, "uuid": "f1fec561-2177-4300-9c74-2266b50d4196", "comment": "Malware payload", "value": "49012ef2364f367049054922e6455ec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344554, "uuid": "58c974f7-bf88-400d-b7f1-cee875e5e6d6", "comment": "Malware payload", "value": "27c6a0334d8c8e806e37654e4180151050cd9b2ab70a8c98c2885c2aedfae400", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344554, "uuid": "d6ee0693-7cd6-4372-a083-18b90f1e0d5a", "comment": "Malware payload", "value": "4be45bf2b4254b6cf3b3f73285116f8d027f8b09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344554, "uuid": "5e728f8c-ccd1-45d5-8f49-f22d4a8f5f9c", "comment": "Malware payload", "value": "9cb62dc2d9c20f159244fd2b94c4bd57294f3dfa541fcf61bb632962bc454018a8f232a56e9b462c80f13dd1da2a4646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344554, "uuid": "22ed1731-e5de-492a-9e29-d837e8b98e6d", "value": "T18F658C182BAB4666DB653778C8B592945A191F431F68C4B51E310E0EBD2321FFC23EBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344554, "uuid": "b3289dc8-0957-4469-88f6-9fb52063c4c9", "value": "4f7f1cc1c101a4009af15b3f7e9dcfb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344554, "uuid": "6ef28a62-3493-4f10-b12c-9ac62205e8e6", "value": "24576:SZ1wuTLj2gl5ClxJWx6Utzc0r/ggXGuB+LvL2heZP:Q152g+xU9c00g2g+vU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344554, "uuid": "965c8b80-9ecd-41bb-b878-e548cae3c346", "value": 1413120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344554, "uuid": "a53b724e-2d19-458d-a4ce-9ab478934dd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344554, "uuid": "074beb06-f4db-4d6f-b052-3b8edc5cbbb9", "value": "\u9488\u5bf9\u57ab\u4ed8\u517c\u804c\u5f00\u5355\u5341\u4e2a\u79d8\u8bc0.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf3b6e9-1bd2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632335058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632335058, "uuid": "50b8db00-c95f-4f9a-8b3d-c2bb0b1702e7", "comment": "Malware payload (Dridex)", "value": "142b680a0540f3664068c3157c999faa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632335058, "uuid": "c5909f88-83bc-47c1-8510-7fd3752516c8", "comment": "Malware payload (Dridex)", "value": "28222c906d904e9de74b325d5a3fe60d24ffaec03362e0fe904fc49c37ecb434", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632335058, "uuid": "8e56c5cf-14a7-4fb4-95e2-92d9e9956149", "comment": "Malware payload (Dridex)", "value": "c7c12af02f63b79baafd5a1bdd3bf374eeacb60e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632335058, "uuid": "53e4804f-a24e-430b-9989-0e7461045593", "comment": "Malware payload (Dridex)", "value": "3393c359ab3c65ef10fb4a02ea4587e0109d83059134929d350f430ba6c583ed341f0447b8fe97c20fd39d1086555b62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632335058, "uuid": "14908e68-0bac-4b8b-9002-4a5ce28a2dcc", "value": "T11514DF13A6B931D3E19B383F92A1E7B16E386F43C338C45BD6D4F46899312A354A5332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632335058, "uuid": "dd2f80c4-1500-41cf-8ccd-5c0b225e4081", "value": "bc9115da123ae49443de76ad96ad8e1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632335058, "uuid": "64897cb8-dd8d-425b-bd8d-1690bcc58fe6", "value": "3072:Cwd4sevPYabz9RLhPO8f3zRCyvD6meTuxn2ZjflxomQYIE5IbiK/n1:zsvQabz9C21Pmb82xnwiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632335058, "uuid": "7e954b53-d432-4fa3-b937-b3fa0b64bb8d", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632335058, "uuid": "ce9d755f-d739-499d-a4fb-4ac232a6da9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632335058, "uuid": "c6fb4724-3a25-4762-a1f5-b32d36958d56", "value": "142b680a0540f3664068c3157c999faa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13074cbf-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632316493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316493, "uuid": "c8e879a9-4d0f-463d-ac05-1e089fc89c1d", "comment": "Malware payload (Gafgyt)", "value": "ef698bdd2d0aa2fa28b0c2e9bf144749", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316493, "uuid": "6ba40e48-d096-483e-8a4a-d67dc3bd4be8", "comment": "Malware payload (Gafgyt)", "value": "28a9d69ed124d4174c88ebc3f7a1d214c928f85d47bd13596439e64f4ebe3d32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316493, "uuid": "6dd12fcc-0f36-4060-ba8d-7fef05418dbb", "comment": "Malware payload (Gafgyt)", "value": "4d3bf8aac73cbe942cbf7f25e74afe3bfaed5da3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316493, "uuid": "a54d7336-0f4e-4ff3-87e8-048508d601a5", "comment": "Malware payload (Gafgyt)", "value": "7967a7d1703ac26047a6bf7bab213739a4d3c256def88605cce104b0284f44df2de83150c3e61a179851ceb336b8dc55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316493, "uuid": "9b1db505-f6cf-4126-969c-31a4c55eac9f", "value": "T1A5C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316493, "uuid": "dca6c76f-660e-4596-99ca-4691ed38f90f", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBe+EdWfRZrmW+IFj:Ted0W0MZQHMd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316493, "uuid": "73dbe2e6-bc6b-4f76-8c36-4556b5c3c0cf", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316493, "uuid": "f9a1e04f-053b-4374-9337-60b1fd764970", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316493, "uuid": "7c0ae340-b00b-43d7-8491-4366a1e8ac9a", "value": "ef698bdd2d0aa2fa28b0c2e9bf144749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281fbaaa-1bb8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632323830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323830, "uuid": "9d9fd648-9503-4575-bf44-51c754ec1326", "comment": "Malware payload (AgentTesla)", "value": "4f993a8587d85eb0fef151e6bcaf3e00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323830, "uuid": "10d295aa-543a-4df3-bc41-cc49c709dbe8", "comment": "Malware payload (AgentTesla)", "value": "29b5f130d45482fe5566c41540580843bc2d541e389da24b1526ba9e85abe17a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323830, "uuid": "bf5b7382-3906-4ada-81ff-c50594420b99", "comment": "Malware payload (AgentTesla)", "value": "7a38302db47168c23b6533b24cc973d19fd0ca01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323830, "uuid": "b300114e-a5ef-4b85-b03e-8df5b05200fe", "comment": "Malware payload (AgentTesla)", "value": "0ce2b07511f6595efce828c1eacdbedf7cc2321628808426020ae19ff6f507baccedc4b6021470b5c12ab42abe4731ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632323830, "uuid": "45f899c2-00b8-4e1a-8c7b-3feb1fba5ec7", "value": "T1880516394D2682F747EEC66CD08C1BCEEEA6A4837B915F1AC496D7D2025B70FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632323830, "uuid": "416456d9-8e93-497f-b051-a8d592585fb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632323830, "uuid": "c51615a2-189a-481c-8583-c4b793101f87", "value": "6144:Xsc4ENP89VGHqfiJDWxTrFWpal+z3kE3x+7/KX8/T2h9+Rs+qQoCs0YxIeCjVsGT:Xz0VGHqa0xRWA6p3UeWqpCmaeCGG0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632323830, "uuid": "756dff6c-4e51-4677-872a-d46344e88b41", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632323830, "uuid": "3002a829-291e-4980-aaef-89c1f0730a1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632323830, "uuid": "29eea7f2-b562-4ae9-968d-8b77b1dbe61c", "value": "doc0009875323456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b16b2fb-1be7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632344155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344155, "uuid": "b4b078f3-960c-4b09-b9a6-1cb780926e69", "comment": "Malware payload (Stop)", "value": "6a54a8d628e9550d1e23df85301b6be5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344155, "uuid": "2a8d30e2-018b-44f7-89b7-01d97ea7d7ed", "comment": "Malware payload (Stop)", "value": "29d0aa9684c47ac2f631f1929f6dc271fb7ddc6f0a3d31396aa1709ea00c9937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344155, "uuid": "74b652fb-ad03-42f2-a49c-2c1ca4627995", "comment": "Malware payload (Stop)", "value": "562933fc7be8aeafc38a6921513ec39b0f02e697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344155, "uuid": "8871b76e-7105-4ede-8aad-e5839c9f2db5", "comment": "Malware payload (Stop)", "value": "3aeedf2d345dd420274e3b8395e315956d73e3f4d31983b55588555a9376cd9b620e39c0f95b3981a2af75f13ed4d8a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344155, "uuid": "22af50c1-d0c3-47ed-af7b-9d42ee509c4a", "value": "T1F9050211ABE0C034F2F322B509F9A6A5B53E7EB2677495CB92D166EB16B06D0DC30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344155, "uuid": "4639fb58-dce6-49da-81ca-f511cbbf990d", "value": "077da89a12148c6ee034067c75e2bb0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344155, "uuid": "3c83a09d-6185-4408-ade4-aba13389bd3a", "value": "12288:8phd54k4bWCSeto8kffH8FpL0BWfzAajngEv+hmLXLk5sTQBEVNaMUHPOJL:Wqk4bQPsFCun95Y52WDPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344155, "uuid": "70ab52a6-1b02-4c32-b18a-2879eb7b4805", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344155, "uuid": "35eecdeb-a2c5-4bda-b484-0be0dcf697f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344155, "uuid": "0e0e93e8-ab5d-4250-bfd7-4d0b680ff46b", "value": "6a54a8d628e9550d1e23df85301b6be5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e23410-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632316228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316228, "uuid": "64defa96-6f66-42fc-8053-757830d78701", "comment": "Malware payload (Mirai)", "value": "1b639dfe80947976da2043c6bcd79f7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316228, "uuid": "79295f39-5167-499f-bdd1-47148f6ca5af", "comment": "Malware payload (Mirai)", "value": "2a242f245a0321c1de14962da17d37b5ddca273edfc52be09285191d37364765", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316228, "uuid": "4a39a5b1-e561-4c5e-92e4-32db647884b5", "comment": "Malware payload (Mirai)", "value": "2d1bb914791bbb7ff03d2b7bd866b4d3428d73e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316228, "uuid": "89b10326-d465-4937-babb-8b6c1bc41055", "comment": "Malware payload (Mirai)", "value": "e4d3f84f419658c689cac7cef181b6f6c143cd3a1345fb29d4a946223a436e5ac182d85596d74d6e744d4e6b517fa7ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316228, "uuid": "eb429508-2066-488a-8d22-160b3196b8b5", "value": "T19DF37436B7619E77D80ECE7305A985121C8CD98712D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316228, "uuid": "caff859e-acca-4dc7-9968-c67735747695", "value": "3072:1LNqrhHZ0P6bRFBQiUfRjHkLwmrThPaLEne7rNb:1Lsrr0PeRTJOgLwmrThPaLEne7rNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316228, "uuid": "428daf3e-a10b-4bfd-b905-137f3eeb0986", "value": 159493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316228, "uuid": "9c67b5f0-b944-4377-a059-fba598e3afff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316228, "uuid": "da4d8daf-0c73-4b30-8089-470b1c71eeac", "value": "1b639dfe80947976da2043c6bcd79f7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27ddfc5-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632289756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289756, "uuid": "a04c43fb-76c3-49a0-b9d0-b67fb0b6f3d6", "comment": "Malware payload (AsyncRAT)", "value": "63153251a4264b8a8486f72f69e38912", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289756, "uuid": "7935323f-1783-44ac-ac91-ef6d2dcda04a", "comment": "Malware payload (AsyncRAT)", "value": "2be88cc03bf14b140267099ba5270fce43a8ec4a1578c2b96f11be8139c42255", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289756, "uuid": "5ea3bf35-c0cf-41ec-a50e-a974253e2403", "comment": "Malware payload (AsyncRAT)", "value": "eee117aa16eb3178841e0d619c7915574b285d27", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289756, "uuid": "62af2210-b648-42b6-b1f3-607af0744efe", "comment": "Malware payload (AsyncRAT)", "value": "d09b1738d0e5df6e115db16b5c292b1d2a85e60fa1319c66d959d126f2cedbbc77a99453f45882b7ece57343ff5e6089", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289756, "uuid": "5b28b602-ea6b-4ab2-b20d-258bd08cecf0", "value": "T176E18E1786851E69CA60053EAA2C4FBB65045C5A10FDF72B2194326C0FA178713D70DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289756, "uuid": "4462ec14-bfcc-4c26-88fd-c5bf05caec20", "value": "96:ZEKr9NP11s5geRYnEG7ci52krrn6+nEi19OK94vt5UlsIZEXo1YXUzaLUe:xrXP/sGcYBci1rrn6C9OTvx75X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289756, "uuid": "4196df35-feac-4589-a4d7-01bffe110592", "value": 7403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289756, "uuid": "ca5883d4-c713-46cd-b8dd-f3c36f3802ae", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289756, "uuid": "248abc43-8604-45ba-82c4-34d24551bea5", "value": "Documento.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc30037-1bae-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632319730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319730, "uuid": "be5a05c7-20e0-4fe7-b259-7c071142a72a", "comment": "Malware payload (SnakeKeylogger)", "value": "e64bd2c72aa4cb3136a3e724884ca9cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319730, "uuid": "bdb733f7-9bff-41f8-a965-93ed66ad3813", "comment": "Malware payload (SnakeKeylogger)", "value": "2c4a136cff5708096c501a149f6ae89ec6f639c66841aae429d28b6e415b899b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319730, "uuid": "fb87ca3e-fb07-44cc-881b-bf85d824988b", "comment": "Malware payload (SnakeKeylogger)", "value": "71f4bd90c43ae02c0bd770e48cc08e39ab589aee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319730, "uuid": "8aadb725-fe80-4549-873b-660c578884f7", "comment": "Malware payload (SnakeKeylogger)", "value": "e7e0afd12b4df66b2f95761cdac95ec80007ee49b6936f86dbf5d7b2e11aeb2110aac68b7d2600636c71817edacf4988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319730, "uuid": "f494dabd-fc48-4fdb-8ec6-ccb7dd4f257d", "value": "T1DCB40860256E7D75C0B46B3A477317E51BEEDC002A7ACF896B21F2B9103C6D77E4220A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319730, "uuid": "afdb69f6-9b2a-41b0-8740-f0f1e2b8e78d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319730, "uuid": "5b4941aa-a63a-4d6b-8aa7-2ab91af230a3", "value": "3072:QGNbLbRyu6dkyOMyKoCwx+Hg5+a5ugc8ffgoPlRS9ZQaTznvUPh0kudnd9caTFtI:QGNbodkfAwv5PNfRvSIaTznyouSmSX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632319730, "uuid": "ed512b45-ded5-4f78-84dd-6f19c7d1c6bf", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632319730, "uuid": "bb04ab5d-7bce-4502-b72d-55f6b5c9dbc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319730, "uuid": "d2461020-a49a-412f-b58e-238dbfed3dad", "value": "e64bd2c72aa4cb3136a3e724884ca9cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce8c777-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632334387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334387, "uuid": "e044ba5a-7e59-46c2-90e3-336bbb243d5a", "comment": "Malware payload (Quakbot)", "value": "45aca51df21c61427db0ed10b554259b", "object_relation": "md5", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334387, "uuid": "d1b5fe75-d38e-4b2e-ad51-836176117ce7", "comment": "Malware payload (Quakbot)", "value": "2c544aeae61ee9bad278fc039e69b5ba8ce1861ed440b4704ce479770fc049cb", "object_relation": "sha256", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334387, "uuid": "fa7a84f0-b904-42f3-b1b8-461c8ea964c2", "comment": "Malware payload (Quakbot)", "value": "43b973562001eb5f2ca0b8f6f89777ac48f05138", "object_relation": "sha1", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334387, "uuid": "8d25ed99-da77-4a57-9b66-1164fc6b0b11", "comment": "Malware payload (Quakbot)", "value": "3517273e113f636bfe1e91ded51100e962a45e04a9f66156d3c1f3fd754ea7e5282b2587afda4232fefc9d6f681c15b3", "object_relation": "sha3-384", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334387, "uuid": "5c1cc266-4c38-4a1b-9fea-d32ed013b9a8", "value": "T1FDC4AE19BEC3D1A1C83C187488A1C9F27638B865AD54D6473AE93F3F5EB31C25C560AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334387, "uuid": "90d0b1e3-f6dd-4b28-9039-639a2041b763", "value": "c900f0b45b7574481cc6a21428393566", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334387, "uuid": "5f07a508-1378-4576-a142-db0271442292", "value": "12288:e1ghp5DubQFErdxA+zM5miTrqZj1kENwNmhxOUNU:9Irv05T+ZjHNwKOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334387, "uuid": "68c2d013-44e2-4417-aa5b-4aad24a1724f", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334387, "uuid": "625ce1b1-c847-4518-9218-da5b061c495e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334387, "uuid": "9d9a2915-cc67-41df-adfb-7a234560c3d1", "value": "45aca51df21c61427db0ed10b554259b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d3e97a-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1632289780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289780, "uuid": "d9d9b32a-417a-4a2f-b4fa-8aa44852a004", "comment": "Malware payload (STRRAT)", "value": "28323d2c57a11f267035f5a580d609cf", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289780, "uuid": "7a6ea273-ce85-4ba3-9442-5486200931be", "comment": "Malware payload (STRRAT)", "value": "2cd33b67cedb84528ce335e93eb78187cf37e0d69c66cb55f7ab3deda7050828", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289780, "uuid": "a8e6edc5-1ac1-47a5-a503-00c3aeeb23ce", "comment": "Malware payload (STRRAT)", "value": "7b78faf2ccbf8fc6f9c1fa97d31f50ee5318edc2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289780, "uuid": "63168e0c-eb4f-4130-80ba-194d3dc70946", "comment": "Malware payload (STRRAT)", "value": "01eeafaf716b3d7832370ddad25a850bbce2622a3e1533c1e84e15b480ef551f20b8bef066dbafeeaa9016cdc3384243", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289780, "uuid": "2a4c5037-6038-4921-8256-575c9fe29e96", "value": "T19404025EFFDAD0EAE717823655194171F28D2058F005912BBAFC19121EB4D78870BA9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289780, "uuid": "9f05ce5b-a5ae-4bf1-8342-d1af562b78f2", "value": "3072:ZfOlgZrl05LxQyieJh24yOrziWUhS5YmpwCBApnIg8MFRKj6jwN9gj:Z2+m59QyiSOOniWUhgptB9j/9gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289780, "uuid": "8f758f3c-c312-407e-a9ff-96046d6f0a9b", "value": 188552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289780, "uuid": "a23ee41c-e522-4433-aca8-1347f30c85da", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289780, "uuid": "00479b5b-a2b0-4a26-a36c-cfd15bb8c4d8", "value": "Quotation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfeb05a4-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632316783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316783, "uuid": "20aafaab-c38d-4ac7-bdaa-aae654797927", "comment": "Malware payload (ArkeiStealer)", "value": "cb6051f83eba7a317f0defd165625cf7", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316783, "uuid": "7bac2780-8b34-4b82-a0ea-efdf776d0c38", "comment": "Malware payload (ArkeiStealer)", "value": "2cd6d3a1fbc27a5adc32e3e3a22f9f75f86e25d91a197b7ccc060a913e4217f2", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316783, "uuid": "35258855-3c80-4822-9519-b0f94ee58600", "comment": "Malware payload (ArkeiStealer)", "value": "8972af5080d8115fd6fa69a0db48cee3fd01e8e6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316783, "uuid": "824450cd-97ee-4bdb-bffb-7d255c0a992b", "comment": "Malware payload (ArkeiStealer)", "value": "67063079ef14edb2c17d53cfbf48d7d746bfa922d08b85a2381d191cb8ab82c765d48e40b84452d98aa2e4756193f984", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316783, "uuid": "734891c1-c275-45b7-b0d1-24b8633b42f2", "value": "T1F805F1306AA0D035F9B712B05D7DC3A8A52A7EB19B3050CB62E53EDF56352E4AC30B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316783, "uuid": "331a02bc-e0f7-4562-b37f-551ba4f7f06f", "value": "bfbc360c6a2a20fc6e98b50e62a61f43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316783, "uuid": "0f0ce7d0-2ce7-44f4-9954-8077ee3a430e", "value": "12288:8QSV3F1yykM3m7vMY4ITyC8CbZZnRlKsbv/yUEz3/mo8dY7nE4VPdU/rgLc:rQF1yy+Dy4bZd+s7qZ/moPHU/rgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316783, "uuid": "caa3736f-89a2-4a07-9372-e9658d44f693", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316783, "uuid": "f9d33e03-1500-4158-845e-d87cfaa3e68e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316783, "uuid": "0f4330a9-278e-400b-887a-0eabcc47a798", "value": "2cd6d3a1fbc27a5adc32e3e3a22f9f75f86e25d91a197b7ccc060a913e4217f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e9dc7f-1be8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344605, "uuid": "a864f98a-63d6-4234-aa6b-c1a51796152c", "comment": "Malware payload", "value": "dd5ad0f08229b6b8a5624bd03ba907c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344605, "uuid": "a3fde16e-c31e-4cc9-9c0b-4e99950de41b", "comment": "Malware payload", "value": "2eecb7f3ac6d026ebaed050b0fa0657a6a31a3147ac2f70e61022d729fbbbad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344605, "uuid": "2a005a53-5981-4a4b-a55b-e8e471129c6c", "comment": "Malware payload", "value": "b406b4ea867d258f7ec0b31d89cbfe4abd16352f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344605, "uuid": "0a70387e-41db-4674-864d-00c4b3290333", "comment": "Malware payload", "value": "824bffc964d8502bd606d7a5f8668a642bfed688e80159c5038dd16106de88420a4e6bf35b1c1b787284d8204ffb355a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344605, "uuid": "d871b636-5c85-4415-9104-2ae1d8825878", "value": "T111957C116E8D8871F2B73234A5DA77B951ADB830AB3041D76350FBADAC707C2963934B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344605, "uuid": "3eafbc85-bd43-4272-9102-8741f48269da", "value": "e2afc946bb1a7942e18b4d1a8f444ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344605, "uuid": "8e150fa7-3876-44ed-b392-e4a4e4e43f2c", "value": "49152:HnIAkInphzxpIa6Ed6kd8MIQkZiFzi+p6C:rkInpzl6EneZQ1FzH6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344605, "uuid": "d47f7479-a945-4831-b6a4-452c87bbed29", "value": 1933312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344605, "uuid": "55e45e0d-c476-419f-8dee-0d098e23e55a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344605, "uuid": "b564dc06-01fb-401b-a52c-d87fb1d6b004", "value": "\u8bc8\u9a97\u56e2\u4f19\u5728\u6697\u7f51\u5012\u53565000\u4f59\u4e07\u6761\u4e2a\u4eba\u4fe1\u606f\u66dd\u5149.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa94108-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632312560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312560, "uuid": "7d9f0a96-229c-4e80-8a1f-5fa835eab88f", "comment": "Malware payload (Formbook)", "value": "c40d259a0b4e4747b0f621a68fc6c1e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312560, "uuid": "6528f57b-5b55-4e66-8eb8-28260a8b85a0", "comment": "Malware payload (Formbook)", "value": "2f086810181af89d5d29a30f5eafcc60efdd2dd3f68292dd3acff64fc92a547a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312560, "uuid": "c1cd295b-c412-4dfd-a33a-067b460684ea", "comment": "Malware payload (Formbook)", "value": "e59f65f58364926af52b81aafd31065277a9cfe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312560, "uuid": "2143557f-08e9-4942-bd7d-7df1298b11f8", "comment": "Malware payload (Formbook)", "value": "0925e93fbe327f306402194688c678d5b8c8ec0b2fdb02ae4acead4eb8788ae0f5a1cd1b49d3817f289c1de8ecc68796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312560, "uuid": "f7b00c36-c1de-4fd0-bf33-78e36d4774f8", "value": "T11AF47C9D322076EFC957C976CEA82C64EA2174BB530BC207A01716AD9E0D997DF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312560, "uuid": "32b5d964-f7e0-404e-9180-5fae74a70d7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312560, "uuid": "b5ecf88b-3761-4987-a277-d99e1341259e", "value": "12288:PDY4kEXQGgj01EoG4kZo+8q1CT73BDBJSTTFCPZw+j5Z+/dqh3khGW0OmLGazpwP:PDWN01EQkfj4NDPSTp8aMYqhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312560, "uuid": "78730530-c757-4dca-8648-70a875547b09", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312560, "uuid": "874607ba-3f7b-4025-b1e7-43314af1431d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312560, "uuid": "04347c0c-5ae0-4104-b283-be6bb8d2a146", "value": "c40d259a0b4e4747b0f621a68fc6c1e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29630932-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632289472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289472, "uuid": "ed44f360-d95f-45fb-a3d8-2580126f3f54", "comment": "Malware payload (AgentTesla)", "value": "c7cd9d4ebec68d90fa64461b4fa88b21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289472, "uuid": "275e4ef1-520e-459e-a59f-89024a700465", "comment": "Malware payload (AgentTesla)", "value": "2f5741617cf3f7d6da4c993e5bae8234d61ec9adfe066e06149f5aa654199cfa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289472, "uuid": "6c8271ed-d256-4c53-98d5-71535b7189f6", "comment": "Malware payload (AgentTesla)", "value": "6a1c9b2e3db1ba84b1bb500ce383c93ff1779f20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289472, "uuid": "bed01d68-7826-4331-9ecc-5f1662c417d9", "comment": "Malware payload (AgentTesla)", "value": "a65d71668ac7797d095a0d1b9c73da78583f9397a5e156ebcdc0e6cab12c64f2382162caaef7558bd7d4209fee7bb526", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289472, "uuid": "0691ce0d-4df6-4506-8cf0-927005d94583", "value": "T1E2B42345A1A3D9FFD8A3C7781875B779B10367289112590703946E3BBB0A883ED472FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289472, "uuid": "7fe0c854-c782-4aee-a23f-86ad1bbfd009", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289472, "uuid": "07690406-2e6c-4223-9afb-123d96dbd5ab", "value": "12288:FLMeE19ta6JpaRLJhAFb9Gwd9/HyuKLmoXq+:1MeW9om0ruxGwd9/HdKPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289472, "uuid": "3f29de48-fa65-4147-a156-b30c4c7f48bd", "value": 530311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289472, "uuid": "af4108ab-3532-4810-9168-e75eecb2b398", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289472, "uuid": "610386ad-d86f-4d3f-b478-c36c829f0416", "value": "c7cd9d4ebec68d90fa64461b4fa88b21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7535724-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316849, "uuid": "5974bdce-4b70-4d47-8419-11af54a388ea", "comment": "Malware payload (Stop)", "value": "faf21f1f42846fc2bff2db7946354c8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316849, "uuid": "e1bea457-1698-4f51-b839-c37bfe347455", "comment": "Malware payload (Stop)", "value": "2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316849, "uuid": "29da579e-e908-45c8-a9e8-6350f035dda0", "comment": "Malware payload (Stop)", "value": "c2c7a38cb28ab175ac3726bc65e5bf2820990168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316849, "uuid": "150fe133-8b27-4192-9b26-fa84333eb78c", "comment": "Malware payload (Stop)", "value": "a141a31d37f11ac4ecfbcf9cb843faaa6913b85db38b8e4515eb6a13b94e3e4223767b5318088f744114167eda5aade7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316849, "uuid": "fbad519d-7163-4c63-a6ef-b663d169bf7a", "value": "T176F422007650CAB2C69759318B64E3B0D777B9226971C74B2717B7BEEF213807B6630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316849, "uuid": "fdc4e679-4c91-4931-b8e0-79a3f6aefc5d", "value": "b4a5f131bf57e0871ab3cda52113b279", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316849, "uuid": "087c44f3-3a1e-4e39-bb37-c879c9e98a69", "value": "12288:cjIpoJXSSYGMQLefEMT1LCWRLCdTF0NzT557AYLuMu348EGj9fDuukpIrACCNqBr:cEpoJiSXNkEMT1GWkTFCzT557nLuRo8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316849, "uuid": "6681c20a-6102-4f76-859d-f28aab061f1c", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316849, "uuid": "1b4b9f6f-bf9d-4995-b74c-0c23df9f3b21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316849, "uuid": "efdd0e96-4fc5-40a7-a550-65f04d71963d", "value": "2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1ce20c-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632317017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317017, "uuid": "ad3bc0b9-4a9d-42d7-a6d1-8e7ed03af52f", "comment": "Malware payload", "value": "411ccc32901140fb9bd05deca71b4004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317017, "uuid": "1a9cdee7-4b0c-4d24-9545-9b272bd6c9bd", "comment": "Malware payload", "value": "2fd46dcc61eea04399708df6d3be6fe9a866be4d5e09f8b5199e8fe160ad81bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317017, "uuid": "6b8a0c4a-bea8-49fb-a6de-da4b640920c3", "comment": "Malware payload", "value": "ec8d57aaafce5082e04b009b00f7d76a2a3bc725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317017, "uuid": "8bb3572d-ce82-4beb-b873-7cd82f3adb36", "comment": "Malware payload", "value": "dab604445ccfe04cb0f09739b299de19cc1414963c4506e741199f46f1f025c5bc5645e43fd94d312cfabb3ce19f6bb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317017, "uuid": "a7edcb46-0b9a-4cea-835c-c882a9f12b36", "value": "T11804121671AC8C5CD2CB22701F6FDC966FF4EC64DC26566E1542363DA080FA0372ABB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317017, "uuid": "49520f00-48c3-4869-9a58-bea936013681", "value": "514c554c4eccf8b5d18d8453867113c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317017, "uuid": "1d1aabd5-2594-4859-b64c-0339e8f1a23f", "value": "3072:cJ5EFKOO6OzSmxs8VHgXPc8XASOg17MTvuout0:PFKiOzC8VEXAouuoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317017, "uuid": "bce8cb28-f4c6-480b-820d-35d4674710b3", "value": 178091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317017, "uuid": "b2af7045-b78f-460a-8d9e-bd1c48bf735e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317017, "uuid": "00fb6b48-8acf-4480-a568-5fbaedc75f7c", "value": "2fd46dcc61eea04399708df6d3be6fe9a866be4d5e09f8b5199e8fe160ad81bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc06e3a8-1b97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632310012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632310012, "uuid": "e6c7f643-52df-4134-b493-8baac81f7f1d", "comment": "Malware payload (Formbook)", "value": "c6c02236fb49f739d808a3194bd9c925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632310012, "uuid": "2ab49bfa-c8e5-487b-b57a-8a5bbb4f50a5", "comment": "Malware payload (Formbook)", "value": "3046d29324f18d00e2603aa26674aa29e9cc9ff3e110fb51e23204ff06e36f70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632310012, "uuid": "aecfaea9-30fc-47dd-a125-c873376e2ab8", "comment": "Malware payload (Formbook)", "value": "9b487089746d16e4e6d8cace3c4d8811de561934", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632310012, "uuid": "be1190ae-4f02-4745-9be8-e99c92409a69", "comment": "Malware payload (Formbook)", "value": "c099affbf35277c62fb66ddf6736d330deb3624d129799e9489f72dcca1e4e905369bdb2f6d8be835a143869267af4a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632310012, "uuid": "7020e12d-6a0f-4e92-8702-11faa194bb13", "value": "T14AB41230C23CC72CDB5C8BBD5561514607716E9B7A13EE19DA59B8892E3B7A3C024FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632310012, "uuid": "a26ef81b-e49c-4dcf-a74a-834d9b35f904", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632310012, "uuid": "5753425c-9ddc-4101-8efc-074a2b4bf8b8", "value": "12288:pNYpmtiK5oBskIWKdXCJ8Z1BK4B7B312ML:q+FoBsMKdXAqhNFtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632310012, "uuid": "d895e302-0ea2-4811-b1e8-3b31ddec45d9", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632310012, "uuid": "5b502394-8c25-41de-8971-9f094f9bb65b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632310012, "uuid": "9d72f7c7-5af8-446e-9cae-b6c6ee604ed0", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9da3b6-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316613, "uuid": "ae4279b9-d746-4cb0-a166-9c31997a4fb5", "comment": "Malware payload (Dridex)", "value": "4e7b3473e8a237bb62cb82484af582d7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316613, "uuid": "780b9a1a-8fc3-43b3-a834-815a91787424", "comment": "Malware payload (Dridex)", "value": "3061d92e87741ff5084623a5d5d234c6d04f4ee425e251afbc8d63b166d01d1e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316613, "uuid": "a4f4d312-f2e8-40fa-acd2-3c9749f47a9f", "comment": "Malware payload (Dridex)", "value": "886862b02ea1ba97d4a7a709aaa28a62c44aa535", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316613, "uuid": "01723820-8a48-4204-83e9-086f2f107a3b", "comment": "Malware payload (Dridex)", "value": "7d357b2da44faf9636dc9a036fc3aeee6d556a7cb6f6af4b8126a47ebdf364e62625b0058bf9277cbe6d7e47da3e3b28", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316613, "uuid": "d92294e9-a608-4662-a0b1-03b6372ada0e", "value": "T1AAA5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316613, "uuid": "7efb92ae-d89a-4d8b-9b33-d7f3a52df346", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316613, "uuid": "a53c5f63-25f0-4381-9fe3-1362071e32f9", "value": "12288:DVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:SfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316613, "uuid": "7229cbbb-a9d2-40a0-9aa7-be4dbef077e2", "value": 2117632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316613, "uuid": "eef023f2-c702-4b76-828d-c5b1871fa358", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316613, "uuid": "4b6d800e-2ef6-4acc-9f6c-fafe152ee921", "value": "3061d92e87741ff5084623a5d5d234c6d04f4ee425e251afbc8d63b166d01d1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc166b3-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632312431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312431, "uuid": "1600f328-dc26-4c52-b0a9-01db9f19dbd6", "comment": "Malware payload (Formbook)", "value": "159eb5786f4b17721261d1b33e1aae08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312431, "uuid": "74507540-318e-425d-8f3b-aa280ff20fa2", "comment": "Malware payload (Formbook)", "value": "306f86752e3ae1a4baa4687d06759b43cbcb47a6ded4073b2e066b72ac4054ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312431, "uuid": "8c5a778d-1400-46fc-af45-417e2e22f6df", "comment": "Malware payload (Formbook)", "value": "7900bac42d67d209fcd386627bb02e5e3c0ff2af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312431, "uuid": "235d001a-32ac-479a-8fad-14d73e0a68bb", "comment": "Malware payload (Formbook)", "value": "0ad76a14ce059f22a208d9046425360b6b88a66d44e0f287879507cab9de714225d79e156b84e8c036be855e4f66abba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312431, "uuid": "fb71cb74-112e-45ad-9cd4-3a1a7a1c26c0", "value": "T139B4127D8B9C5A3FC2ED8AFD14201242AFB5F0167AC5F795DCE0309A6B523E8401796E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312431, "uuid": "fd8d2f12-5fa6-4b61-8840-621c51159d61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312431, "uuid": "18b6cabe-9c05-469b-af8f-4ccbae1b2498", "value": "12288:WjmtiK5ov1b7Pqt1G1V+EoA5vcNSDuYuDuQ0XRF:Q+Fov1b77toA5owB39F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312431, "uuid": "974a1df6-973a-41e5-8ba5-743b2b959d2d", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312431, "uuid": "6cc41453-22bf-4499-ba2f-2f3612335949", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312431, "uuid": "bfc4cb91-5ada-4f68-81dc-f1ba10d2635d", "value": "159eb5786f4b17721261d1b33e1aae08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dabd16df-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632334437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334437, "uuid": "ea612926-8a30-422c-be1d-9e447a00b042", "comment": "Malware payload (Formbook)", "value": "ba077a988793bef42012f4ea39825be5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334437, "uuid": "2e23b975-7bc1-4f5f-b66e-35db26353e6a", "comment": "Malware payload (Formbook)", "value": "3223dd79c4d992cae77414e3e334e705a4cacd22b76cfd46887f9a8979dc55be", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334437, "uuid": "4b4823bc-8bdb-4c59-95a0-22c4172da5fc", "comment": "Malware payload (Formbook)", "value": "0120861aec72aa402e28c71a25367a3609bda1d8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334437, "uuid": "45ce0fbf-bb11-4b6d-9366-1b55d9939bce", "comment": "Malware payload (Formbook)", "value": "e2a68ceefc5754bc9969481800bc8e3e77501b0429abef1487f16842dbd913647cc9f62fb42fb95a94864565b08a65c8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334437, "uuid": "60a09e41-f696-40af-bc89-4231bd515eab", "value": "T1698293ACE44B06948F86A3B82B2F6F05058D761DF7DD9273357897346AD2DBA801283C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334437, "uuid": "9e20dd10-beb1-437d-ae19-a11ee7926a9c", "value": "384:+bxesPMMivBYPL0lZjmg2diXnKDiYu934ZtOWQMMC06i3CDr/soo:+bxbi5YPL+ZawtoZt5QhciSv/To", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334437, "uuid": "abb25adc-54e5-496a-aaec-52c9294337a6", "value": 18728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334437, "uuid": "1c0505ed-a65e-4297-9b0b-da4f5114df40", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334437, "uuid": "67f09116-5cee-4648-831b-fcf71d79d219", "value": "TU22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa90fc3-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316801, "uuid": "fa4163ab-ebf6-428b-ae10-01fbc64cada5", "comment": "Malware payload (Stop)", "value": "ece4abade00ec557c59f5daa3f62f90b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316801, "uuid": "94de2278-c58e-4d81-a24c-89f99fe70366", "comment": "Malware payload (Stop)", "value": "325df09a1d1478a0be19a6112b0753714fb0e3b6308b263c0bfe8c65a0708c05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316801, "uuid": "51dcf9c8-34f8-43a8-b678-545f20df7b2e", "comment": "Malware payload (Stop)", "value": "9b3a721da45c3d6f4c3a4faabb0859aed92a7ff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316801, "uuid": "5f1b3cf6-42c1-45d3-8674-a0ba1bf7110a", "comment": "Malware payload (Stop)", "value": "ea6ee0c73785a45201fbfdf2b8d7fe7a21e3837f884bd6ec092ef730360d7031f8e30becbc3f0087d7eadc3b73cca3a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316801, "uuid": "8f5a8a3b-f315-4b2d-adee-0e5ecc4a6f34", "value": "T109050220A790C235F5B793FA8AB68BB6643D3A715B3491CF62D226ED12347E48C31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316801, "uuid": "c53a5fa3-ae93-46e6-a374-94c061f47cc7", "value": "7273bdafbe151bbfd9b7057bf9d812ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316801, "uuid": "6e9c6c35-0207-44a0-bdab-bf1f442e7ffa", "value": "24576:T8uDrGR/A1B54Gb/bEbhjSwpDgEklcjII3FssHn+:iu1BzK9S6Dgil3FsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316801, "uuid": "86ba77ee-8e61-4062-b6dc-861cce557681", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316801, "uuid": "de885504-2b7b-4f72-a24f-9c364012e419", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316801, "uuid": "8dc3f74e-d29e-49f5-a35f-3782349d413c", "value": "325df09a1d1478a0be19a6112b0753714fb0e3b6308b263c0bfe8c65a0708c05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa595b0-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632316694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316694, "uuid": "d7a967ef-c24d-4c90-9cd3-09ff929ee631", "comment": "Malware payload (NanoCore)", "value": "e07217b1154af88f8ce6741582982984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316694, "uuid": "6cbfacea-f655-44ff-aa58-f17f21bb2e62", "comment": "Malware payload (NanoCore)", "value": "32d774692a0b8f16f24f190d56cc418af8e563db7dd663c37173708a9e300aab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316694, "uuid": "a3b1db97-8d00-485a-a7df-36740bdc1d63", "comment": "Malware payload (NanoCore)", "value": "c41b10d02b0cfba807b42fbee2c1d107dc695fa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316694, "uuid": "06579205-add4-427c-a0f4-1c7576f4d5a1", "comment": "Malware payload (NanoCore)", "value": "68e9e089ec9f4488d6db9d56a0c6d7cba2c697e48a682fa120220d6d53ad2addde2cbdda145b901943fa9e25951f5103", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316694, "uuid": "22de1578-d59a-467b-837c-6855304aaff1", "value": "T128552394379B9362C9F4967280CF3DF013B3AF974733A9A5365D61082E82353191AF5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316694, "uuid": "55154a09-86d8-4ff1-ba5b-38114785acad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316694, "uuid": "50360226-77a0-476c-ba8d-fe95eee4f8b3", "value": "24576:TR5mrVUvCt2/WdUwtBmdkqHpiFIXSNYfeXD06xzYj9Vx/EQ1rXC:t56VUvCtiAUwIk8ApYWD0y8jbxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316694, "uuid": "c53cbeeb-b2c0-4e02-941c-78a46a38ce91", "value": 1333760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316694, "uuid": "c092d67c-fffd-4633-b20a-7751bbd4c99b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316694, "uuid": "8ff1203c-c0f3-4c0a-9acf-b8b166ef5f7a", "value": "32d774692a0b8f16f24f190d56cc418af8e563db7dd663c37173708a9e300aab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefd86bd-1bff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632354604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354604, "uuid": "17a5b86d-122a-4911-8adb-223fe56146af", "comment": "Malware payload (Mirai)", "value": "d7f834914e8588f60a910518f9854da9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354604, "uuid": "bdf38dab-4cfe-4e60-8c59-df80528bda44", "comment": "Malware payload (Mirai)", "value": "33052dd5e2eb157a74b66c396504d8ce95ea7ff0d27229104a6229536d6cdfa1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354604, "uuid": "31c0d461-9b2e-48f8-be9d-93b0c7006b24", "comment": "Malware payload (Mirai)", "value": "a8bc117240ad1716aa5bc84d41bfcc0095b55615", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354604, "uuid": "f955fdc8-0b8d-42ef-a959-18254c1fd4e6", "comment": "Malware payload (Mirai)", "value": "f27a69f4da72846cc50574db122cb77ad4d037135e034622afcd2f899b07215bacd9c2b8b1ef563714fba997a590ed6c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354604, "uuid": "6f0196eb-affb-470c-aedc-687cebe4c582", "value": "T1DFD35C46EA818F03C4D1277ABAAF41453332E754D3DB730699189FB83F86B6E0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354604, "uuid": "3e9623af-b055-4163-b53b-508a72459c9d", "value": "3072:SvX8lu0ppD6+iMRNZJJEDtekESV0Oy+CnxX1O3M/9D+DNn:iX8luepDdeDtekEfO8X1SM/9D+DNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632354604, "uuid": "438522f5-da2c-478c-839d-8f775d2161b2", "value": 135389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632354604, "uuid": "3df016fe-1c94-4ea1-9445-eb7adabb81d7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354604, "uuid": "27c039c8-adda-42e2-b21d-0cbd0840f0fd", "value": "Hilix.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55592d4e-1bf3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632349246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349246, "uuid": "ff74fe43-fea2-4d75-88c3-d340a1f7d289", "comment": "Malware payload (Stop)", "value": "26863d325125f4d8d83e2eae3376454e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349246, "uuid": "a053b4c4-4f7b-4a2a-b196-a58a212b1476", "comment": "Malware payload (Stop)", "value": "331318ad73d13c8c2e3fbb0d56c5a493722f42eeda70c0b8e375abe035a6b54f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349246, "uuid": "57422c68-b5a4-4ad9-bd36-37f0aafd1307", "comment": "Malware payload (Stop)", "value": "533a7ca388527724f1e1dec150ca118276ce7df1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349246, "uuid": "92787641-cd68-42a4-8dde-c5aca77c12c2", "comment": "Malware payload (Stop)", "value": "72bb26435d890f4d5972b4f2ca3b9a6c587cb3485008aa26c008209cc3499897b96d4264b1116d68f1337472865c0945", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632349246, "uuid": "654df8cf-9489-4077-8937-2095096c5b63", "value": "T1D0050120B791C434F6F612F845BA93A8A53A7EB1AB3450CF63E13AEE56341D1AC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632349246, "uuid": "9b7325d5-eabe-457d-92b1-03f27259086b", "value": "0724b6e67f50109c65fd8c6025d37cf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632349246, "uuid": "331442e4-f14b-4c56-ac19-dae5536b93ab", "value": "24576:q//r7ldMX4Mpf12dgRRzo96Oo8PnyKzEOBgG:q1dMLpt2dgvzo9XGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632349246, "uuid": "484d290d-fffd-4882-b183-52bd7a2577f9", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632349246, "uuid": "73603feb-78d5-4339-b1bf-16bc40dd3082", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632349246, "uuid": "7fd486ee-5a4e-422d-b0f8-b4d6cc3a7b5b", "value": "331318AD73D13C8C2E3FBB0D56C5A493722F42EEDA70C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dec4c52-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DarkComet)", "timestamp": 1632316968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316968, "uuid": "e96d516e-889e-4656-b95d-e73db247f2ff", "comment": "Malware payload (DarkComet)", "value": "9dbffc041eb423abdbcc46e05d99899d", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316968, "uuid": "fe6f1bd9-2351-4059-8ea7-fa755b303427", "comment": "Malware payload (DarkComet)", "value": "345415dbeda848892a070803785da5a40db03b7800cfa726bfbe7fed3c4136a2", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316968, "uuid": "2ac4eefc-8b19-4a24-9755-d321c1b5638b", "comment": "Malware payload (DarkComet)", "value": "9224ed9c8521441e787dd232e18e859c9d555e72", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316968, "uuid": "6b7c67c6-866a-4944-aa45-e6d99a0bdfc0", "comment": "Malware payload (DarkComet)", "value": "0e3842799ba585b357114bb3465985c28c3d6e703837a9391504c3633ac9009d2ac6d73d81a72f5fde0211da1ca1fbd0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316968, "uuid": "c703c473-45d2-460d-93c3-bd3e7f217828", "value": "T1F3B4E0B1F144FC62E8D60DB1E11F36B117466F6AC898392F7584BD2E7CB3B45C0A291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316968, "uuid": "d6ba69f5-d624-40a6-86dd-f9fed0d39522", "value": "f2d24d034ad8ae86f9dd9c6c9707e46f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316968, "uuid": "e562ad1a-e27f-4bd8-b568-50dec1642c37", "value": "6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMb0:f9fC3hh29Ya77A90aFtDfT5IMb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316968, "uuid": "89a6a755-d6cf-4c8a-bfbb-9184d798f6b9", "value": 532615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316968, "uuid": "b4a4c6ad-fd6c-40f2-bed8-008c50a80002", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316968, "uuid": "4b7acc94-01cf-4198-9944-659a5e3efa9e", "value": "345415dbeda848892a070803785da5a40db03b7800cfa726bfbe7fed3c4136a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28a49ed-1b6b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632290991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290991, "uuid": "d9181faa-ab65-4984-8040-6d3a73b5681e", "comment": "Malware payload (AgentTesla)", "value": "464959158ed71950afe40ad865c3b665", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290991, "uuid": "3ee0a217-f58d-4b72-b044-2165d14cd1e4", "comment": "Malware payload (AgentTesla)", "value": "35e3ba35c42911426f042be29d0c0cee146c58394cbcdd95b04289668ee08902", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290991, "uuid": "81df487b-41da-4110-b34f-ecf994732ed3", "comment": "Malware payload (AgentTesla)", "value": "c0574270b0296b372004720521ac3397b8b69f02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290991, "uuid": "ad05e796-0d59-4fa9-bcb7-937c97b267dd", "comment": "Malware payload (AgentTesla)", "value": "ea2bfab7333d505e379d2c807d636f0c246ac03d0aafa5bec268b8f777c33ea0c8d4727bea2303855894a4dc944dd248", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290991, "uuid": "3a058eb1-df2b-4c65-a969-31227237ccec", "value": "T1BF34223722D05CED9EA0E5A7B785EE0D40B31B5BD03C161C8AA8B7D7056A98771CB633", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290991, "uuid": "a22305d5-3e3e-493f-87d7-7d0e184d3eff", "value": "3072:zjOgWgPKshngQgP63gxid5sf3eGVI3cWqAL4ShhbfVO6W0jdIP3h/RyxB92kLvcE:OgWPshn3/PsfuGVIQ0hFtO7z3xR3kLx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632290991, "uuid": "bedd4f4c-f25d-40d2-be54-45f59229599b", "value": 239436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632290991, "uuid": "49865ff3-2505-459c-9bf3-eeb6a1c3be2e", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290991, "uuid": "f27d8578-6f33-4196-9446-4d60eae7f379", "value": "DHL STATEMENT OF ACCOUNT - 3300315209 (1).GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170bfd6d-1ba0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632313493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313493, "uuid": "393dbfbd-23a4-42c9-98f4-2c5c3d70a862", "comment": "Malware payload (AsyncRAT)", "value": "6e2281a0d6ff813f086dd8acf0c8d73f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313493, "uuid": "8c58ca73-2353-4865-b99d-64f01bb52134", "comment": "Malware payload (AsyncRAT)", "value": "37240b0a8e09cad3b2f6f3e6db18279d653c36bbfa2813c2ef0f03055efb216d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313493, "uuid": "7fa8d886-81be-40f3-a1d3-8a42d7b412cb", "comment": "Malware payload (AsyncRAT)", "value": "d09d000c4afd4464bcdd0eadf01075889bc6f7b2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313493, "uuid": "6f9430d7-276c-465e-b2d0-829b0400935f", "comment": "Malware payload (AsyncRAT)", "value": "f077e84086bdbf04065ab12fced5f6dd084eb315497aee7bd8de2f787ff765a53bb12684082489c7f19153cf8d0ebeb3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313493, "uuid": "9893d9dc-5ebe-446d-968e-5ecca68cacdb", "value": "T1DCC4F16C3790A4EFC967CA3698202D50EB61F06A670BD743786721AC5E4E6DBCF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313493, "uuid": "471b819f-7920-4911-ad5c-37e4c2ef3884", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313493, "uuid": "f5f8b05e-030d-469b-b93e-6ec6f35adf59", "value": "12288:GOPMemtiK5oBsg314tedB7Utzr1uafoS/4SiHRW6bGNAKf3jgHwDKec:GiMe+FoBl3yAH7gduaf/JYiC0UmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632313493, "uuid": "225d1ec2-f581-4b33-8fbd-1ce413fe994d", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632313493, "uuid": "c61b94c6-1862-4d0b-bb84-99b1ada45f3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313493, "uuid": "128fe192-5da3-458a-900e-7cb1bad766eb", "value": "P03000--------18092021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab640d88-1ba1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1632314172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632314172, "uuid": "84289c7f-0bd9-44fb-8725-3f4f8704795e", "comment": "Malware payload (AZORult)", "value": "64be2bc5ad3db30aa9d85b888591962c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632314172, "uuid": "d32d94cc-25cd-4b9d-8293-d52d796b0b96", "comment": "Malware payload (AZORult)", "value": "3733c0d21fd6a6e1ef819f4b98fbf38757051e7431c743a11bd0c7e91f4d76ac", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632314172, "uuid": "a9bab19f-f69a-443a-a89e-924fc17d7086", "comment": "Malware payload (AZORult)", "value": "b22746bc1e4b133e574ac903b087b12d5569a0ee", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632314172, "uuid": "20fe5467-d06e-44e8-8603-453d5f06c6f5", "comment": "Malware payload (AZORult)", "value": "5bbd47cfbfea5461ff08607942e3ca2d689c4ab659b33a2c148fb8aee3b1595ee354589f0509a3e2d48ba2bafa2d9d47", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632314172, "uuid": "c20e7e29-b9a6-4692-806b-a6b80b8d2406", "value": "T153F406394D2682F747EEC66CD48C1BCEDEA6A4837B919F1AC496D7C2025B70FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632314172, "uuid": "08b6281d-f1f1-4170-8a6d-707a2d1d94fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632314172, "uuid": "f1bb2162-1bbc-4253-9512-9f2e057da5f8", "value": "6144:G2viuZ+P3gke+P7PNvaaTrXmid7FZiIWb7eNRutxQApf9ArRhf6DLS2zf:G2vMe+PLZaaHBRuoG9Arf6fS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632314172, "uuid": "d6bdaea6-3b8d-4f76-be0d-5750f86e57ce", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632314172, "uuid": "5b3bf6d2-8123-4abe-b6d8-5b41b3502211", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632314172, "uuid": "e1db8308-dc24-41f2-9cab-cca21964f34c", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1f9852-1b6b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632290925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290925, "uuid": "c5bd9c66-1469-4731-b4d5-cb31d02d6c73", "comment": "Malware payload (ArkeiStealer)", "value": "ea64ad7325fc2da9bfcfa2b982c4813e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290925, "uuid": "4327755a-7155-4c47-a4fd-4523a94dd720", "comment": "Malware payload (ArkeiStealer)", "value": "374bba8bdba85792f9ba272a9635ddc97c67a870a3bf2177e35ec10d545ed4c9", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290925, "uuid": "e219c413-30a1-4a45-8b23-5c086f3b40f1", "comment": "Malware payload (ArkeiStealer)", "value": "2ed5679b5720addcb4283f5c487c49c8ce667ebc", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290925, "uuid": "7ce50b96-936a-41be-85d1-f49dc5ef12dc", "comment": "Malware payload (ArkeiStealer)", "value": "da9c3bc32b2fe2422d25064d4af2204eeacb68cdc60f5d4ed8eb11d8e8c3ead7139e129f2d2f790e3b32a89d947602dd", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290925, "uuid": "59097973-beca-41ca-b1ea-f844ccc85ffa", "value": "T149447D20EEA0C035F5B702F8497AD7A8A93E7D716B3051CB12E52AEA16346E4DC31777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290925, "uuid": "eb378adc-8c29-45ab-b11c-c6a6ac83000d", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290925, "uuid": "1d8b78c5-87b3-4a5d-8f71-7e494517fde4", "value": "6144:h5URWeC/NXyALWe0gC58dRO/OZ42IqajwfUD:Mk/NXyALSv5kREBmajk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632290925, "uuid": "9e3a39de-c9fe-4ef2-b979-fa312671e367", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632290925, "uuid": "277ad421-ffbb-494d-b8ed-63d7c26ded93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290925, "uuid": "3ef096e9-2085-46ad-b818-1480fdf57345", "value": "ea64ad7325fc2da9bfcfa2b982c4813e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90d31d2-1bf8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632351668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632351668, "uuid": "6af272da-63c3-4656-ac99-bad3e65fb844", "comment": "Malware payload (AsyncRAT)", "value": "cf0402758d656ddd2604e86b2366be4f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632351668, "uuid": "17f19fa0-1ad0-4b37-8c90-9859b7d95332", "comment": "Malware payload (AsyncRAT)", "value": "3794e2e7ae2473f740d3d42046fe1c682f6168dd46ca49512049d7d2ce559431", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632351668, "uuid": "5abad87b-8158-4ee9-be52-2238beb0a4dd", "comment": "Malware payload (AsyncRAT)", "value": "f5525371037eee281fd75ba12b07abc8709790ab", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632351668, "uuid": "7ac4e8a1-8bca-445c-8c20-ec0453e390d4", "comment": "Malware payload (AsyncRAT)", "value": "5def22919b6c7d0ec7b8bb72a5a2659fe90b6322b5f6f59f41e2280153e1e981f78461f88a7db47154915bd66b3ffc64", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632351668, "uuid": "50657367-859c-4cbd-bf5b-9d802f90a9c3", "value": "T1CBB4F1167785DB03CD2E35390C262994B3B7DBC33793D6472F8AE5BA5803BCA4B05626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632351668, "uuid": "5fd9f98e-68aa-419c-84c6-7f24aa61d6a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632351668, "uuid": "6db839a3-0a0d-4e87-a467-da8308beedf3", "value": "12288:Eyi6W7n3t/SSWatbqcPUouzLPMntxu6KsljH/q3v1YAWbXt:A/SzImRoAPOPu8D/q/1YAWbXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632351668, "uuid": "ba6c4a4c-f98a-421e-8757-90df764cd62f", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632351668, "uuid": "16fdc649-59e8-4aed-9025-c02e1974e6c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632351668, "uuid": "680afaf2-8a0e-4304-8bff-adfb86449be7", "value": "invoice-378.pdf.Scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eedb1358-1b82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632300970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300970, "uuid": "19ac3589-b8ad-4705-88ab-9978a57a4302", "comment": "Malware payload (NanoCore)", "value": "ad57c7ab148612b1b36b13c02ce27275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300970, "uuid": "0f8ec5a4-201f-4357-ace4-8c37a2a197c1", "comment": "Malware payload (NanoCore)", "value": "37f03b1ba2e2c160c840e3c8fc17bb3c5dd0bcba887483b56cefb3f0de4d87ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300970, "uuid": "0091ded0-623c-41dc-b37e-17d0a943576c", "comment": "Malware payload (NanoCore)", "value": "90d4a8606ec9a280353784e6d3911dc0f2199419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300970, "uuid": "835ebde2-aa9d-4ba8-81b9-c6947d4014b4", "comment": "Malware payload (NanoCore)", "value": "d8ffa2c70c59ee39d46fe9a39bf139297f048a6cfc9853c9abb328c41b74729f7b801e428921cf7af415c837bc7148e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300970, "uuid": "1c21cbd4-53b8-4330-98a6-6885057389cf", "value": "T105E4122D329071AFC917CA7289B41C90EF21B56FA607D3076453219D5E8F2EBCE164F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300970, "uuid": "3090e23b-624c-499a-b3b0-f988bc9b1c9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300970, "uuid": "24187fd1-3be7-4f87-af85-1ee4bdadcd43", "value": "12288:yrmtiK5oBG9q9jEbCREZ+gKfvuZIOIy20soND6jM4ZZFDkhQwC:yr+FoBG8eKfWWusoFSZZFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632300970, "uuid": "4800eaa1-4a86-44f3-96cf-2957a5066557", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632300970, "uuid": "28a03eb0-a0b2-488b-9ec8-1ea8449dbe7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300970, "uuid": "024c50bd-cfcb-4ef8-99ae-1944a5e6eb71", "value": "Invoice Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b395c38c-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632289704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289704, "uuid": "233cf5cd-efea-4f22-8ab0-bb1ad76e769b", "comment": "Malware payload (Loki)", "value": "5148b92ac7f2cc1dd53f1ba66cdb42da", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289704, "uuid": "d798eeb6-d693-4f53-945e-986c37952d8a", "comment": "Malware payload (Loki)", "value": "391d3ecc4e2ae22ec344e4d89b856b900b4dacaf647679e004488a1ebb1b9e3d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289704, "uuid": "5d08adc4-a02b-49b6-971b-cec0492d0169", "comment": "Malware payload (Loki)", "value": "c6e7ba54727d6908eb937486f54666638d9ec1a8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289704, "uuid": "93be81a3-1b81-449b-9215-df3978410592", "comment": "Malware payload (Loki)", "value": "34cb2d50314c7d153f58730431f414bef5ef9228b6041621538aca7be9c0dea260b2db57cdff1d567ec17ccfe5a1ba2b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289704, "uuid": "340aaa2f-cd08-4e06-ae3c-7f7d0201aac1", "value": "T199D301207B9A89B7D5661BBA0D63C86DA936AD31C9CDCC47326E7F1171BB4480DA3122", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289704, "uuid": "a586bd70-8b1d-47a2-bd9a-4f92185654c5", "value": "3072:b9DfuynwqSB9G8Ik03dTVcsGCYWqk8v3IXogT92IVu:b9DfuoE9G8mdusGCYW35ndVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289704, "uuid": "c0b0d7e0-2fdf-4745-ad78-0b21d114ad4d", "value": 132552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289704, "uuid": "15be6fef-67de-4d4b-bd74-d2ce95ffe7c9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289704, "uuid": "7cc95a4c-37ba-4cc6-83c5-8d0302bacdd0", "value": "SOA Swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c859c70-1bc9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632331300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331300, "uuid": "b4703b7d-73a2-48d4-81a3-813f977e8f65", "comment": "Malware payload (AgentTesla)", "value": "e9d715a12d71471dd6f2c7909ce28c21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331300, "uuid": "5cdba2bf-7437-433c-aec3-af4b4e74368e", "comment": "Malware payload (AgentTesla)", "value": "396dab70cc7553c2735dfe9800ae9c745ccff49ce4adaa873406a397252cd5dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331300, "uuid": "917c664f-2650-444f-9834-d93f1bc5b940", "comment": "Malware payload (AgentTesla)", "value": "42e80f8d96cf281daeabea136d7a8e011808d45a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331300, "uuid": "c2ce5bf6-9fac-4db3-bfa0-e82feaca9e99", "comment": "Malware payload (AgentTesla)", "value": "eb42ebac7d49cd77d2eddf5559c95261f8ec4c9e5b3f1c101787f2a07e8520e648a452b6a122057d3db3db49d6bb8978", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331300, "uuid": "251c530d-4d7f-4d15-89a0-58ea871c8eb5", "value": "T19C6572394D2682F747EEC66CD08C1FCEEEA6A4877B915F1AC496D7C2025B70BE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331300, "uuid": "02695a45-f31b-4138-a785-fe94021f758d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331300, "uuid": "1685af91-9828-4b64-bede-d547057f8f54", "value": "24576:3Vy4TlqwJiAU+Ynj2pmHsOozQ+cmEcbYepsQa0PvLkZ:Fy4TlRiT+mapDOozbKcbjAqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632331300, "uuid": "63b620b7-4a3b-41a4-8335-c1f98cac7c8a", "value": 1508864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632331300, "uuid": "48719798-2624-475f-912d-c58124a76473", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331300, "uuid": "7a872527-e213-4c4c-a8f8-295b5ed8df00", "value": "DHL Tracking #_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13efb2ab-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316494, "uuid": "2e8d48cf-1771-4e98-9be5-64159b7d44b0", "comment": "Malware payload (Dridex)", "value": "7291bb9640986f29dbf9f6105667ed43", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316494, "uuid": "a4d0f05e-76c5-4487-a4c8-9a06bea9ea99", "comment": "Malware payload (Dridex)", "value": "3a62db4202e9fe399f00ec25f807b3a340ace017fcbb036927b96185c87b354e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316494, "uuid": "63a1970c-ba0a-46ba-8c3e-faf41ddb6b28", "comment": "Malware payload (Dridex)", "value": "92ee3a06d235d8e119666af4478e5b9dc491b49a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316494, "uuid": "3e52c871-a875-45e9-b949-279e829ab3ca", "comment": "Malware payload (Dridex)", "value": "aa1f59572641b7ec25c6e2d5c3197bc8759c514ae9ebbdbd94571295c0cfdf8eda3a08a92c51f252cfa7fab3b6ab4238", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316494, "uuid": "f67f008b-3219-47dd-b079-a2c1bf9b34c7", "value": "T1C6B5E020EF69E1E6C6B89F3ED408352727B93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316494, "uuid": "81965dd7-a594-446f-b146-5a42abd6c828", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316494, "uuid": "00bd0474-953c-48a5-894b-350cc4b05cd2", "value": "12288:qVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:3fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316494, "uuid": "0d26f02f-957e-4a3c-ac7d-c7cb66787ccd", "value": 2441216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316494, "uuid": "f4e33127-dbe3-4132-af49-9491868b519c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316494, "uuid": "9b019a0d-74cd-4892-be25-7394b1d69c89", "value": "3a62db4202e9fe399f00ec25f807b3a340ace017fcbb036927b96185c87b354e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5dbbb64-1b66-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632288956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632288956, "uuid": "5b0289d9-0062-40d0-8940-a4fa686125ff", "comment": "Malware payload (Formbook)", "value": "91c289b6bafeb905c1570042e9fe569f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632288956, "uuid": "6bd792f4-cda1-43a0-bcf2-82e8747a4d2b", "comment": "Malware payload (Formbook)", "value": "3ac2da7ec8b0c46550c9b85707c4743ea4cacbb5bb6ee0fd159792f3978e3ad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632288956, "uuid": "61876e9a-5c45-4f77-a5c8-c06ff878dd4e", "comment": "Malware payload (Formbook)", "value": "cddaea3c122eb47b03f5b12374682103de994fc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632288956, "uuid": "a0511e18-c193-425c-8e5c-3bf6a023ab6b", "comment": "Malware payload (Formbook)", "value": "e426d59efc46f6b54eb5179caa6f0eb63881a469ce365733657915e1722be66beff52d00aa9657876ede04933cb26666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632288956, "uuid": "3f915011-bacf-45e2-8e21-2a0cc43ee75a", "value": "T171441203F6D1D47BE1F20BB01AB5BE38F3768705416D4A178BB8EE9629768CE1706E50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632288956, "uuid": "608eb316-2210-4c32-8558-128400957627", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632288956, "uuid": "d224aa8d-314f-47f8-992d-7efc05d176a9", "value": "6144:b8LxBqm5559jJFez2P2EBrsIGJHAiVlE4/cqJ/dwKZ:nK55VXZBQVoqRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632288956, "uuid": "fb882f62-01d2-4e52-89d0-c9ade91c3dd3", "value": 270806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632288956, "uuid": "9b5fcdfa-4acd-42ae-aab3-afaf2b66d7a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632288956, "uuid": "9f664b5c-93a8-4f19-9d77-3596b5bb06b1", "value": "Quotation - Urgent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c21cba6-1b6c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632291141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291141, "uuid": "5662a3ba-8823-46db-82d5-08b3317c3575", "comment": "Malware payload (RemcosRAT)", "value": "a356ae7ed882abddd3b4ea1d6d83ce31", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291141, "uuid": "72a3870b-cf2e-4e25-82c0-0e145e8accba", "comment": "Malware payload (RemcosRAT)", "value": "3adc8cc746fa5471fe05f4b084ce21954c073d09a1f414a735b8c8ebaeeaf247", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291141, "uuid": "78057e9a-9e70-4e7e-8ce7-4cd84c5b369f", "comment": "Malware payload (RemcosRAT)", "value": "6d2b7cdfc674b7441e57beecf73660b97415dc83", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291141, "uuid": "eff8e2d2-7227-4f82-be03-536fa779dc07", "comment": "Malware payload (RemcosRAT)", "value": "286768d1cd899e358f934b91cf4045b1b7f334f48f32092a94473c05422dae62511f63d6804fa0179593580968141203", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291141, "uuid": "d45a3976-0b1a-4710-8c56-6c39cf5e7cfb", "value": "T17224237AC845FC409C2664354A374E2DF2DEEAAB956275091DE65C21DC2C8C3B9EC3C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291141, "uuid": "9c15144d-b75b-42e3-aa98-d6cbda4eb29e", "value": "6144:7mlxZeYLcT7npe+lwMAnbvrEMS7cK11KYTVjWibTkPipzCz:6l7eL8aonbvrtyTBj13Jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291141, "uuid": "fb6a586a-07a6-4f58-bbe1-1e8ed6185376", "value": 217425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291141, "uuid": "99a9d588-9747-47f1-a89b-871110d8accb", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291141, "uuid": "2b741361-1847-4f71-a067-e97797bb83c3", "value": "AW QUOTE 21505 HQ1-Scan-068703_PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33df174-1b82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632300844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300844, "uuid": "513d3d97-c6c8-4062-b585-85bf65c946b2", "comment": "Malware payload (RemcosRAT)", "value": "09a7253465cbb84acd5ccbe801144b6e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300844, "uuid": "ddf82389-b913-45bd-9fc9-8cfd53494766", "comment": "Malware payload (RemcosRAT)", "value": "3b103382dedb2748d8164a7ecccde2dee2e81a10b9672d88ce1a8160d4b92e7e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300844, "uuid": "47ccc261-97ba-4b28-aad9-f9587c2b71ee", "comment": "Malware payload (RemcosRAT)", "value": "1dcf16ed57ed7ed334c9c5bd47e45c1191bd07fc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300844, "uuid": "f93cf07b-561b-4113-ac0f-8f6868c06943", "comment": "Malware payload (RemcosRAT)", "value": "e166cd1fdee987627866eb04cbef5812e4fe135ded16473328246e10ee6094d0503e104972d3ed1346d76245eb66649e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300844, "uuid": "ccda5c53-aafc-4145-b90e-468cbc4a165d", "value": "T18E256DF57345D8F6DD14363EDA05B2A63201B7F12C531C88ADB83D8A56B9A94FB8C087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300844, "uuid": "8c449f12-6e15-4b5c-a4a6-e9aef83b2325", "value": "91a12f22e7f2305a107edddf42c40880", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300844, "uuid": "ad444aff-e354-4234-b6f3-e3c29d9df919", "value": "12288:MYeqaTWvI8UhU0EIp3Cx4Dt9eoAdrL7mSI:MYpa+qUH2y42rPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632300844, "uuid": "8efdaabf-591e-403d-abd7-e59fe0880c4f", "value": 1008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632300844, "uuid": "b66ec4c7-f1f6-462a-949d-65c6761ea2e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300844, "uuid": "250ddebc-4282-40d3-ba72-beeab8d028a2", "value": "INV.DHL202038658530 ,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbb3a7d-1bbf-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632326844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326844, "uuid": "a099b68b-40fc-4e20-8043-5d700ae6ea20", "comment": "Malware payload", "value": "597f01ce02ebeffe9c9b4a066bdbfbb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326844, "uuid": "3cd499ea-6d4f-4e97-ae82-bddbdd573830", "comment": "Malware payload", "value": "3b2cf351142e7a5b36f1c1c9850e797fd7ffe01cc017159022ef83d5118cf4bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326844, "uuid": "2cd9634f-5792-458a-b848-06d0592593ff", "comment": "Malware payload", "value": "ed2ae0c0c8f71b30842b9febf06a26172c66aa7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326844, "uuid": "4c136020-94de-4b15-ae2b-bddba0dbe14e", "comment": "Malware payload", "value": "eb97ff4f913eca9a5be015cbdf3079271e7e836340a9b52e50a1df5b8b9c93c3cdcd241812d688ca54f21aa031028113", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326844, "uuid": "3c236513-5aa7-4941-a7d8-d7fe8b7c95f7", "value": "T18955AE15F764C0B2C147417E8856C76AE772B8250B748BCBA7A04F6E9F233D1AD3A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326844, "uuid": "6785787a-1531-4885-b5df-c5c8e1870645", "value": "97684ed2b4bb5eb7f373577c0891222e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326844, "uuid": "1df2d4b0-2535-4955-81d3-9403ecfac9ae", "value": "24576:UZUwXfHfdrWqVn6tnFE2A8ZF6Qm+pKVGH9fcwDLMQG+i2XlR:Cf/RCGmdpKe9fc1F2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632326844, "uuid": "e6b20013-202b-4a73-9b98-bf9ab2d032cb", "value": 1315840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632326844, "uuid": "ef1335c6-3c40-4ec5-bebe-bd3d7d361749", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326844, "uuid": "d53afa4a-ec1e-426c-8c1b-63fe59e27dd0", "value": "597f01ce02ebeffe9c9b4a066bdbfbb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48cb6e1-1ba2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632314590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632314590, "uuid": "3fc1d53f-ba7a-4537-9a1f-adee934055cf", "comment": "Malware payload (Gafgyt)", "value": "9274a6f75406b14a3494df242ecb6c9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632314590, "uuid": "a2cf3439-4784-4716-8bcb-a5185ba71756", "comment": "Malware payload (Gafgyt)", "value": "3b34b4a650c334f8d50c4e1129fbc2991fb7a1232aa3e1a400ad30a1a97a168e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632314590, "uuid": "a5a135ba-23a0-4d7e-a7af-63a78d825221", "comment": "Malware payload (Gafgyt)", "value": "9b996931d66ed0bc4597394b8703616545e0683e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632314590, "uuid": "3eae4839-0d39-4ba2-8526-16cb0a190afc", "comment": "Malware payload (Gafgyt)", "value": "4cd37e1011b045827aa6e34eb1e30ee6c4bd4b74c90441c356b20dd51224b616c4655059a139a24183f442dbb32939ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632314590, "uuid": "bfc0039c-47cc-498e-9913-f859abdf887a", "value": "T150935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632314590, "uuid": "47609f7d-d3d8-4fbd-987c-d5a5378b6391", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3LyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKbifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632314590, "uuid": "d35b0620-f269-43e5-aa38-b22a8a4ba952", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632314590, "uuid": "ccc0795d-e28a-4c4f-9c21-c29f2eae5fe7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632314590, "uuid": "28c33a0f-f9e3-4373-a607-21e1576cea26", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85430882-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632334294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334294, "uuid": "07c34701-09c4-4dc3-97af-3f49b864cebe", "comment": "Malware payload (RemcosRAT)", "value": "7274d6c1a7dc0a091e1a801165f879cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334294, "uuid": "70a4559e-1e0b-4c02-8850-910f1509bbfd", "comment": "Malware payload (RemcosRAT)", "value": "3b5a4b0fe5b8f4fd9bf24f32712e69da23b412a5653e0042d23a1d2429c42379", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334294, "uuid": "3f156596-ac04-4204-8c6b-746a7cb43599", "comment": "Malware payload (RemcosRAT)", "value": "cc686677e1e22b71ef2b18559adb4c16aef11756", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334294, "uuid": "c949a3a0-1b46-4974-8cc1-2f8328749e5d", "comment": "Malware payload (RemcosRAT)", "value": "e246fe43d1d68160b2bba442c088dfdf252549dcb58c2a66f7e23b25ad8a5afa148429c2aad017480ca12fa4e7ecc7de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334294, "uuid": "aa3f61d9-d2d4-4956-9ead-eaf76dcf1186", "value": "T17A255C97A395D8F8ED38393EC94573566600BFF13C135C4CAD642A8B6AB8684FDC9087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334294, "uuid": "8156b1c5-40e3-4846-999e-413ea84c9e28", "value": "91a12f22e7f2305a107edddf42c40880", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334294, "uuid": "e79398f8-c24e-4180-865b-d0c6b88ecf1e", "value": "12288:FYfGUHuv5bSkBsFkT5m3GpOAz1yeoAdrL7i:FYOUUtBs2YqO8PrPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334294, "uuid": "9ac422e4-c6fc-4ffa-aaeb-d14d9433a8c0", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334294, "uuid": "39304e26-a418-41c9-9297-7152357a725d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334294, "uuid": "c080ab26-9791-407a-b9e0-026ac20c4323", "value": "7274d6c1a7dc0a091e1a801165f879cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9149d8-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316858, "uuid": "5e5d9aeb-e188-4533-b303-cc716ce936f9", "comment": "Malware payload (Stop)", "value": "5e025cb972cb13e4b87f3324eeb2fb80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316858, "uuid": "6cbcad44-710e-4798-819c-bef45b9be1b0", "comment": "Malware payload (Stop)", "value": "3c71f2d4d000810aeeaa5378811e1955947b9cdf3e8bc858159199d583a22825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316858, "uuid": "b30a6ed3-e73b-46e5-a907-2d375be1d690", "comment": "Malware payload (Stop)", "value": "2e41deba462fd9a4cd8868ea0f6a99684fdc533a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316858, "uuid": "18f72ff0-561e-45ad-8e71-1f0f0e22a5d4", "comment": "Malware payload (Stop)", "value": "2c1b56441d904901206fb08d36c318ed11f21829090dec8144ebfe0458899dfc840fab17c59584e6a47b68fe6f418641", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316858, "uuid": "ae206fd0-9cd8-4ced-af5d-3e9110d40b4b", "value": "T1F3F4120D78F0C572C57B15B15B369BA01B3AB8606974C7AB2A46376EAF313907F36390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316858, "uuid": "a1ec3ccb-34fa-4a76-8e8b-1a6532a23522", "value": "019bced73b51911db702af2d47c34cb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316858, "uuid": "fed7db0b-7ff3-487c-b54a-d67c25d375e2", "value": "12288:qbKLzqbULMLhweYnINB4KxGNm2spYmzQRr//N/yndCsWPTI3AyoBai:quLzGRinaGzspY46/V/GYbnzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316858, "uuid": "6c595ed6-1419-476b-9c3a-4493b5d12a57", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316858, "uuid": "ccd3817f-d281-4bd0-b0b1-f7ba8fbb7add", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316858, "uuid": "7f1e02f6-e877-4249-90b3-31f6408932d1", "value": "3c71f2d4d000810aeeaa5378811e1955947b9cdf3e8bc858159199d583a22825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b44a09-1be5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632343187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632343187, "uuid": "61011ba1-a569-4a76-b585-bb744a94e5f2", "comment": "Malware payload (njrat)", "value": "551330e77d1b9401269e4673d95f6f10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632343187, "uuid": "a2189906-8e86-456c-830c-a15a68e68755", "comment": "Malware payload (njrat)", "value": "3cd79c87dcd0f77d8c52dc53d3d35af64541cf9b82819b1020e8480797ba287a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632343187, "uuid": "90670048-08a9-4c8b-90c9-6fb8b7f6412d", "comment": "Malware payload (njrat)", "value": "747e8e091f9784ddfecd6fd4c84d25e372abb5ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632343187, "uuid": "dd50f3be-1c94-47f5-9bae-3d5c211457ff", "comment": "Malware payload (njrat)", "value": "c918aea665e7c99c33c53288253a45cff85db9f8fcd7cdd1dab762ca8dbd067a569d1fa345c87f8ef33699b28baa05be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632343187, "uuid": "118ab76e-c544-484e-b8a5-c81edaa6ba05", "value": "T13DD36C93335B2A22C0CE017680AB662253F5FAC7E1B7D74A7DC412B58E973C59A49F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632343187, "uuid": "152f6d5c-879e-4a65-ad5e-da0d06515b1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632343187, "uuid": "0edf5b8d-e01f-4fe7-a7d2-3f8d63576d0f", "value": "3072:FpXYi9b7Nqf7g6axINDyg2+qkFKl9STR/UXlI9:rj9b7EUx/toKl9STR/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632343187, "uuid": "d6634404-7ba2-4ec4-8051-f81dbb19486c", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632343187, "uuid": "38e7998a-876e-4835-a8ba-df9300c0ff1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632343187, "uuid": "4b1c9dfd-2a16-451e-89e9-8ea3597d630b", "value": "01_extracted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b242a7-1bf3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632349173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349173, "uuid": "39735be4-203b-41eb-989d-ddf2fbe1d77b", "comment": "Malware payload", "value": "81c4ffe02a85dcc9abae6f8b015aa5e0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349173, "uuid": "03784f62-4d19-41d7-a0f3-21c8d58e5e13", "comment": "Malware payload", "value": "3d08a779418ab9b22e24c236b97246033c919abc885c813551fe409b63421541", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349173, "uuid": "3fc02c11-ae4d-4391-9bb8-fbcd6e3cfd6d", "comment": "Malware payload", "value": "8e11e5bf2a468efaad5b1acf03782307064ff430", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349173, "uuid": "be7c6e8f-cb85-463d-9cfa-6984413fa909", "comment": "Malware payload", "value": "cddae093f8a68aec38d9df6667ab7f0d4b56fcab7645caa2f69f272823147b52637580561d191c2223af19f6048c858d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632349173, "uuid": "1fbd7fd2-03b3-4045-a44a-29e8018045c6", "value": "T1FEC4D52126A9C275CCD631F4912C76B161DEE6E2C36912C71A145FF6DEA03E09E386CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632349173, "uuid": "02024bf9-a66a-41e6-8bd1-96344354dc0d", "value": "1536:S2VcC6MtqWgV3vAFNJ3JXS9n5SYCR44u029R+J:QC6MtAAFNJ5XC5SYCi02r+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632349173, "uuid": "4c5e2f18-5d3b-4c6a-a64c-7000f0489f29", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632349173, "uuid": "f7701fd3-8e08-4bc6-8188-4e98e5e33fa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632349173, "uuid": "49a2b60d-6b72-40a6-88f1-477afb96a05d", "value": "Xertis.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7209c21b-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316652, "uuid": "86ac2063-893f-45b1-900d-5c7bc13e3b0c", "comment": "Malware payload (Dridex)", "value": "6f56e68f3e8da44430db6c3d7a83ef0c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316652, "uuid": "ec0ba623-47c7-42ba-a877-cb987fc4180e", "comment": "Malware payload (Dridex)", "value": "3d612052877952f38a77b9bc54dbc403eee0bce00bc651d08bd7defe23e654c4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316652, "uuid": "5a7f6b26-2b8f-4558-b857-4631421f4a65", "comment": "Malware payload (Dridex)", "value": "fef0df6c7c2bad4547b0c50df71c258be443d479", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316652, "uuid": "9f838342-4582-4575-9dcc-1ead1e1ce1ea", "comment": "Malware payload (Dridex)", "value": "7998d107c6f4234c1f6fe16296b5ece9f1f36613568f0e2517ca9bd7d2ca2fc2a397f825559756645df02577be4d7172", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316652, "uuid": "61ea1791-15ee-4ccd-98e6-c5712662faeb", "value": "T1F985E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316652, "uuid": "0347533b-4886-4c90-8235-703329d54ac3", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316652, "uuid": "a0e50160-ab75-4336-8b7d-3a6968e9e38d", "value": "12288:JVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ofP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316652, "uuid": "5a18565a-6ca1-4830-ba64-2fc5b9ef3963", "value": 1781760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316652, "uuid": "ba41d461-173e-45e0-89a2-0ef0456aa6ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316652, "uuid": "17648e38-f91f-431a-97a4-a1ca13e872d3", "value": "3d612052877952f38a77b9bc54dbc403eee0bce00bc651d08bd7defe23e654c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d275fcad-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632312519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312519, "uuid": "d438c053-6b8a-45ae-80cd-e8c976dc66f7", "comment": "Malware payload (Loki)", "value": "9000ef472fd736cbe2647e4bd891ad18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312519, "uuid": "455a2537-268b-44e2-94c0-3ec8e9d3c255", "comment": "Malware payload (Loki)", "value": "3e139cfc7cd85be516a7598cb955e9e526c0d8d992ec6eb5a56728521ca91a53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312519, "uuid": "0113ecd1-b2ba-4ecc-9043-2c59787eae46", "comment": "Malware payload (Loki)", "value": "a8fbd3b2c9dcd9162f0686f222500e8d3b15b844", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312519, "uuid": "5c8081fa-f7ef-4373-9af4-e8e520e6a6ae", "comment": "Malware payload (Loki)", "value": "112c34bfaf3f141dfd8faf499e2ec22f8d5879f659f041e67796530c41fec7278f2201d7074eb50d35bad4492b366494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312519, "uuid": "33b87aae-93ce-4bb2-a345-43b62d86d138", "value": "T1AE2539298D2682F7C7DEC63CD05C4BDEDA62AC877AA15F1DC495BB93127B60BE04805C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312519, "uuid": "83101dd2-3d28-4005-ac0d-aa5d36d5d919", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312519, "uuid": "0cc8864f-b373-41b5-bfb4-aedd8577a696", "value": "12288:4RyqyrrN15/kXwMwsIrMxBFpcu8rRJhy9P7r9r/+pppppppppppppppppppppppH:0y7J4wsNBbcu8rRJh+1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312519, "uuid": "82e751ee-5837-4f18-83d5-86e9b99b3e76", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312519, "uuid": "9cc554cf-72b4-4c83-8c84-d0d991851a52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312519, "uuid": "425dc0fa-d49d-41c9-bf73-e02be7f5372d", "value": "9000ef472fd736cbe2647e4bd891ad18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c08b0cf-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Osiris)", "timestamp": 1632316938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316938, "uuid": "74c16e5c-c72b-4683-93f2-60ac984929ce", "comment": "Malware payload (Osiris)", "value": "7e8b9cf70707293f8950b2151a3c16f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316938, "uuid": "dfc03d85-6044-4e69-b6c0-fc23ec1f9755", "comment": "Malware payload (Osiris)", "value": "3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316938, "uuid": "c102674c-181e-426f-943c-478b14559b76", "comment": "Malware payload (Osiris)", "value": "c925e491311dc75e2c8a7c05d7deb608c95b4e51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316938, "uuid": "5eaf940f-cbed-4926-b569-d35a73631fd2", "comment": "Malware payload (Osiris)", "value": "6822845583a570fd4ac6b561e094ea84dee4a36a5d4723c84ab9bb6f4faca250b7d00c6577d629486ba120b982677905", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316938, "uuid": "1507344d-2008-40ee-af14-dd63194d374c", "value": "T138C41216FB4FD873C6AA4872CC5D17788445EFA49BB7B88736887F8E16B23E14721904", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316938, "uuid": "01f6b563-16c8-4e99-acc6-4f4dc32ce91b", "value": "174266963e9a11ce6878050b21579fcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316938, "uuid": "e269bbde-4a9a-4c47-ade5-403541035183", "value": "12288:Bz4ubZCXMtdUKat+YH7/yJ2je3rojGvB/WaEYvW0:pjOMtd1a/yl3KOjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316938, "uuid": "e25d0a92-c9af-4a6b-93e9-c3a2818e8c14", "value": 579589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316938, "uuid": "0047ea5c-57ee-4d7e-8768-7d45d939f015", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316938, "uuid": "235f30ed-1a29-4f1b-9a7a-862dbbe98b75", "value": "3e6612264ae84cddf04379c1a1df09197cbf88f9103c825457c837fcdef69887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b1d1b8-1bc3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632328842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328842, "uuid": "9a4886b2-cccc-42a8-9368-246d410fe373", "comment": "Malware payload (Formbook)", "value": "1f20821a142f93fac5153746b902b166", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328842, "uuid": "178315fd-9108-450f-b19b-c0d5d6a5ceea", "comment": "Malware payload (Formbook)", "value": "3eb7d51b8bc7bca27400be167b265335d205e8936312d1b33c2c3dab04385d15", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328842, "uuid": "d64781e3-5931-4694-ac95-9022ef2e2959", "comment": "Malware payload (Formbook)", "value": "c111910378b25573ed386bbdedd160efe0c441d1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328842, "uuid": "89d48fa7-7510-442b-bb99-e111e3d48262", "comment": "Malware payload (Formbook)", "value": "e6f1182ec2c2cb8672f97a2a1e086c801e130e24c1afc3dfe85d1d9b7ced80cc63cfaf9ea9aa299039048996748d13db", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328842, "uuid": "fa710df1-56ea-4b4a-9e05-9805eddcbb53", "value": "T1D55230BCC46702988F8AA7B82B2B6F41118C7A6DF794E172357CA73567D1D3A402387D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328842, "uuid": "69f8bc9b-82d1-4fd2-ab12-e0bf7cbe9243", "value": "384:6a+WlEja52fCK8Ly2LbQyh9uDgCJbndtlcsW3P:6nk2kfMguDjddY3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632328842, "uuid": "2fab38e0-d235-452b-b5db-ee081da270bd", "value": 14375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632328842, "uuid": "31e67366-5a93-4403-bc81-9f8326dea91d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328842, "uuid": "415f1859-ab56-45bf-b078-e860dd7f633a", "value": "Abn order 55.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c13315f-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632316240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316240, "uuid": "a262a78f-7063-4c9d-ba9a-9f86bf163685", "comment": "Malware payload (Gafgyt)", "value": "6845f70fffaf1dc20afc318057169769", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316240, "uuid": "0e2b8aa3-2e52-4445-9412-31a6f13e36f6", "comment": "Malware payload (Gafgyt)", "value": "3f168e5f8aa5f613babd8a8afb0af00ddc4fa19ef643805053936ff560cd8a4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316240, "uuid": "373e0e03-79f0-44fd-bcee-bad460987d37", "comment": "Malware payload (Gafgyt)", "value": "60cdeaba8fb6db0dd9fdab33352339369d5b08a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316240, "uuid": "7a97a85c-a22a-432a-aace-9d9240d85228", "comment": "Malware payload (Gafgyt)", "value": "476e6d6138e14412070663b3e22c9c7cdd4cd690d41a018f7c6f915d0795b60c4809956c102de6fd7026e4f17cf4024f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316240, "uuid": "2a55588b-ba8e-4b03-90a3-47da2d52432a", "value": "T1C9C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316240, "uuid": "8a0a909c-3230-44b8-b8ca-155ec8291afa", "value": "3072:ekYPUfsgnsb0J2ag/Vf+kDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0+kDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316240, "uuid": "928902da-8ef1-445c-9cb9-160938601ac2", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316240, "uuid": "9b7a141c-2bd1-498c-b246-6d197f9a0742", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316240, "uuid": "a02de443-332e-42b3-ba0d-1f4a0d1fdef1", "value": "6845f70fffaf1dc20afc318057169769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15174d59-1be8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344414, "uuid": "8de53506-d6ef-4308-b382-4854c7c972ca", "comment": "Malware payload", "value": "9c99af2b37d214f1bb542a1443827f80", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344414, "uuid": "fa4df4cb-fbc4-496c-8a6e-374ba7636754", "comment": "Malware payload", "value": "3f50acb405343eae59b77cb80db34876068c55739100d5bf9531c646f07784b3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344414, "uuid": "4fe9694c-0f74-49b5-a48b-d743a85d989b", "comment": "Malware payload", "value": "d6f69277464f05ad1eb4930a7877eaf65765077d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344414, "uuid": "c2aef6bc-6a27-4e4f-914f-083bbafd2e48", "comment": "Malware payload", "value": "724d780dc146933afb2cce6eb17f9f2a9d78cae925345684ae09ad593589c59f8eafd971434ca158c1e56245646f1586", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344414, "uuid": "2efebdff-8dba-437e-9b27-6516972e1c8f", "value": "T1A345339AFD4BED3BD58F2EF3CB6241D2F36280221B489F2B696058537167902558CD7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344414, "uuid": "70d9d6f5-dc83-4973-8168-81f05f1f8651", "value": "24576:2WeLt3Q3dDqYPMqs8LpC4SHhTD4DKiz7epuJY991mGEdzBj:2WeLt3+dGsxLL0k+Aepu5vx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344414, "uuid": "e70128c1-c3bd-4170-9005-0922626527e8", "value": 1172497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344414, "uuid": "f5b40b49-d1c1-46e9-99c5-9035bf2cd995", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344414, "uuid": "dd573bac-933f-4b1c-a782-a11b37e319ca", "value": "\u90a3\u4e9b\u88ab\u83f2\u5f8b\u5bbeHR\u5f53\u732a\u4ed4\u5356\u7684\u5973\u5b69\u5b50\u4eec.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc7c420-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tinba)", "timestamp": 1632316912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316912, "uuid": "17235ee4-524b-4fbd-af3e-0e53444ecbbb", "comment": "Malware payload (Tinba)", "value": "4bd9ba16ac4409714dd196183e8d385f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316912, "uuid": "69325467-0941-443f-9751-8a64904c01d6", "comment": "Malware payload (Tinba)", "value": "3f6f25079be5e1c095862f350252e3cbdbeb16df476d1e7e2396a10448738650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316912, "uuid": "229cc38e-738d-45ad-b131-06ebc9a81f6f", "comment": "Malware payload (Tinba)", "value": "2e26c9e65acbf7adc11b9de1757f59990ff3aa35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316912, "uuid": "e48cb7ea-a91b-4cca-ae5e-73f5757950ed", "comment": "Malware payload (Tinba)", "value": "247b4a9e579e30803968cb6a8e95b3f99701afe4bba38e8f567472d8ac0cb3c968f52ed31453c9f5a2502cb258e108c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316912, "uuid": "acc21929-cbbe-4b3e-9fa5-8ba819577751", "value": "T160D44B276595E1B6E4B26CF2164BA3725175AF701714C243B22C3B5EAB702D2EE243CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316912, "uuid": "ada4757f-c378-4ca2-96e0-412981054a9d", "value": "d0faf1f829379ff4f83833223a663610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316912, "uuid": "64568aee-c7a5-4254-8ee8-5518dde33447", "value": "6144:jCE6/mUXJ531nIUliViSZbLhaZfvMlLXICg2vj7OyzWxzRazUE1K52u8iqUNr6:d6TOUMBQf0ljW2vj7OyzoRaA+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316912, "uuid": "11bd97bc-b9e3-4fc7-8283-d122eebb442c", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316912, "uuid": "fe9901a8-ac48-410b-87d3-f3b421bace92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316912, "uuid": "713d1c58-d8fe-4f88-9ef2-c6cb1b3c8d80", "value": "3f6f25079be5e1c095862f350252e3cbdbeb16df476d1e7e2396a10448738650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a496625d-1b9c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632312013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312013, "uuid": "c4138661-41c1-4031-aa52-94279cf4fc0d", "comment": "Malware payload (AgentTesla)", "value": "527458a20d961c482beb38ed150aeea5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312013, "uuid": "7f1bc507-3299-4ab2-ad0a-f6d7894ac60e", "comment": "Malware payload (AgentTesla)", "value": "4060abf7b75e024090fbd2cb937a60f50698334db53a04f3d82a96bbdd823719", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312013, "uuid": "fea70f23-5ee0-474d-bb48-9962b134af57", "comment": "Malware payload (AgentTesla)", "value": "4000f60e019475ea15549b8c3cad2bf99db81e3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312013, "uuid": "5c697b59-e5f1-4c97-90e8-1275c7db2c82", "comment": "Malware payload (AgentTesla)", "value": "fc200791ee9d88e35a4745b9a85a47967564d94514e73b01f34fa39ab30666d6d07e17f8ada3ab2fb24c9bfed7818bf9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312013, "uuid": "a7394037-3f76-4e0e-a6b3-91acb35776ef", "value": "T16E4253ACC46B02988F8567B82B2BDF8511DD7A6EF3845532353CA7361BD1E7A511383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312013, "uuid": "60610b13-e1fc-497c-93d4-d19f7be0183e", "value": "192:2jhWjr7zSXrG70p6ccLwBrtWs47OZDM36DiFy3tQr1NMmY8t/TLn02ghYk:2dyuXrg08cqErtz493IiFy36RNMY/PnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312013, "uuid": "7153fe4c-aebb-44b6-865a-52f51951929a", "value": 12158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312013, "uuid": "70bde1d0-0239-455b-8c1e-ec53e7c1a21a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312013, "uuid": "ab20d2f6-61af-4356-8f91-5b03d91faa3e", "value": "SWIFT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980addca-1b42-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632273337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632273337, "uuid": "bd2da7eb-a382-46b9-b84c-bd044ca543be", "comment": "Malware payload (RaccoonStealer)", "value": "a92ecf7fef1451c1ebd6f7886a9e22d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632273337, "uuid": "412e5c35-7f38-4f76-992e-1e4bcb3d01c1", "comment": "Malware payload (RaccoonStealer)", "value": "40f4f7b3233351e4885a1758cd4eb0981dc5361aa7a354a981ed3ed6363f53ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632273337, "uuid": "e553b801-45f8-4444-b987-3fbdf4dbe48e", "comment": "Malware payload (RaccoonStealer)", "value": "271776d22bb408f5ac2c1c375f116f0cfe5315cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632273337, "uuid": "2b777360-33fe-4a3f-96bb-a2fa122e764c", "comment": "Malware payload (RaccoonStealer)", "value": "d5b84535dad0c3006d4fe9832005415c413125af488d13152f8d1f6fcd6218815498398073aa95644841ade5f23ec8b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632273337, "uuid": "cf00ae01-4445-4af1-b048-b1b5fffdc79c", "value": "T14645223AC64A8462E84A117ABC5BCC752AB4BC35C6F24C79F5D4F97FA2B5342006D21F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632273337, "uuid": "3b66a0e4-2cfc-4a72-9768-8cfc5cf1cfca", "value": "4f0265512a1363fc11fe0c410b950baf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632273337, "uuid": "91f61b2d-a67e-4f62-afea-fd42d2af6c7c", "value": "24576:GnrOChfE476dtiw8t+cZHlcBIfej4gRgq16CeRrLs1/cLG4pNdWgWu33Mqz2:GrOC9EEOixtjSBWeMgt6CeRk1/cLG4p3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632273337, "uuid": "9a521f0b-b89f-4e72-aeae-55b3dbeea487", "value": 1265152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632273337, "uuid": "4b78c0c0-d4b4-4832-8922-347eb28c8e10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632273337, "uuid": "37ed9e7c-717b-4109-b420-5ed83d2e7280", "value": "a92ecf7fef1451c1ebd6f7886a9e22d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c211a649-1ba0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632313780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313780, "uuid": "abcb690a-e291-4c45-93bb-04a52245dd3d", "comment": "Malware payload (Formbook)", "value": "55552a34489fa2cf62cac5667e17cd45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313780, "uuid": "608018f6-488e-4c27-9629-1994374e885b", "comment": "Malware payload (Formbook)", "value": "410659d6e76a955d58e88df12ffea3550a57758513630f051c6e66caa343fdad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313780, "uuid": "9b5d9f4a-b580-4304-9976-878a793e9770", "comment": "Malware payload (Formbook)", "value": "0292df2a71fbeed972ad72e29d42c4fd71469372", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313780, "uuid": "85f4335f-fc1f-4fc5-9d81-4bb5b5b19489", "comment": "Malware payload (Formbook)", "value": "931b37c0e2c19e603b3694d121babce31fd10abc1c41e693d42042fd169a39dc30675fa9dc9f40406ddc99ab07dda4ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313780, "uuid": "d2fae70d-1d1f-4f7b-85a6-39e23278796b", "value": "T1B1F48BC49D895603D7A44672DC5D664A32681C0A3723838BCBE53DB73EFE6C3C22D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313780, "uuid": "231feaba-2f68-4adc-8685-849ae4497ccf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313780, "uuid": "738c8748-64d2-4b2e-8c47-d6035b560c6f", "value": "12288:NLmtiK5oIln2dvqDKTEupvkQivRAPBxRNi/IcJoe3K+ydTh0k:d+FoIl2A2TfBkWPzRA/Iy3yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632313780, "uuid": "f0b7c9bc-4b21-45b0-affa-b8819d37ae52", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632313780, "uuid": "4fde036b-348a-4595-b433-3ec587268858", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313780, "uuid": "61ffb6b6-8c82-49fa-b0eb-209d0238d4de", "value": "Amended SO of 2000KVA400KVA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeaff687-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632316754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316754, "uuid": "95b62ec6-ac05-4d1a-a6cf-8aa252380d75", "comment": "Malware payload (njrat)", "value": "dd50c188aabc9e550fc221de015ddb55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316754, "uuid": "c26aa271-4539-4d58-83b4-2149f19361bd", "comment": "Malware payload (njrat)", "value": "424b1800061eb3534756eada61219882687a8f99d206d300ba7e4696066aaac8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316754, "uuid": "b1a4d74a-ad8e-48bb-9991-2a3d6fbb4265", "comment": "Malware payload (njrat)", "value": "068aa881159f72c4454f44f32fb754fc5b88f688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316754, "uuid": "cff9a10f-5248-4513-9748-db061c95b9a4", "comment": "Malware payload (njrat)", "value": "f0605ce5d0da152a8f84225307dcc6c5996588178ce273e9944a04e31a7db6f2a74a3dd78756695981da8734559a6825", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316754, "uuid": "58755be4-63ed-4710-9047-20036788bdf3", "value": "T186259D02B3D5C076FFABA2739F69B24256BC6D250133842F13982DB9BD711B1127E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316754, "uuid": "7829d87c-a479-41aa-9df8-dfa2893c37fb", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316754, "uuid": "ca5e608d-9dc2-42e5-9b2d-3a525dc49504", "value": "24576:uAHnh+eWsN3skA4RV1Hom2KXMmHay5uertmY3Z5T:Zh+ZkldoPK8YayGYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316754, "uuid": "e5e79222-4b67-4b6f-8e6b-ad6caee436c8", "value": 1033768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316754, "uuid": "83b11387-3c12-481f-ad35-77ea5d35a7af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316754, "uuid": "8b8f55ef-c5eb-42b3-8bc4-8ce9e52f772c", "value": "424b1800061eb3534756eada61219882687a8f99d206d300ba7e4696066aaac8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3ba07e-1bc2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632328187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328187, "uuid": "a4268c8e-d692-4593-ae5e-eaf6b179c0fc", "comment": "Malware payload (AgentTesla)", "value": "662177de85cee09f915ca635c889e174", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328187, "uuid": "fd99efb6-633a-4a5f-90c4-625334d1c667", "comment": "Malware payload (AgentTesla)", "value": "45170524af54ad26729139fb76a9da5c7e356c536ef4b195a9d785c2d60b8538", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328187, "uuid": "af679b91-159d-4efc-8030-8822702ecf13", "comment": "Malware payload (AgentTesla)", "value": "169cb65bed175822aa36c3f829c0252af055fa67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328187, "uuid": "3efa2ab9-9678-4fa4-9e33-01f2fa89bf2f", "comment": "Malware payload (AgentTesla)", "value": "ab8fe7eddf565df64dbb67dfef88d2e1b434ff13fc5d7e460ce3fa3aae22846feec98dc40e909cae2f033bf8138e1ac7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328187, "uuid": "f33fce8f-e6d6-4baa-becb-5201d149fc4f", "value": "T11E255A298D2682F7C7DEC63CD05C4BDEDA62AC877AA15F1DC495BB83127B60BE04845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328187, "uuid": "d3fae2c5-0fb7-4440-bcb1-ad1eeaff8af3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328187, "uuid": "d6ac91a6-2085-4455-be1f-fef453bab8e8", "value": "12288:gllPGcvxSu9WaQSHbiDAnlkoE6yZKXP7r9r/+ppppppppppppppppppppppppppx:gHPNS6QSHhlmxkX1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632328187, "uuid": "c4cbb564-f7f7-4db2-84e1-8062d43eb655", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632328187, "uuid": "8216f849-e2c5-454b-b5cc-3381fc9beb37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328187, "uuid": "75b3cf85-17f1-42b8-99fb-e226167f67f9", "value": "PROFOMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1be65ae-1b96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632309431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632309431, "uuid": "07e6f288-005a-47c6-9401-e101c1963a3a", "comment": "Malware payload (AgentTesla)", "value": "5bb4ba7a4cd613f552edc1830606d55d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632309431, "uuid": "5d481d0c-36b6-472e-9bac-d5f0977fdb7f", "comment": "Malware payload (AgentTesla)", "value": "4541c2877fc9c83ea79a96a3891230c3502089583e0727953edfd6dfa3c9f8af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632309431, "uuid": "dcae8800-d190-4275-9d0d-89a17f011cd5", "comment": "Malware payload (AgentTesla)", "value": "5cb2db60bfa61384e43b9f2a6c93c4819e78d17b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632309431, "uuid": "cfbd7019-aa3b-447b-b13e-0ad407c21922", "comment": "Malware payload (AgentTesla)", "value": "1971a4f4a3903bea00447d8b2689497eb8ad5577fca6dda531ccea3f8bc751654ff26bd17600c47cb54e40b5cec0b5b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632309431, "uuid": "3c439b99-d032-4fbc-a03f-807ea34d17dd", "value": "T1C9C423389AB8D3B8CA8E873D50E254D60F75518E3912E527DF43B08A7D6A7738029C77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632309431, "uuid": "4664b505-64ea-4439-802a-2ca489eb7a50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632309431, "uuid": "75e3ddef-fca6-403b-a639-808e84eb0bbe", "value": "12288:RNY1mtiK5oBTn5tfuKp7/apK12EczvyS30hD8:2+FoBTnWKp7iycbyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632309431, "uuid": "be1349f8-3d73-4fdb-8274-7f0789ed2f6f", "value": 586240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632309431, "uuid": "a21900e9-7108-45bf-89aa-8716bc190e61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632309431, "uuid": "93afe298-16f3-48c0-b7ce-6f12e4de6639", "value": "RQF #22209210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901a23a3-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Osiris)", "timestamp": 1632316703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316703, "uuid": "7d9055d0-c93c-4cc2-8116-8872bb52c35f", "comment": "Malware payload (Osiris)", "value": "9d06f72aeb10616c07e774187dfdce95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316703, "uuid": "fcb4d6d3-8b79-4bc1-8100-4e8eb39f3514", "comment": "Malware payload (Osiris)", "value": "45b8f4130d70db6e59cc17cae406798f5e40f97f460caf032d59b2a1715ec33c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316703, "uuid": "62f1ebc8-9584-4fc7-b906-b0b0a6a4f9f1", "comment": "Malware payload (Osiris)", "value": "9c71200fd05f22fa12971c0ad4232d4fc169430d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316703, "uuid": "ca9954f4-975f-4747-a5d5-aaa628dc5e3c", "comment": "Malware payload (Osiris)", "value": "c18af8dd78e39d3f176e5fc9fa32aa769b26388bb06025c4e1b39206d4cea025d0f759dbc0b3582adcaa8bab1750ab36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316703, "uuid": "9de297e0-651e-48df-8f5a-2064edceb621", "value": "T13055C026F6D08437C163263C8C5B57649839BE503D297C462AF91E4CDF39BC13A7A2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316703, "uuid": "9775bf91-a676-448b-98c6-9ce40e7a8aac", "value": "e9ee54cc14ff2b781a4098b903b56f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316703, "uuid": "5d3397c8-4796-4b7d-a379-373b0856f0e5", "value": "12288:u+rq0yKJ7KZeBA4DVzlzEyn2QFqTjCAjkTnV/QH7OTzId2nfpN3fXb:FW0yreAkpzP/QCAjkTmbOwYRZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316703, "uuid": "184ab98d-cb9c-418b-baa6-15dfffb85743", "value": 1309194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316703, "uuid": "878c0685-498a-4de3-8ef2-6e72095c61ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316703, "uuid": "00787b34-b925-4e66-86f6-2e5a788b9e59", "value": "45b8f4130d70db6e59cc17cae406798f5e40f97f460caf032d59b2a1715ec33c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311f6c78-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632289485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289485, "uuid": "73556305-1798-4681-9b3c-e1ddb04979cc", "comment": "Malware payload (AgentTesla)", "value": "ce0ecdff71a09264656f0c1bd8e16042", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289485, "uuid": "ce73a0f1-a419-44b8-92e8-c35c4ce1bd65", "comment": "Malware payload (AgentTesla)", "value": "479a22f7d237f106a309d15b940df13eaba43c1a13bde3e99e85d493b5cfba75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289485, "uuid": "55e1cc7c-45fd-4914-b8ea-c39bc23c0de3", "comment": "Malware payload (AgentTesla)", "value": "6a03b304f61e11f58fb924f1b09bfdb2889f712f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289485, "uuid": "006254c2-ccee-4b24-b292-11e8bf226e5b", "comment": "Malware payload (AgentTesla)", "value": "4ba901ffb55ab11ff1e32d7d18720b76f5ea4141a65d92b5c0c56be7b71fe01bae87569e163dc6147d9e3e0241bea607", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289485, "uuid": "bfa09526-6826-42e3-a1df-b1e1d112d799", "value": "T1A264124DE9C0D9B3F5A289B186B33F76E3BE4358815298438B783E7878728D6535EC11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289485, "uuid": "75357d2d-fedb-447e-9e16-8b21e3132a3e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289485, "uuid": "05ae9cb4-2c84-4c86-9065-57d7ba1aa6ef", "value": "6144:b8LxBqUdQEVgNgs4U7EdCqGBcUgYqrtz/e4lWVxP8w+wiuiaUoCwNdfLRLL6LKUx:nUdQEy2ZC7GVYqrtbe9xz+sUojfNmKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289485, "uuid": "c6ab7765-cc1b-4c33-866f-8bd06d824c2d", "value": 320357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289485, "uuid": "caae1c2a-5958-4799-8ac1-683996c348fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289485, "uuid": "b82f0605-0545-42bf-ad79-bf0fc2b0bde6", "value": "76543456887545.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dddf2b4a-1ba5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632315974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315974, "uuid": "a5aad950-9928-4269-9ee9-4858695f7c75", "comment": "Malware payload (Gafgyt)", "value": "2240da867222a7d21503d6afffd6c962", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315974, "uuid": "7bc6657a-8dff-4559-882f-9325fc79c770", "comment": "Malware payload (Gafgyt)", "value": "484139799c910c4caadf4b6a26c81052143ab93f84f974029f25c03b3a255a6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315974, "uuid": "44a92856-7be8-4476-a282-f58fce77a7bd", "comment": "Malware payload (Gafgyt)", "value": "281f785b791d19301a84f2f37a05d5389704d914", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315974, "uuid": "a5fab956-e497-4785-b730-e0666b45982a", "comment": "Malware payload (Gafgyt)", "value": "6117ffecdf88a1db06b80b9155aa8442b92b586b5b154b0e74e94e4b1a4766ae6a2e720389e5ee67156731024fbf430a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315974, "uuid": "a1b5cc28-5659-4dc2-84b2-42f09b20377e", "value": "T18C933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315974, "uuid": "5366d3aa-be6e-4268-ab39-6be4be10cd5c", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+81l4umXxVqDrstKfz9e:Q97vk51RcG7ATl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632315974, "uuid": "4ecf67ec-77ec-4f06-bb57-db1348209d34", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632315974, "uuid": "d8e0f00e-3f2c-4ad8-b79e-b902eb2b09dd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315974, "uuid": "09fde953-19ef-46c8-aee3-2f71b3d3cf9b", "value": "2240da867222a7d21503d6afffd6c962", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bcd583d-1bb1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632320991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320991, "uuid": "b67f6ef6-f701-4e89-ac76-cfefc7807a9f", "comment": "Malware payload (Dridex)", "value": "80facba257fc754e9942ec11c3469ef9", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320991, "uuid": "303e18d4-5c03-4b48-a20d-b7d103ae69a5", "comment": "Malware payload (Dridex)", "value": "490d39baa28c8c1b12c44522ab883bee0a5fd8c0e8afe22e2d9499fabe16bf2f", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320991, "uuid": "371c02f7-5bc2-4f0d-be16-578434ebf842", "comment": "Malware payload (Dridex)", "value": "73d282bedb0ebe482c33cef2d105bedc3d4bdf12", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320991, "uuid": "ff3d9587-fcfc-4b32-8b94-b93915d4bd1c", "comment": "Malware payload (Dridex)", "value": "ee818cc7dd194d6e128ba9d0636300a66066397159a1181473026b8a354130d1643e5c30ec7ecd8be63c9ceab6169e08", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320991, "uuid": "bae51af9-8a3d-4883-abf7-9ec3fb88af01", "value": "T1CD14D0D3DFBE82B5F1A67A790830BE39242D6741CB84E567F2D9CA908171521F02EE35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320991, "uuid": "488da48f-d3f8-48dc-ae03-789e29e33d88", "value": "7ccd6f40a9c36cae6c541b1ce3dcb8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320991, "uuid": "4e5ff009-ae5a-4765-86b3-473cd041e4aa", "value": "3072:IglCoxtHaw2NiohdCKwP/LXHiIDLSKsytAKPypyCRbXy1Vee1/TpzXAljIK:IglCyt6Jrdf6XH9dJtByI6Ve1LpEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632320991, "uuid": "b4e3801e-66db-4e08-924e-0c4e05951196", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632320991, "uuid": "ef34a093-84d5-40f4-8bd3-7026ed571117", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320991, "uuid": "8e23351f-4a9a-494c-9b55-03f549dcf569", "value": "3_System.Net.Http.dll.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406898ed-1ba9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632317428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317428, "uuid": "af023b28-a928-4358-90e5-b0e70afafe12", "comment": "Malware payload (AsyncRAT)", "value": "fe281b06394f909456bf3442b3c7242c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317428, "uuid": "ce9deab5-3baa-400d-9665-1c13561079f1", "comment": "Malware payload (AsyncRAT)", "value": "4961a419cdbf4653eface4b509ca87f906a4306b7565c42a1eec521a314a7be3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317428, "uuid": "59d9a1cc-87d5-4fdd-af7d-07eb9eaadcf3", "comment": "Malware payload (AsyncRAT)", "value": "7094d4df23e24cbfc67482a3ba79d89aa5241fd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317428, "uuid": "28680f99-1311-4904-85e8-4894aff1869e", "comment": "Malware payload (AsyncRAT)", "value": "4f8feb86bf0511ce1bea015b918e05f92fbb1fbe03208c68db3db0addb514c1924d9f1b472e824554c11dab7078169e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317428, "uuid": "423257f0-1dc1-4416-bcf2-28482b51039f", "value": "T1A0B4603C55285AADF7A484BCB5709CFF27946C2F88A7B8F7D90CF99706B97D14102222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317428, "uuid": "3d4442a7-f713-4d99-94c7-c3d588261940", "value": "63b82f4e52bdc0ca36b88701c436108d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317428, "uuid": "10dedd12-b474-475a-9413-d234be592748", "value": "6144:xDP1+5FOqkHOBUBk5vpekSz3RJnY0eGtGnY0eGtnVKiEgY8jc5J8:XEO2OYzW3RJnYxGtGnYxGtnpEcAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317428, "uuid": "b3dee26e-cda6-47fe-a94a-585adbb02b25", "value": 517568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317428, "uuid": "e6eab12c-b4d5-4ed8-a04a-3bdbfd4ef941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317428, "uuid": "80c43bf9-d35a-4440-a9ac-8b2f2285ce06", "value": "fe281b06394f909456bf3442b3c7242c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75449dde-1b76-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632295612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295612, "uuid": "ed68d9f4-a738-404d-9a80-b57d4432d8d3", "comment": "Malware payload (RedLineStealer)", "value": "8db72b47d0e9b71bd08f6adf47818291", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295612, "uuid": "ea0bc377-fd84-4fd5-a2f9-7bcd93e0b2b8", "comment": "Malware payload (RedLineStealer)", "value": "497cf5588ab1e6fe25e37346d688a9f3a5aac924a384aab4bb0e4899b049bfc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295612, "uuid": "8c9f46d2-0adb-4312-9b70-25d9fa572603", "comment": "Malware payload (RedLineStealer)", "value": "8c42bb949161337b6bf3f21bb31183f1d090a7aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295612, "uuid": "d6d6c329-e153-459b-a6f9-97826ddadad0", "comment": "Malware payload (RedLineStealer)", "value": "a891f9d1c44fd957ac3a0d6c4672ee743eb01215b8970c62b7814edf7c025d34b8df2c903f2d21aa1d8ac2e2ccdf10db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295612, "uuid": "8f0699fc-7977-432a-99f5-1c189f6dcacf", "value": "T146E5222B02157684DF8D4E37862276B52861EE9E3A4095386073F6BE4A797C73D0738F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295612, "uuid": "c9bf1eee-0f49-4891-8956-b59a706858c1", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295612, "uuid": "ee8c8482-4649-4725-91a9-2e2a66ecf738", "value": "98304:g209YD7r72Bs+oKTXAQ2liHfk4+eCUifpck:cYD7Wu+oKTXp2gJ7ifSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632295612, "uuid": "52aa707f-bbfe-45ef-9f38-c7ec33082db6", "value": 3229896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632295612, "uuid": "185408bb-f539-4499-93a6-305a6a974f01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295612, "uuid": "350ffa62-2592-406a-94dd-18398392bc02", "value": "8db72b47d0e9b71bd08f6adf47818291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163c0b47-1b3e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (YoungLotus)", "timestamp": 1632271401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271401, "uuid": "3572331b-9b12-4667-887d-6e3a5a5d6a81", "comment": "Malware payload (YoungLotus)", "value": "03425c5250ee08fdc2c040625cf81459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271401, "uuid": "4c90f0b3-d332-4c5a-8be4-52447be6ae2d", "comment": "Malware payload (YoungLotus)", "value": "4b008912e8e53602f958522a55f7dca2c32b98d5793e417d50a56506f738802d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271401, "uuid": "7b1b3ed3-ec66-446c-ae0d-14679d2e7196", "comment": "Malware payload (YoungLotus)", "value": "56a7fdedebe3ec7822155b1925b43046500b9fbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271401, "uuid": "fb118cf4-4304-4221-a979-1d2946bf5180", "comment": "Malware payload (YoungLotus)", "value": "519e909f22add00f02fc78858c7db089cacc7f7d80cb4ca95b7f2096bd3bfa6a958f5009ec4f42a2ebfdcd746e9fce2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271401, "uuid": "9f2088d3-eba8-45d7-bb73-b799fe53e964", "value": "T1CCB44A417A4F80A1F7690F34469E227692626C7A460C95B263B4FF5D14F32ACED13ECE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271401, "uuid": "08d9b3b4-a4eb-4481-ab42-7c83a9ae572d", "value": "05170c3952c47a73573887e0f56a9cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271401, "uuid": "8c7ef762-26ee-4c10-9b3a-a9c61a4ba272", "value": "3072:oHgVbcBoTRMGUYnJjEFp8Qp5O8kd6LkLh3VNr4d3Pc0n5f5Uyd:IgZ+nRpXkU2hlNrWj5fO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632271401, "uuid": "eb6459af-310e-464e-90ff-10bf82a14875", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632271401, "uuid": "56581671-151a-45d2-87da-df750c2435f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271401, "uuid": "2d0773be-37ed-4466-80f1-bab38709b01d", "value": "'\u7f05\u5317\u83e0\u83dc\u201d\u5973\u72d7\u63a8\u8fc7\u6765\u83f2\u540e\u60e8\u906d\u7325\u7410\u5f3a\u5978\u6d3b\u57cb\u89c6\u9891.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4780f5c-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632316791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316791, "uuid": "29a049f2-6ebc-4e4c-b851-13cd4ca3a5f5", "comment": "Malware payload (Gafgyt)", "value": "f2a319772b6c4aeac6505e90de9279c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316791, "uuid": "28df9158-403a-4cdb-a610-7d517973c4f2", "comment": "Malware payload (Gafgyt)", "value": "4bf57773852c42f26eeb6f08a3eea51340b056ed23df6f270663a2d936409442", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316791, "uuid": "e9ebabbe-0734-49b8-a1e8-979bb048b076", "comment": "Malware payload (Gafgyt)", "value": "3a46096b75c3dc3a952d1ea788ae7df4788cc591", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316791, "uuid": "a2797220-e9be-49c9-a069-7c07be17e296", "comment": "Malware payload (Gafgyt)", "value": "d31c83c0187ba9cb09860ff356b99c499863854b7b9d4dc2db69ca1f64fd0b7bc2ccf7a809af030ecd81e94a2f7d76bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316791, "uuid": "c8af1130-d5e5-4568-85e6-424f309c37d9", "value": "T12E734A43A9A58FB7C0476EB566E74A300B13B8616F1B1B89712CA9F4034B9CDF81F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316791, "uuid": "c8a587fe-21a4-4280-a7fa-e256626bdae3", "value": "1536:DTja1haMKIc+AqLnmxxKH4RCBKezj+mj9VqYLe8f26e:fe1haTILLnAReP2mj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316791, "uuid": "9dc85957-b44f-4777-9d3f-deab76d5adac", "value": 76905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316791, "uuid": "fba4d3a2-53a8-4c4c-96be-98bce362fc3e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316791, "uuid": "a89b9d5b-461b-4e36-afe0-749563714851", "value": "f2a319772b6c4aeac6505e90de9279c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6886c468-1b9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632312771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312771, "uuid": "9efff089-2791-4334-b157-d067da639a89", "comment": "Malware payload (AsyncRAT)", "value": "303fe9e331166745e53abf66e153dba2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312771, "uuid": "2ef0bc30-ef33-42aa-9c31-7d063b658978", "comment": "Malware payload (AsyncRAT)", "value": "4c31f34fad2724f968f6b34c835f5de3306757ce11e3a0cff8b9c695d85a2bb1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312771, "uuid": "9019ffee-4ea7-4f36-9fc5-9a8ac857d226", "comment": "Malware payload (AsyncRAT)", "value": "e0487d1082d1bdda055ab89da838c90c0bc0f6a7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312771, "uuid": "5b5243b4-3422-4f29-8446-2d5b94a033b6", "comment": "Malware payload (AsyncRAT)", "value": "db21e18074e3bb16a531dcea8c3189e344f0494ac50636a97c3bdfa3a8ebcc075e99366b0040c201486bc657476b7b77", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312771, "uuid": "7b50c8b1-9752-4927-8730-92049ad2a5c7", "value": "T1B9B3BF537666C804E758877A0CEA829E7727FC112F7E03473110F76E6E77AE48D1261A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312771, "uuid": "3dc0a1c8-55b4-4368-9f88-079a8e1d906f", "value": "3072:Bk3hOdsylKlgryzc4bNhZFGzE+cL2knATqPn+9Cjv7oSctaMF4DKr7WjM:Bk3hOdsylKlgryzc4bNhZF+E+W2knAMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312771, "uuid": "4acce85e-500f-4e48-aca3-6470ee77a0f9", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312771, "uuid": "76549ef3-0159-4fbb-833c-e29349f59e59", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312771, "uuid": "3d7304a6-12fa-4adf-9eb4-039f9cc7f26f", "value": "Fatture settembre.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b357293f-1b86-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632302589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302589, "uuid": "3e317fa4-d609-4ed3-83f8-b941382f2990", "comment": "Malware payload (AgentTesla)", "value": "46a9cde2229b45d390ad40ce0cc997f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302589, "uuid": "e09cfde5-740e-4acf-bf89-1b4a80b54101", "comment": "Malware payload (AgentTesla)", "value": "4c4a0595a5ac3499e7d398aa9cbbea5fc5a77836be706c50bbae6dd7c0c6aadb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302589, "uuid": "319ce07a-a385-4677-bd1d-e99899cad634", "comment": "Malware payload (AgentTesla)", "value": "ddf3a356e42d2a15ccd930b0d5c6d7077824ef8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302589, "uuid": "12912241-2965-4d7f-80e4-b60dd3eebcfa", "comment": "Malware payload (AgentTesla)", "value": "38d050d0f2359c06243fa863913a2eab5f0dedabe5b4c8ea1a4157a7e6ae026d5ce624da52da56613425ac41cb1a6ffe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302589, "uuid": "cc83b14e-b67b-4631-84f7-7c859642158c", "value": "T10AE33A217389DB13CC2B35790C91299473B79BC73B57D64B3F8DE6B89593B8A4B04222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302589, "uuid": "cd849d50-ac7f-4c09-9f65-4f1b7e5d6e44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302589, "uuid": "7fcedd84-6e34-40c0-adc9-daadf77cca53", "value": "3072:hldsbRjH0ScSqHXHYe7FzlF4Mo2OqR8Ob:hHsljH0ScSqHXxlF4Mo2nR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632302589, "uuid": "f1afaec9-cf0b-432f-94c2-fd77150da39e", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632302589, "uuid": "04dc9d2d-3cc1-43ba-a087-0eb99caa81d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302589, "uuid": "44e74d1c-cbb8-4d98-84f5-13b3eb870401", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1157b0-1bcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632333854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333854, "uuid": "1eb17ec6-8596-43ba-88ba-219516c94fc0", "comment": "Malware payload (Formbook)", "value": "446ac30db49157402fa3c5e2fea9caec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333854, "uuid": "ce38af19-4b3d-4608-bec1-1718a1a7e5d3", "comment": "Malware payload (Formbook)", "value": "4c5887639c1dfcc0349690d98e9c8034029a6fa2f2e6bdbba96371bf23ce3301", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333854, "uuid": "59f04dc6-3d90-466a-bd82-95c8b0ca6e9d", "comment": "Malware payload (Formbook)", "value": "004197b9fc86d2271ddbdb0759927c13287bbca6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333854, "uuid": "bad57293-ec91-4f32-8645-18cad1f27629", "comment": "Malware payload (Formbook)", "value": "7ecc9003f2d7a02c33ab13886257f872e687ea948aabeab5835d3dad521835fd14abed230320c89c93e76b517fae9fb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333854, "uuid": "6cabb235-3041-46d0-8631-f54a727ce560", "value": "T17CC41335C55853BCDF798F7E211491490B71E1CA7B03FB5E2E92B0DABF4679080289B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333854, "uuid": "d4d5662c-395f-40b4-a248-f698ce00da74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333854, "uuid": "e45f865e-f0f6-42e1-b41f-ef2d894237a9", "value": "6144:vs5pkNmtiS3/NpZZaBVr0aeTzRUD2YW9N4uk6APyk+GFM2XFI9R+RW72EOzufIbI:vs5YmtiK5oBuaeTzt4pP9++lRc2EFIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632333854, "uuid": "84ba1ffa-acd5-4da0-8fa4-596c84e59d69", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632333854, "uuid": "698cd213-f0d6-420d-89dd-719a65eb8885", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333854, "uuid": "ccafd14c-e298-44d7-b9a1-c1df25471093", "value": "446ac30db49157402fa3c5e2fea9caec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e1846d-1ba5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632315857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315857, "uuid": "61873b1c-45bd-4962-9b8d-4c309dc742ed", "comment": "Malware payload (Mirai)", "value": "e2f29c89945a6128e64803f305c3c976", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315857, "uuid": "92c5d9a4-ac76-42bc-8488-2a5b1fdc225d", "comment": "Malware payload (Mirai)", "value": "4d100d7a438658e6415e78be11213258004d8e0f956a992d8c3e9549c2e30210", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315857, "uuid": "2a8e59f7-41ff-444d-bc73-390370fa1905", "comment": "Malware payload (Mirai)", "value": "1996e00357b278364896e6325dbc010fd5f2da00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315857, "uuid": "b1574265-0b7b-41e3-9189-7f8e4b7fd769", "comment": "Malware payload (Mirai)", "value": "16cbc08328e9809b44dcb96ab9ab60ea5633c85c55a60dff308e79e1623f8bd834dad388cd6a6ac49517ae0448e1b569", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315857, "uuid": "9dc1805f-07e7-4ac5-be45-74f3ad304b8b", "value": "T143832A33A761C56AC00791F016EFA9A1D823FD3F0976306B77917D606F748C12A6EB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315857, "uuid": "23f6d00b-4dcc-45c1-b616-78e7e28667e8", "value": "1536:I+n459sk8nYLdsNDJpQv00+bx86zWpROTOsiK/31qezwj:H45oY5kDJ21E86zWaTDjPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632315857, "uuid": "43104032-9118-41c2-9615-228fb4a15160", "value": 86304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632315857, "uuid": "649956c5-56c7-4b90-8772-9cf30cc366cf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315857, "uuid": "048f0564-3457-47e5-a279-048b0aa651c6", "value": "X86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85632879-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632316685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316685, "uuid": "7c90972e-ac21-4f5b-b7e9-0b012b02c1e1", "comment": "Malware payload (njrat)", "value": "bed701af2601f7d0b9e02578f8a7d190", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316685, "uuid": "0e492f4b-1869-4d1e-a17b-1d5fe7a04d0d", "comment": "Malware payload (njrat)", "value": "4d45b8210c1a3ee305e9adcf9f7e055b562c6c8977e1210782a9a57155123417", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316685, "uuid": "fdf8e551-2da3-41cb-96ae-e53d4426b87e", "comment": "Malware payload (njrat)", "value": "f4617afd24c07a057b91b1f52e66a4167580bdb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316685, "uuid": "83850f0c-739a-4aec-b3b5-d550d16a0071", "comment": "Malware payload (njrat)", "value": "452f84b24b33a16d3fd9b2e38b1baebc3bdf42ffe75b8d1ec1a3c3ff43637692475132cef1047bd6f3da6384f7d39af4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316685, "uuid": "3e1fbffc-179b-42da-a7d0-e1eaabf8392c", "value": "T1E8652202B6C6C4B2E53329360939A7107D3DBD605F25DE6EB3E4391ECA305D1A625BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316685, "uuid": "3462d62b-f08f-4bbf-81cb-92593085a58f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316685, "uuid": "ea8b3454-a1ab-41f5-9df5-a74a53f57765", "value": "24576:eNcBtkZXdsDwEx1JXCFX2NPMmx6AGeRVVNxLNd9p7EmELXUkDauELAW:5eYNtFx6AGKvp7EmELXUkWrMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316685, "uuid": "252faef2-ddb3-43a4-989c-815b35bb19c0", "value": 1436124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316685, "uuid": "17b65a16-bd5e-4d7d-a8e3-466b8d2264fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316685, "uuid": "a5445848-b68d-4d2b-b127-5b38f4ddd05f", "value": "4d45b8210c1a3ee305e9adcf9f7e055b562c6c8977e1210782a9a57155123417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6719170-1bcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632333947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333947, "uuid": "1726b540-aa6d-4d6a-b746-3474f1f8fb72", "comment": "Malware payload (RedLineStealer)", "value": "ecb887b80ecdd78f0d5c3d93e77fe21c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333947, "uuid": "612aa5a6-d94b-4955-83e8-0cc7b700117e", "comment": "Malware payload (RedLineStealer)", "value": "4d88199ada7b791bc7f1d03faa7ecb85b7a5f42ecedc3f84a9514afd4f5996c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333947, "uuid": "744150a5-8e58-4d85-898c-b1b71c42d34e", "comment": "Malware payload (RedLineStealer)", "value": "060740155c949a9fb213362a169798df17910f22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333947, "uuid": "955e158f-39e7-4f31-971d-d5bfd274a338", "comment": "Malware payload (RedLineStealer)", "value": "001ac83780aa595d4965580ab7aa5d4a842a48bb767837693a572fb209976a41a5dd9e96d3649c18da6b6c5a3497246b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333947, "uuid": "3cdea8b1-1e33-4e04-95af-9b4a76a66e39", "value": "T1C873937701A191AAC5892334F8B50F4B3A7CD6341580B69CF04BE2AEEC1D69D9EF8774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333947, "uuid": "05fee7cb-2aae-4266-8e2d-550f36740d09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333947, "uuid": "70690610-7dc1-4776-a74e-2ffee92bb30c", "value": "1536:57wy8P6KV6w1DbzQVOcfjyCKoyfBB5JLezr+J:57wyTKV6w5sjbyCKoyj5szSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632333947, "uuid": "c8f04626-693b-474f-99ae-caa69a8d4ee0", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632333947, "uuid": "8209cfbd-6d72-4f1a-9253-affc92402b82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333947, "uuid": "913f0a73-1bef-47b9-a6bc-6571c782ccab", "value": "ecb887b80ecdd78f0d5c3d93e77fe21c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0439245-1b69-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632290101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290101, "uuid": "9b6deb79-188d-450a-9fb7-b27f6da74eb3", "comment": "Malware payload (AgentTesla)", "value": "fd17111394162bc6eba7ecff112492df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290101, "uuid": "f91aa31f-81f0-4c5e-b2d7-71ee4de75dcf", "comment": "Malware payload (AgentTesla)", "value": "4daa2b18077b016f83ec9a59be346f7f74b3bb6d07c21eb8856a2ae27fa4a9ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290101, "uuid": "886d4917-5370-4d3b-8aa5-fd037d43afc7", "comment": "Malware payload (AgentTesla)", "value": "a94a1281e188958816d7e845e4a73e54a98b5aed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290101, "uuid": "accee077-2f4e-4132-b883-45fed13f3b18", "comment": "Malware payload (AgentTesla)", "value": "12fbc00c29c6c411ca135f26a30c1c872c3067b4d4ee5e1519ef58ebadb4ad7fa5717ee692d842a1039a95959dce93b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290101, "uuid": "eb470b96-4aa1-45ed-a9a6-cac413323df4", "value": "T11A94021236E4A332E22983F82F6219F8955FBD725D64DD87BB003F982B77D4641243A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290101, "uuid": "21051ea9-23e5-49db-9241-5e62507b5065", "value": "fbc2ee00d690edba30359018bdb1112c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290101, "uuid": "b67624f0-a6dd-4610-879e-f368d182e477", "value": "12288:E3Pf0sFGplXz2UOFoJ7DW6XUJBOZp3MZwYl:E3Pf0jsFohWbKTYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632290101, "uuid": "54645785-544a-4f9f-88e2-3cd96474fd39", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632290101, "uuid": "8a6ba250-ee4a-4ffd-8d6e-74f36179e2fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290101, "uuid": "ebf3df5f-844f-4507-97d3-0a2162925439", "value": "DHL Delivery.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d57732e-1b75-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632295035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295035, "uuid": "5907aecb-44ba-4095-9876-756e2840927d", "comment": "Malware payload (Formbook)", "value": "9d4b5da7765d431b11ccd9a72cadf2aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295035, "uuid": "a766c269-da6a-48fd-ac82-a55cf4bd31d8", "comment": "Malware payload (Formbook)", "value": "4eb131114c2b67395cff2f126c699a569e6ba5e3a53876f79588dfa0924b3d7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295035, "uuid": "7ef78be2-09ad-4cdf-925d-79648067cdfe", "comment": "Malware payload (Formbook)", "value": "152ecaa7b1afc0c3a5fc57a20e5fc2fc4dcba5f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295035, "uuid": "bb8fb360-c8b8-483d-9645-9160e4a59abf", "comment": "Malware payload (Formbook)", "value": "6edd2e031f35749bec7b9eadc22bce68031a24168ce15556853ed4fa7bde84e0beea935e96011efa57b8cd1ed67e5c50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295035, "uuid": "ef7101b6-7a19-4f78-9fc5-e7f635ce4b27", "value": "T1B1B4123C82DD6A6FCF4D06BA691159011FF1A1A77AC1F7C3D9D1205FBA8A3C4812B4A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295035, "uuid": "1d541b81-d87f-421b-b04a-613f3bc12df1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295035, "uuid": "2308d80e-a713-408d-843e-4617b114554b", "value": "12288:HbLmtiK5oBgzAoj8Z+8Zj8WvG2HEinP00W+wcWO1Mc3jMcf:/+FoBgzAojUjdrLHF51xWO/wcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632295035, "uuid": "9e59f5f6-0b45-4fd4-8809-a870b472baca", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632295035, "uuid": "ae08e0cc-e696-4bc2-9dc4-87d58b72bf99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295035, "uuid": "795f6895-b55b-4576-a1a6-f1b57154f71f", "value": "Z14S9Zolcyub1pd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b219db55-1b69-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632290131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290131, "uuid": "481a9af0-a493-45b0-abff-ab75872c29f7", "comment": "Malware payload (AgentTesla)", "value": "51d6b54c16f4baf074c9132c72548075", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290131, "uuid": "4353c17c-ad82-448c-aaed-17187f7af32b", "comment": "Malware payload (AgentTesla)", "value": "4f5206d7f4e9e94f95d951bd8df6df472d1907051caaa91e9aeccbd4dcce60a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290131, "uuid": "da03da80-8669-4f6f-86ff-a8c48b26d649", "comment": "Malware payload (AgentTesla)", "value": "8702706f8713c76c75fcaed3e9393a52c6662873", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290131, "uuid": "4aa2c916-5e8a-408b-8f96-337fd75292dc", "comment": "Malware payload (AgentTesla)", "value": "7cc4a1aba6448798014f6b1da70f2afe067107d4b0c17d475411545ba7741b47605e22af9df1f4cad779f375e3e90018", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290131, "uuid": "bcf5ccf9-3baa-4397-9d98-d110639c2995", "value": "T1BDE40102712D9A14C79D3B7765A597A0BB73FD2A9A32D54E25EC308E0F7B7890E30316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290131, "uuid": "d81dd5ed-db2c-429f-87a6-61747a36334a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290131, "uuid": "f6ccd1b1-f12b-440d-8c0e-bd5d6502b89f", "value": "12288:3AIbw8eGGmtiK5oskW6hUyxXEhWJmNLy98TH2sCFbSNfRB3pugDDWawqsA:3jbw8eGG+FoDbUhWehH2sCFbSNfUgDD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632290131, "uuid": "4c143d9b-0676-4c0d-ba4d-debf22308dc5", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632290131, "uuid": "01df5f87-ba53-4adc-9293-76c9fb9f82b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290131, "uuid": "88cd0874-f62d-48e7-b04f-427e44dd702b", "value": "DHL Airwaybill documents_TransportLabel 3831234002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e7fba8-1bbf-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632326838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326838, "uuid": "68ddea69-735b-426d-923e-ba57f90abd02", "comment": "Malware payload", "value": "19892e4eaa5acc4d15853a76566ac7c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326838, "uuid": "f5b5714f-3c35-44db-be1b-aabd24f6e56f", "comment": "Malware payload", "value": "4f57c0096974f1d6feca433908c0267355a418893145ffb43a66de5ddf7be9e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326838, "uuid": "95c7eb64-8dd9-4880-936a-890b36fba46f", "comment": "Malware payload", "value": "9e13c49fa57e153c00e8ebe789f5c29cbdb16751", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326838, "uuid": "dc6d00ba-d4b9-4627-8d4f-6994f202c917", "comment": "Malware payload", "value": "ad01daacdd00e0d8edfd1b6d36160f4e430bcb89509fd8a73b97dc8049fa7de2cb7ba67e46186738475212ddf3cb4fb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326838, "uuid": "d26430ae-49f0-495b-9c3d-eb95f6738e0e", "value": "T13A55AE15F764C0B2C147417E8856C76AE772B8250B748BCBA7A04F6E9F233D1AD3A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326838, "uuid": "b650231d-ceac-4c88-892c-b8f0541eeff1", "value": "97684ed2b4bb5eb7f373577c0891222e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326838, "uuid": "572a37f3-87fa-4a83-bcb0-635e10a2e306", "value": "24576:UZUwXfHfdrWqVn6tnFE2A8ZF6Qm+pKVGo9fcwDLMQG+j2XlR:Cf/RCGmdpKJ9fc1Y2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632326838, "uuid": "489adbc7-89e4-498e-a0d4-d59836ec75d3", "value": 1315840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632326838, "uuid": "dbe841f2-764e-49f9-ad8b-43fd51c557ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326838, "uuid": "c8181d3d-0889-4ca4-8d85-9527f165d38a", "value": "19892e4eaa5acc4d15853a76566ac7c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db71b3a8-1be7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344317, "uuid": "dbcd21f7-7de6-49f6-9359-d6acfdb4744a", "comment": "Malware payload", "value": "255621fa5b329e005a5b6fd09b042483", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344317, "uuid": "3394180d-4b64-4c97-80fb-7970a65afdeb", "comment": "Malware payload", "value": "4fbe5e544538a5b4e9d1af00ddfd28b14e7a41c927a1f44997d38204d9768669", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344317, "uuid": "b6df74c7-6748-4be9-ba07-617e744981d7", "comment": "Malware payload", "value": "16d0a5bc07e2ae96c95d54fb7253e6675e30a89a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344317, "uuid": "50b8b172-94c5-4607-8f2c-750d0ca73587", "comment": "Malware payload", "value": "c313d803e68e6c37b95cb1f012f9526f1846deb2385f262286c8be84503dccd12b86731c1d28b8fc9a691ad1436c04fb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344317, "uuid": "5f039fbb-5296-4097-a5ae-106a0777d1cc", "value": "T19B05231E2D9877ACC77A76B978CDEE51EE8F120E3C4185C9D54F253029B341A12BA173", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344317, "uuid": "479fdee9-8b1a-47c8-bd72-4b183b5536f1", "value": "24576:dOb1mjPrzp8c/6iOjHjKcq5pt5/A1/+kgrNzhWQg7KpLk8Am1QaB:sb1mj/J/6iSrqB5IJ+/VhWQMKACQaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344317, "uuid": "c1f5fdd5-05d3-4549-ae3a-e6fba4538b65", "value": 864646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344317, "uuid": "708bc13f-1fd5-44e4-8a5b-8737870fa709", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344317, "uuid": "0a9cb9ba-affe-4007-a9ff-2db5577042e8", "value": "\u8fea\u62dc\u5973\u72d7\u63a8\u88ab\u8f6e\u5978\u66b4\u6253\u89c6\u9891MV.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac001752-1be8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344667, "uuid": "dd3e3516-bb48-4cab-a1c2-8d7ec0376503", "comment": "Malware payload", "value": "42e0ce1b4fd4120aa96d02607b67f614", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344667, "uuid": "c474cb22-32bd-4b68-9418-5740bff7ff6f", "comment": "Malware payload", "value": "500954ed4644d1fefd70145979d43d516baad8b21389f887841c3f6cc32008bf", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344667, "uuid": "2fd67dfa-1983-4e57-a153-5d1289bd227a", "comment": "Malware payload", "value": "6926d6f7769ce0a74f22ec7289ebb67ac1f1dc44", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344667, "uuid": "aed6e0d0-be37-498c-98d5-19201b511133", "comment": "Malware payload", "value": "9d0357331360ce28d5d1f1909ffe7ae1976689c6e47a61fb98b6e8d6f8bdf529393ab9fb55a8f2d5f5e42ff08508adef", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344667, "uuid": "b5d44aaf-0b74-4116-a53a-5afb36318f12", "value": "T172D4237900D1E218EBBD11F04B33EE8112E7C7AB03B5E746F0D945DE96CA5B6E9214AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344667, "uuid": "799f8337-edad-427f-bcad-eebc53d31ce8", "value": "12288:GzWAic9YaY2ByWFTA/tp3YdnVWn6rPvOmrNFMr:g/vNyQk/GnVWnoPvOssr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344667, "uuid": "e60633bc-b4e8-4bbd-a0f8-eb5597605eb1", "value": 608138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344667, "uuid": "fe9851cb-bb6e-4aba-8ace-052b3208b32b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344667, "uuid": "626cfcbe-0b9d-4b42-9386-79959a1ad8e1", "value": "\u8fea\u62dc\u201d\u5973\u72d7\u63a8\u79c1\u52a0\u4f1a\u5458\u906d\u7535\u7597\u8f6e\u5978\u89c6\u9891\u66dd\u5149.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693c20ce-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316638, "uuid": "baaa7f9d-582a-4e31-87e6-4901a7e151b0", "comment": "Malware payload (Dridex)", "value": "7ffbe9e4ea4cc7788f22bb7ea520c703", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316638, "uuid": "df616309-f2c6-43d3-8392-f45f64b0e93a", "comment": "Malware payload (Dridex)", "value": "501d9d6d5a0f5f9c8a0c0956aed4be6438ddd6c1b9bd710c9313d34c3ce4bd3a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316638, "uuid": "c16ba4cd-ef42-4c24-a38d-880c1ffed92b", "comment": "Malware payload (Dridex)", "value": "7ce31b8831360de12b440e471a6899b25f70bbb2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316638, "uuid": "2fd95806-d7f7-447c-a07e-d8005b327878", "comment": "Malware payload (Dridex)", "value": "2a259a713e6fe56f63ea31e53499f3613192c9a9f425402fc5468e014f5f4f2fdca3cbfb4871b3063e48079ef838f03a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316638, "uuid": "f8e0e838-25e0-4743-94c9-32dc5f76bc0f", "value": "T11D85D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316638, "uuid": "85f51ca2-fb0a-4dd5-856a-37f5f96b17ba", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316638, "uuid": "fe401e2c-3c0a-4423-99e0-bd20aa455390", "value": "12288:yVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:vfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316638, "uuid": "633e5068-dba9-4d29-a8b0-51245a0e853f", "value": 1863680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316638, "uuid": "cde6de8b-3cd4-4af1-b074-39beff00525f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316638, "uuid": "a1e4b2ea-7040-4bc8-96d5-c91e3a43c581", "value": "501d9d6d5a0f5f9c8a0c0956aed4be6438ddd6c1b9bd710c9313d34c3ce4bd3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98847874-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632312422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312422, "uuid": "6951becc-17c6-4890-b5f0-0b8877deb565", "comment": "Malware payload (ArkeiStealer)", "value": "682c644326167c253b50d2fcbf24b7fc", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312422, "uuid": "5ac90070-bd52-472a-86f6-2539131ac0a3", "comment": "Malware payload (ArkeiStealer)", "value": "50df8bab92dde00cb1692a804ea9e71f9827b7cf50f12ab0b0d33414dbd70bfe", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312422, "uuid": "bcbaa7f3-0ff5-4914-bb9b-d26dcb296265", "comment": "Malware payload (ArkeiStealer)", "value": "ae809a29b5d0909f4daab6910f335ed7361c45c3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312422, "uuid": "40473685-7ba2-404d-a894-bec6739cbe7a", "comment": "Malware payload (ArkeiStealer)", "value": "86e8e4ce5e51eee19b3f0a8f4fdd146734a918de3fd90afb50dc0d1a3dfefda6b545891cc5f23e7677867ba299b0fcc2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312422, "uuid": "aa3fe418-775c-45d8-990a-eb128364e26c", "value": "T150F40120B6E0C039F1F712F885B99768A93E79B25B3840CB62D516FA16387E4DD31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312422, "uuid": "26d0b39b-e04e-43c3-a81a-2fe9e8915bbb", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312422, "uuid": "c2b0722f-12b4-444f-a9f9-5e312058799f", "value": "12288:ys82uMIn54TUSuN0rr7h2hfBbKl8XouVcsxs1laOnTyg2IUyBPIQgQYHA:EMIn51Er7uBbaslUl1nTP2o6QgQYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312422, "uuid": "8bb884cb-c2b3-4f05-a3df-0f6f06934abd", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312422, "uuid": "cc584060-33de-4e8a-baf0-3e8fe38f19cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312422, "uuid": "4f711b36-2a9b-4303-9cdc-6dafc5761d5a", "value": "682c644326167c253b50d2fcbf24b7fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0824bf-1bbd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632326014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326014, "uuid": "32734719-7618-4900-a7f6-4bf711a3e7d5", "comment": "Malware payload (Loki)", "value": "7d61098bd6413d9eaa84abca69c207b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326014, "uuid": "776e9e06-3563-4249-9567-2719a45813fc", "comment": "Malware payload (Loki)", "value": "51e4e8ce104c598529d82164820861312b26cb75de0271e0e9917a153116416d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326014, "uuid": "737472ef-b7e9-4405-930e-48cf9c89beca", "comment": "Malware payload (Loki)", "value": "4b768aa5d72d0491fdf2103faea6a6a678586c14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326014, "uuid": "d18a712a-2061-4584-b42f-2d7de7534a8f", "comment": "Malware payload (Loki)", "value": "869022506b035b2900671168bbada1797e58288377d522191d257c1c17663712e9f875750758d3d856638b6c9f6a2173", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326014, "uuid": "909b0c75-5387-4407-9fda-7411e2ed066e", "value": "T1A114D0313AD0FE32C4971A7144B8C6B12B79B8251779818BB7A5376E6E303D27B72346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326014, "uuid": "e2158eee-d085-4a9a-a104-489159e16363", "value": "a0a666636aca5f36444e237f86f70507", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326014, "uuid": "09cfb1d9-991d-46cf-8165-b54df0d2127b", "value": "3072:NMyLh+c3a2Fwo6qwBxpBEoxNO5kY1WOaHudC3mS:qyL33HFwosbBvHY1WOaHudL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632326014, "uuid": "bf2f80c0-9f5e-456f-81bb-4d1dc5b733ff", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632326014, "uuid": "72df6758-a8de-45fb-83b5-74cfc077b7c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326014, "uuid": "99c4a1cb-320c-4b15-90e5-6a608ad64701", "value": "7d61098bd6413d9eaa84abca69c207b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b0d04d-1b9c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632312067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312067, "uuid": "42050b9c-d119-45a6-94ef-5eb37d3db1fd", "comment": "Malware payload (Formbook)", "value": "95e18447645292f1b256faa44201d436", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312067, "uuid": "a9e022a6-9a2c-4bb2-aba8-90c1099edb37", "comment": "Malware payload (Formbook)", "value": "51f4409d611e0bcb80c4a0e5841a261503a423b401c9af2c17df1eabfa9dc42c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312067, "uuid": "b882ce60-9c87-4c6f-b3e9-d57cb5864385", "comment": "Malware payload (Formbook)", "value": "2a69f5ad1d728771ec24b07c0217f26e47e02d5f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312067, "uuid": "c9185228-6ec4-45c0-8ff3-b302f1b9340b", "comment": "Malware payload (Formbook)", "value": "96a98e815d4a5cc4b8fd57a19ee4f4043471b4e7538a27bce417a8c95b64b1abc50b1683af3a54c4a956d155a6233e71", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312067, "uuid": "d0e1089d-4945-468e-9d73-ede38f7492b2", "value": "T1E4D3029EE65A41AFF033A47108C96497533FFF8A458CDA1281C1332E76B777CA0A7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312067, "uuid": "2409974b-cae5-4295-b643-bb32f0d91e56", "value": "3072:UOMQ164WkJvbwUvVtOEpRgT/HVBtRIbyoHxVRYFFg:UOMQ1TwU9X7gT/HjLIbyovRYF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312067, "uuid": "a27b2e52-133b-4695-a677-4b199ca20b45", "value": 132392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312067, "uuid": "c4edb73f-3b42-4e66-9e19-49004ba98f0e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312067, "uuid": "c183fd52-3497-4116-a111-239572e098f2", "value": "accounts.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055a1457-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632312175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312175, "uuid": "83f8f2da-1d2a-457b-991d-09a488b7201a", "comment": "Malware payload (Formbook)", "value": "7198bfdc7032f6256daf7db1a9809ef1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312175, "uuid": "525fb437-6d16-4cbd-88a4-b91fa3b7a0b3", "comment": "Malware payload (Formbook)", "value": "5207ba9f0497c5501d346254a91fb60959f475d7d77b6b1d959048675e99848d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312175, "uuid": "b3f01614-bfec-4c1e-ad2f-67d3d86257d4", "comment": "Malware payload (Formbook)", "value": "334f51e7b6173244f8e1bca876cba2378b88320b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312175, "uuid": "437604bb-7fa2-49dc-a8b0-302c75978de7", "comment": "Malware payload (Formbook)", "value": "409f842c48dadc26417865f8b76b8ee0fbf768ce10efb971b6ecc458b596276ec7194b1240ce732b58ccdb044729cf05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312175, "uuid": "2765e3f7-a7b8-4e6a-84dd-b360f06ee976", "value": "T191B41225E6B58376DA59CFBF54A085860BB5618EBA03CF3BEB8670853E077714038876", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312175, "uuid": "2343e33b-c70f-4086-9edc-4ffa27d73543", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312175, "uuid": "583f97da-baf4-4344-bf56-9f1305b75806", "value": "12288:Ap8wmtiK5oBRWYdz2Z30B3F6wQ9ect3Sm/yGUpKTTIHB:W+FoBEKJB49fv/1UgTT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312175, "uuid": "f136c729-a0bb-4fb0-9189-0f0907164f6e", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312175, "uuid": "8a21c402-8baa-4989-88ad-11aa4794a8a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312175, "uuid": "f6b71c77-a04e-4cf4-a940-84e3751b5f8d", "value": "Order 122001-221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d217391b-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316813, "uuid": "6d07c514-ffca-4d24-a799-9a8a03fc204f", "comment": "Malware payload (Stop)", "value": "573242eca320cad5344adb7b359ec6f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316813, "uuid": "55bb720c-2385-4e6e-b32a-32849b56ca96", "comment": "Malware payload (Stop)", "value": "52989434515532345e8a5b0cd332c44f1650ef4771b38a84d0e6e526e2d761b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316813, "uuid": "bb411501-57e7-4c14-ad95-ee6ffae57449", "comment": "Malware payload (Stop)", "value": "e435dc3d2b8030898d7b988f6308f71eaa3f3ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316813, "uuid": "add60aa0-c051-4e62-9334-c5acf9639ea5", "comment": "Malware payload (Stop)", "value": "92ece9fe426bbda128b22fefaff860b2bda18ba61daa936b911e3e1eb46b6eaf5bfe38570e350b47441cf4394d1638ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316813, "uuid": "c541e7fe-5f1f-4636-9acf-cfb54b2ff371", "value": "T10FF4122D757CC16BC5B2C63048B2F7F04A69B8326860C55F2F61E73E2EF0690656935E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316813, "uuid": "ef37bdd5-b404-4055-8bd6-51966ed678e2", "value": "268bba94d92d1a87745080c74278035a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316813, "uuid": "bda8af34-1774-4f46-a962-22836a230949", "value": "12288:XyvenbmhxweeEmbTTTKbS7ZtZLMLNumuqP2VaguJKcLE6pzjDKzze:CWexIEAuoZtF81P2VaXJKWttee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316813, "uuid": "41cda0bd-fd01-4c18-a49f-3cae28a99085", "value": 787008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316813, "uuid": "7c253227-a795-4d72-9fad-47b888378882", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316813, "uuid": "2cd8e918-1223-4fec-987e-26839f2a09e6", "value": "52989434515532345e8a5b0cd332c44f1650ef4771b38a84d0e6e526e2d761b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd82aa37-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632316886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316886, "uuid": "001fee37-7bd1-4abb-9231-18aaeff5a732", "comment": "Malware payload (RemcosRAT)", "value": "dc039d3804fda98d23dd1b637dcf06c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316886, "uuid": "82517475-f489-4e89-b8c7-783390fcd9bd", "comment": "Malware payload (RemcosRAT)", "value": "5351021d57d8f2f9b51fe8ebe98a4134bae20a92a7a9887b9474e11b915398d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316886, "uuid": "e49e1603-9199-45ca-9c9a-470cc318b0ff", "comment": "Malware payload (RemcosRAT)", "value": "a581ec3bb7aca1765ede30b518099924b2fe4cc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316886, "uuid": "0266d571-7e21-4fcd-8c9c-e3696d4a7b7a", "comment": "Malware payload (RemcosRAT)", "value": "66c58ca5c7e267c85755ffaaa87cae00b715cdb6f0abc80543d083f8d50666a381874b06f462bfeaa88d98ce5c686ecf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316886, "uuid": "6f0ebd7d-c7da-4766-9db5-1ad605f591c6", "value": "T14EE48DC17D47D89BF4DF2AB398AFC12011646E9D5161C73D2682BA2B65F3312306BE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316886, "uuid": "16df521d-16b3-4b70-93ff-dea6fc7ed402", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316886, "uuid": "2aa34a64-ca6b-489e-8c8b-ff605c50d27a", "value": "12288:s5MTdaVt8JsmtiK5oyZnx4/LHErbqSXgBeZkwBeMCJeSc:Ir+FoUUwrbqSSeZdMFzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316886, "uuid": "20625667-0e72-4e01-8694-a4d369bf5f61", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316886, "uuid": "d52fdd8c-48f9-4b96-8569-12798e175e8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316886, "uuid": "acb2cc27-bd0c-47ee-b96f-51b6db4a3182", "value": "5351021d57d8f2f9b51fe8ebe98a4134bae20a92a7a9887b9474e11b915398d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429d6494-1b6d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632291662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291662, "uuid": "97c1483f-5d17-4b35-9c6f-77b8c6694a71", "comment": "Malware payload (RedLineStealer)", "value": "3c4bb0d8ea06d2b95ee937a82a860d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291662, "uuid": "ec729a8f-0fe8-455e-b7bb-5c5d96e0375e", "comment": "Malware payload (RedLineStealer)", "value": "5368d720c17234fa4aac42b20464b7d0a0fb02436a67dd65d088f3488ece563f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291662, "uuid": "f45c48c1-8c30-4127-ae40-6a68e5daee4a", "comment": "Malware payload (RedLineStealer)", "value": "cb142b0ee28a2243c191b8d3a41cf8115dc8f6be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291662, "uuid": "93942fe1-1a25-438c-82cc-4b717e494d0a", "comment": "Malware payload (RedLineStealer)", "value": "65d6c410586e8ef63eb4bdc425808f8deb61d95452c5abf94345cf583677db2694a47ea2a7f9cfd49126816304b20614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291662, "uuid": "0b577149-2362-452e-8e59-8ffcf51a277b", "value": "T1A2E5D9A53D6F66FBFA9D04FCE5838503672817F1D0104B0A95AD607CAF53C2D22CBA69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291662, "uuid": "044c67cc-2cda-4183-9bfa-90172e49b5f2", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291662, "uuid": "ffc41615-7958-4009-a423-cba6f785c1ee", "value": "24576:50l9FjBRhJQ06bwIsNdvh+RB8dBxw9QVxiFaDxuLrPQY+/voV+VjHd976Dr7RMyS:58zYUJmWdM5SgQmfRDk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291662, "uuid": "1deb737b-9ed1-4200-a645-d2dff8d82c6d", "value": 3256560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291662, "uuid": "8f9e5678-46a0-45f0-a8a5-af9d2ace9c35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291662, "uuid": "250a711c-3ad7-4c1d-abf2-699e79282b7f", "value": "3c4bb0d8ea06d2b95ee937a82a860d69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ba0e97-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Osiris)", "timestamp": 1632316922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316922, "uuid": "bec86d8d-58be-4917-bbb4-37a7e886684a", "comment": "Malware payload (Osiris)", "value": "0e182fa82cebb7c71134d22645d7181c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316922, "uuid": "12991f46-fce2-4e46-8a8b-1e81ee628646", "comment": "Malware payload (Osiris)", "value": "53a06e86b64819a4b21977584c5ee1591c0299d45ebdaad1306b852c64ec5f89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316922, "uuid": "bf56c4ee-0a9a-4409-8803-4344d9bab9bc", "comment": "Malware payload (Osiris)", "value": "620ce9d1e80005fa11747ed2223e79c710774c87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316922, "uuid": "bc25fe0f-9906-4a59-adf6-b961817b3606", "comment": "Malware payload (Osiris)", "value": "a49c182791b6c967d42f31a383e8a04f8f74ef2f8e7d29c549a8bf1f182d1ce4e4858f3b4a0a8f1643d002ac7c00bd8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316922, "uuid": "304edf95-7bc5-4a61-b5d5-d4550a014949", "value": "T130C41216FB4FD873C5AA4872CC5D17788445EFA49BB7B88736847F8E16B23E14721904", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316922, "uuid": "0055b487-1372-4a62-8464-04ce69bc5ec4", "value": "174266963e9a11ce6878050b21579fcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316922, "uuid": "c7260510-13b1-4fb0-92f1-0d001b0be908", "value": "12288:Bz4ubZCXMtdUKat+YH7/yJ2je3rojGvB/WaEYvWc:pjOMtd1a/yl3KOjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316922, "uuid": "6165336d-7ab1-44b4-b30f-9dddedf2dcae", "value": 579594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316922, "uuid": "3a832081-3baa-4c6d-88dc-081a0aff7684", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316922, "uuid": "46472c2b-c0b6-4b0f-b4c6-391498a2a641", "value": "53a06e86b64819a4b21977584c5ee1591c0299d45ebdaad1306b852c64ec5f89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ef5e2b-1bd1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632334528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334528, "uuid": "0c701ee2-2e55-42d6-844d-9111d282a0a4", "comment": "Malware payload (Dridex)", "value": "b0214678b659976855095fd795510a19", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334528, "uuid": "0f409789-279a-40ba-9cb7-1e15293ad950", "comment": "Malware payload (Dridex)", "value": "53c0a9f315a8774008fab010f54ac51b1e5fb13934b9845aabe8af3dd0c00817", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334528, "uuid": "039812ed-704d-4efc-bb9d-d78ad1fc8dd9", "comment": "Malware payload (Dridex)", "value": "47f7ddc6d1e37fdeca5fcded182214cfcfa76a59", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334528, "uuid": "9083289c-85a4-44ab-ae2d-cd6e3de8a4e4", "comment": "Malware payload (Dridex)", "value": "19b5d00db7ec6ad42d615a5003e3c04e76fd758877c753cefcd6f51f0ad31900ed6a5859edbec54cf6a51a458de48441", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334528, "uuid": "d3950e5a-3727-4540-84de-b0757f06572d", "value": "T1F814D0D3DFBE82B5F1A67A790830BE39242D6741CB84E567F2D9CA908171521F02EE35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334528, "uuid": "747b4021-2acc-458c-827c-b2d3cbbba337", "value": "7ccd6f40a9c36cae6c541b1ce3dcb8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334528, "uuid": "afdfa994-d540-49cc-afb6-a66e377eff7c", "value": "3072:cglCoxtHaw2NiohdCKwP/LXHiIDLSKsytAKPypyCRbXy1Vee1/TpzXAajIK:cglCyt6Jrdf6XH9dJtByI6Ve1LpEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334528, "uuid": "b0659015-93c7-456e-8e38-5dd51646ac5a", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334528, "uuid": "d88e0cf1-747e-4965-8cc2-8d4164bcd848", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334528, "uuid": "edbee6b8-b84d-44d2-aab6-640d55861408", "value": "b0214678b659976855095fd795510a19.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c7d8aa-1ba9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632317711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317711, "uuid": "a6c3a83f-8700-473d-a90d-309fe4cc28b3", "comment": "Malware payload (Gafgyt)", "value": "42cea49d30f601b8ed0a140c85121c2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317711, "uuid": "491b6466-5653-446a-82b7-541dc5525594", "comment": "Malware payload (Gafgyt)", "value": "53f752e908403c7965cf4096bd42e7778180ed14904393471651f69ee009b300", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317711, "uuid": "130c282d-8e3b-4969-96b5-86227c5c765a", "comment": "Malware payload (Gafgyt)", "value": "b01b0d91649b94ff10f71db5c80075ab3a338ba6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317711, "uuid": "45fa28e1-d159-4243-8e9d-f02fcec53ead", "comment": "Malware payload (Gafgyt)", "value": "c38b54c067910a8a8f2b0ead560665a44af2b41e67d03dcc2de57cd62d0a0f5e2c1fa2283aca334fd0cef8a619c8c099", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317711, "uuid": "3fb1ebd6-e892-44e6-9079-18535eb97149", "value": "T114930A41FD458B27C2D327BAE79F429D37356A6467E733056A346EB42FC27C82E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317711, "uuid": "7b12967e-0453-4313-b2a1-fe887a27e573", "value": "1536:ZfjNq5P8fgPcPHfL/ekyjICaHxtOQy4WCPcyHThdjtmREqQ4b/X7XSee:W5pc6ksaH2CPcyH1mREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317711, "uuid": "a4b19fc7-44f9-437a-9ae3-b2d0c45c0639", "value": 90368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317711, "uuid": "fd66dd70-a2c0-4e78-8779-f6ced6dfb9ef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317711, "uuid": "6e60fdd5-1ab5-47fd-bdb3-5c2ef0fc1932", "value": "42cea49d30f601b8ed0a140c85121c2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80781dff-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632317106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317106, "uuid": "9b863d68-1fc9-43c3-a6f5-6c416fd874ab", "comment": "Malware payload (AgentTesla)", "value": "ee63641e45cd39a27512828a6d5de7b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317106, "uuid": "406183ad-253c-4c54-8e10-5d08ea3198e4", "comment": "Malware payload (AgentTesla)", "value": "54a5fb0e74b745f705a71f8a0627043125c983b56b685fbb7036877cb424fa66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317106, "uuid": "7dcb4921-529d-43dc-b7cc-d03fdac5df41", "comment": "Malware payload (AgentTesla)", "value": "19c345fb85877be3adcdc014ca62f7da56cb9920", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317106, "uuid": "6ef365e8-cd24-4776-9ff5-225e611502d1", "comment": "Malware payload (AgentTesla)", "value": "e170c1445e7764f7920422ff763a28c88d9467f6e22c0f8caec7df13710c25f62f9b999c7d5fb46f00d03ea8688cf5a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317106, "uuid": "08ab6402-4da5-4c80-8732-28a30b0c038f", "value": "T11CE4012D7690B6AFC913CA7699B82D50FB21F06BA60BD3037453119C6E4E6CBDE114F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317106, "uuid": "db61e963-a4e2-4469-8781-ac6a1b472c8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317106, "uuid": "40166601-0235-4c10-ac9e-6408affdb10a", "value": "12288:bSlmtiK5oBP5NhGUPGUmCQdv5aKPQaHz7VQPvOJbEojcuxR+haSz8NWGDJ9d0muF:e+FoBPrwzakz7emZEg7tWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317106, "uuid": "277bb709-3ba6-4462-bc83-fccd16a0ebbe", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317106, "uuid": "817d7b8a-2f1b-47c8-bfb5-b3da6a9287cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317106, "uuid": "35dc0148-d067-4d71-9a56-df56e80a95bc", "value": "ee63641e45cd39a27512828a6d5de7b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792a2f30-1bd2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632335133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632335133, "uuid": "8ee6a27a-79b7-4c5e-aa1e-0ad4cc630e41", "comment": "Malware payload (RaccoonStealer)", "value": "f34cac12ad52c250c2381327d5f5939b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632335133, "uuid": "5ccbbd47-5fc1-4f09-b90e-2b8a8b66a739", "comment": "Malware payload (RaccoonStealer)", "value": "54eb27e976cab1b8ef3173149bf1ed638562fd5aecd90d61ad9632ace9b8abf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632335133, "uuid": "98b84110-8b41-4e81-b89e-41514a9bd2bf", "comment": "Malware payload (RaccoonStealer)", "value": "c56cbb5d8ba97932d49146183ecc31045c80b068", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632335133, "uuid": "f2ec3145-6630-4451-9f4b-412de6a9bee9", "comment": "Malware payload (RaccoonStealer)", "value": "93bbaad7e89b45f02e4dcf42be27552bcdb39f71f6dd8ea8d03a1b49dc7d9486b166a3c21890a6191b79484786168566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632335133, "uuid": "d708ad4a-ef20-40e4-b228-ea1b46f2ebe8", "value": "T19FB401D279F0D870C8961D789569CAB4267AFC71C570808B73B8376E2F712B3623A746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632335133, "uuid": "81d0a9e7-6f29-4a0f-aa18-5db5954c3d03", "value": "e29fdb264def7dda465a7a289be86662", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632335133, "uuid": "8ae95a18-d0a0-4dbe-a58c-3a575166b9aa", "value": "12288:wtbvbEltHkeWlPTG1H0oSI4palupg6QiNeh:w2ltHkhd61F44+JNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632335133, "uuid": "1cfc48e7-cc19-44b2-b1e4-aca716b5244b", "value": 518624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632335133, "uuid": "e9c82561-b071-4705-9462-cf0e79738574", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632335133, "uuid": "7608be92-78e8-4725-858c-dbb6dda02fac", "value": "f34cac12ad52c250c2381327d5f5939b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b47fb26-1b65-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632288375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632288375, "uuid": "39dc13f0-94b7-4e0e-8877-aaff1828da99", "comment": "Malware payload (RemcosRAT)", "value": "7450bd6d921c7bf48975f800312f5eb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632288375, "uuid": "1b7b53d3-5d6d-4aca-a220-803c901b1775", "comment": "Malware payload (RemcosRAT)", "value": "551b886b528af4929cc7daf4cf5f606924619014c7a2fd447d0e4cfc71dcd729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632288375, "uuid": "b148ff2a-b5c2-4041-9586-737f60e9ec03", "comment": "Malware payload (RemcosRAT)", "value": "ef8a6e6d2aff2e04110929f95e6b6b7ceff9cd37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632288375, "uuid": "0dfc287f-bded-4c2e-8005-2fc9627880d1", "comment": "Malware payload (RemcosRAT)", "value": "c13e95f6969791443b25c36afd2b34b4eeebb6c43cedd632f14efda20e770cc30dc45ecd6d50266d5a93348241f9e848", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632288375, "uuid": "bf238580-ed87-4c53-95fb-e528900b62d1", "value": "T131A49D12B891C032C17212700D69FB759ABCBD212D3549BB73E92D5BFE710D1BB2A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632288375, "uuid": "6dc59961-053f-48af-86ca-5f5ecb036a1c", "value": "ec8ea73e2aa6f868311acc5b792bc222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632288375, "uuid": "566919df-1560-4e92-a650-31e3cd6c4f6e", "value": "12288:gf+Ud9dFEvMNIWXLg4SPw5+rTmu/ZIz1Eb:pUdyvMNDU25+r6YZUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632288375, "uuid": "36636fa9-344f-4936-a4b1-a12278cd055d", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632288375, "uuid": "5535311f-2a47-4cf2-8554-fb2d170a65ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632288375, "uuid": "f9150f84-f179-4169-8787-51d443d3bde4", "value": "AW QUOTE 21505 HQ1-Scan-068703_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84c449f-1ba9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632317710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317710, "uuid": "636b108d-0152-45de-9798-ffb4314869a4", "comment": "Malware payload (Gafgyt)", "value": "06bb10acc8277850f96b9cfa97f103d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317710, "uuid": "da9aa9d6-2a46-4707-9b22-96798252caf0", "comment": "Malware payload (Gafgyt)", "value": "55867a2ea571de66d57e1efe03ac74b8d00ef44030202282a7a137f0b582ae16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317710, "uuid": "0f01b756-0564-414d-bd72-7fa25308b56a", "comment": "Malware payload (Gafgyt)", "value": "3ccaebdb3f0013b5ad222321e641e3b680a477c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317710, "uuid": "61b38b1a-6e18-4dc8-ad8b-4b8f689bf319", "comment": "Malware payload (Gafgyt)", "value": "44a49fa9d871a28143eb1fd5dd78abb66fac0f2981bccf660424f62b0b1343d848789f65c648b995cd50a2647d57dbe8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317710, "uuid": "f395325c-9867-4670-a04b-9ad342d66971", "value": "T16EF34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317710, "uuid": "2cbcb886-41d6-49fc-a139-ef72a309332f", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvB9YnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/TYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317710, "uuid": "5a712e5d-bc1f-489a-bec1-b8acb13ce5ab", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317710, "uuid": "3c244bfd-14e1-4f06-90a3-78f8ec75dc17", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317710, "uuid": "3cf26a61-aa08-43f3-b4ee-a8840203efcf", "value": "06bb10acc8277850f96b9cfa97f103d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74363e47-1bb1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632320951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320951, "uuid": "1fefde8e-a2bd-4d9b-9285-4cd380916e31", "comment": "Malware payload (Dridex)", "value": "05dfde077206d140af87a91fe51cfc95", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320951, "uuid": "4da401fc-26d6-4edf-9d1f-eb73b6686d53", "comment": "Malware payload (Dridex)", "value": "558e8de9585f3d2e8397b29cc9c7bea595612567968e056fe25219c05dcf460a", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320951, "uuid": "11fe685f-d224-4079-b34c-f74a35d1ac3e", "comment": "Malware payload (Dridex)", "value": "2978bdeb4484ccd92536d1044a18e5382b5056a1", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320951, "uuid": "596de83b-ac74-4c19-8378-4261132644ad", "comment": "Malware payload (Dridex)", "value": "60e857881d7e2c929c62d38d33058186d173f7508aa079cf7283dc8a1ad471938897fc0516a9e062cb399aa01c7c6792", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320951, "uuid": "24588099-1d1d-4260-a853-ce7fa2b41d52", "value": "T13BB3DF0BB07602BCDC1934FE9AD51E35037A4FA231CA9717A674D39897773EB0B06285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320951, "uuid": "6a8c03fd-8679-44af-8ad5-e7ef3509ed21", "value": "3072:oUqdZ1hLYAohYMTTtNqtUaZA1tTcTwvtB6+AWcO:ozBnzMTqtDu1tTcTw1xpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632320951, "uuid": "a25c418e-1f3f-4093-beee-befaad5c0026", "value": 113800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632320951, "uuid": "76433978-20db-4533-9c46-457db6710433", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320951, "uuid": "7ec8ee73-76ea-45b0-8cd3-3290bf3e8d8f", "value": "Amendment.-787066178_20210922.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b15c34-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632289496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289496, "uuid": "15f89482-945d-4208-a129-07a93b03650e", "comment": "Malware payload (SnakeKeylogger)", "value": "af44b5bcd6672e735a8010f692df9672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289496, "uuid": "8a45cc74-b69c-4666-adba-5927997e81fe", "comment": "Malware payload (SnakeKeylogger)", "value": "575851a7e2354cd5541ba5839a38b687c7bbe85e58a44a96fa3afce12cebb4e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289496, "uuid": "53e17fb0-31aa-4531-8cf2-7325385a0778", "comment": "Malware payload (SnakeKeylogger)", "value": "2c31a001dc56047ae813054b3ff99dde30cc0953", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289496, "uuid": "8effda5e-3ead-4314-8afc-b39933000322", "comment": "Malware payload (SnakeKeylogger)", "value": "e50db8f547224b9f9171246cc4042753e16ffb081bd56d262fed215436f3789a66c2af4d0e079684b790ea0cb94d60ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289496, "uuid": "4563a548-b968-43a2-b86f-ecbcc57e316d", "value": "T148442285F6D18EEBD4A7E7B086B66B26FA6FD12884150A0357445E3F3803B63C85E1F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289496, "uuid": "ddc5cda5-d6c6-4ed0-9b79-813b3c25495f", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289496, "uuid": "29a34902-f642-4ff3-b01a-26e57d5ee576", "value": "6144:X8LxBaXJAQML6b/kfe7/3juxmXIFDcfUHYvtnaXUZk1XobZs60Byg0Zt8:lJAQM6ECjYFDuU4vxKn160kf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289496, "uuid": "63349028-7b3b-42f7-a45f-77db62e07ecb", "value": 264576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289496, "uuid": "d7717629-b0ef-4366-82e6-e9dbe796083a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289496, "uuid": "6e16ab7c-269b-41f4-80d2-b445fc2f0001", "value": "af44b5bcd6672e735a8010f692df9672.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bbcaf1-1c00-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632354701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354701, "uuid": "207b3c76-b974-43c9-b89d-5f9291dcb4c4", "comment": "Malware payload (Mirai)", "value": "5dc37746d86455fdfffcb03fa00cff75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354701, "uuid": "3d7971ba-cd4c-4874-bf9e-f98802f8c9cc", "comment": "Malware payload (Mirai)", "value": "591c90f1177f7c0d5d659715d20429d655031a6ff569ac79c92516680e4c5f75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354701, "uuid": "ead2b6d1-eefd-4833-bcc5-5c9de810530b", "comment": "Malware payload (Mirai)", "value": "b5da7e1c7a7b2966db3546126d42b4ea5bdc6ad9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354701, "uuid": "aeb4ceb6-2014-43e5-b568-417c4630e7e4", "comment": "Malware payload (Mirai)", "value": "ced2052c139e55089070d2dface53f5845ca675eeec94c131c360793aa4bb92cf57b21f1f35ffdf7dfbd455a48d93835", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354701, "uuid": "c271c38c-9dc0-4d47-b9a3-eb037d524610", "value": "T12D535CD9B801DE3CF84FE6B98427490AB6232B5456930F23B767FCD76D320949D16E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354701, "uuid": "18cf6770-18d3-4dc3-9e0a-73cbcc7cca3a", "value": "768:xejCglKs1CCOCWzcCB1Rs/RotuVeeeVgSQXjuUXoFXoi8QHAEN:x6CeKSObpBc/RocVRwQXjuEoFD8SAEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632354701, "uuid": "1936f923-e938-43ce-b8de-f3acef25af11", "value": 61504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632354701, "uuid": "f701d6fe-d464-4208-ab2c-a8cd69c1a5b9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354701, "uuid": "34355385-6cf4-43bd-967e-f03b3d1d7396", "value": "5dc37746d86455fdfffcb03fa00cff75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b607aef6-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1632316766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316766, "uuid": "a013c680-d92a-4151-8f3a-d6650d1be376", "comment": "Malware payload (NetWire)", "value": "427e8565cb7c4bbff0ff3c07205f517a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316766, "uuid": "fd2e575e-1355-47f1-b626-6a010d05bac8", "comment": "Malware payload (NetWire)", "value": "5a8d72946b1e08785bba3e067a64cdf3735b46834d4edf4d87d1916bd416a777", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316766, "uuid": "5d4f87cc-761a-4373-85f6-11ce1d1c2127", "comment": "Malware payload (NetWire)", "value": "833a20dd03e1e5aed3d4284fde3d6a8208a97c88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316766, "uuid": "e7186975-2c20-418a-8f9c-7736a68e8ee4", "comment": "Malware payload (NetWire)", "value": "c30feda23d5c392d42eef201261d0468f51345eebb79b66feb6a6886ce3c7f60cecf61a321d21cf1e89cbc56838c3507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316766, "uuid": "6697bfc4-85b6-4aa2-b1db-a448bc0b9609", "value": "T153159EAD23E80D17D32A47B0D412AFE01738E8746A85D70F7850ECDEAC623D6E5616E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316766, "uuid": "c4e3b3ea-0fdb-4a48-ad43-9e15836c4b1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316766, "uuid": "96451643-453c-4543-b753-b70cc4aaa397", "value": "12288:tWEauBVmKa8mdBBh4bgSZuG2U6uKEmaN0:UEaXB3WuIhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316766, "uuid": "c083e385-1c36-4372-83fb-84e574e79bf7", "value": 885984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316766, "uuid": "433e8a6f-eec0-4fe7-a388-40ccb3e1bd9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316766, "uuid": "a82900b4-92f0-4565-8a97-ef98f42019d4", "value": "5a8d72946b1e08785bba3e067a64cdf3735b46834d4edf4d87d1916bd416a777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085fde81-1b9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632312610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312610, "uuid": "7a3b9f32-dda9-4652-8f3f-1b600f0a790a", "comment": "Malware payload", "value": "957533964d83301daa492b5eabc709ea", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312610, "uuid": "3c303dda-187f-4aeb-a754-e26f1ee1f284", "comment": "Malware payload", "value": "5a8fe921fd00e9c051bb76ae7c3fc214b7ed3f2598342cc54a3f16cc78be9948", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312610, "uuid": "9862295e-1a73-4b81-a2b4-24fae3d1ebeb", "comment": "Malware payload", "value": "de424867f451d7348f8849c655bf061ed27b1ab0", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312610, "uuid": "ae9b943d-8d77-4919-8be5-3a3e59162022", "comment": "Malware payload", "value": "435cfbd8f4ea8d71eb89a4d3c1eb2d11bd7f48e7a557fe880bf483193d11f404868c967eb06b0189e018e3c46a91e456", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312610, "uuid": "7747d76a-7a8c-4779-81fe-b81a746ee0ee", "value": "T183B4236D77D4164A4FD4B8A0D268E3377084AEE5893B4B485E277F37DEB54B04880BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312610, "uuid": "59f88b93-f9eb-4c5c-894b-436a840ec93d", "value": "12288:dz3GzbFeL+E94HsJfsrCZFpjWHvWCSqbh3vrBbl9cVXl:hGfFebrJfsrTHeLqBx7cVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312610, "uuid": "68cf91f8-5bd8-49d5-9405-a6828f7d1272", "value": 537221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312610, "uuid": "a96378d4-f79e-4592-9d40-97936a270103", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312610, "uuid": "740c0a6a-d0b6-4d7c-8c5b-877f6bf5af32", "value": "21RM02749.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed707204-1bc9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632331462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331462, "uuid": "32629c55-7347-45a0-bbe0-388568db065c", "comment": "Malware payload (SnakeKeylogger)", "value": "085f97b79bd12abe5fc7b96f321d86a1", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331462, "uuid": "0aacb59e-930b-4f3e-939b-713edb224815", "comment": "Malware payload (SnakeKeylogger)", "value": "5ab98bf16659585929f3a1d2193b4bd7d9f7f95bf0a83f5c4aae8453ddddf6d4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331462, "uuid": "d86b3230-4785-4043-9b77-fa627842c823", "comment": "Malware payload (SnakeKeylogger)", "value": "c88f3daa3b222e19a8b79c934456419668e8b698", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331462, "uuid": "ed31ef2e-6ee0-4119-9498-83a08ce873e2", "comment": "Malware payload (SnakeKeylogger)", "value": "7f064622491a8ef6a9e90a9d847aa6a70cf5b86db67faa658abc84bfd7ae81441dbe5acd35ce6e902238b7a72ed13ab3", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331462, "uuid": "dc54e643-fdc6-4c0f-b279-6965eeca12e0", "value": "T1F4E479C45D884613D7A44676DC5C620632292C5A3723938BCBE67CB73FFE283C62D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331462, "uuid": "016de990-121d-4e6a-a32e-3cb9a94384c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331462, "uuid": "761ec698-e98a-4684-b77b-c9ef8fc960ab", "value": "12288:x0mtiK5oee1hSDy4mgUH41XEC0FJlDANQXJgU5Ck:G+FoZhSDH9UHvpZ0NQXJBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632331462, "uuid": "8a6bc8aa-4b6b-4dda-b300-604804507e27", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632331462, "uuid": "1d23c1d2-7d12-4896-b644-44ccc05a24c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331462, "uuid": "5de7c9ea-45ef-4eac-8d41-0e4950bbd579", "value": "DHL-2021229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fee34db-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632316246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316246, "uuid": "459a976b-5092-449b-9694-e55edad2e6d4", "comment": "Malware payload (AgentTesla)", "value": "9e3d48d47e6370c4cd6ca03ef3c58cd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316246, "uuid": "c1217f00-656a-485f-80ed-edc5a49aaf2b", "comment": "Malware payload (AgentTesla)", "value": "5abfc9096634623fa543a3048b67a690e6c7ffe702367878be2b20f9e0ff6115", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316246, "uuid": "67302827-2dbd-4dc1-a742-fbf2adeb868c", "comment": "Malware payload (AgentTesla)", "value": "c3a1105f92d25fb3fb0f54bc15a014cfa1c49c5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316246, "uuid": "16865912-2b8b-48e7-a32b-07b424bb0009", "comment": "Malware payload (AgentTesla)", "value": "1c438bcd4d610689953a185a7500278a6f849de79df869fc762924a401fd7e55ee32d830c74d9d1dea9a6cd2add446a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316246, "uuid": "ed2bc750-e803-4440-98c6-7a4cecad7947", "value": "T154F49BC85D885613D7A546B2DC1D624636282C4A3723838BCBE53D773FFE283C62D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316246, "uuid": "ca0e48c5-881c-4472-a578-85267c59944f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316246, "uuid": "8eb674fd-b843-4135-9f24-46a7e76a889e", "value": "12288:bfmtiK5ovj21qz9UcLEaoHqgBBHbiCfRpadhGH5k:z+Fovj/z9UqET7GY2GZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316246, "uuid": "ed23f6e0-9e62-4ead-8997-a8fa5db92fe0", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316246, "uuid": "8ca91120-7d8d-49f2-8a7a-9074ba3360d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316246, "uuid": "db5c0103-a67f-40a1-9ed5-b6ed0385da61", "value": "9e3d48d47e6370c4cd6ca03ef3c58cd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aab7c77-1bc9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632331082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331082, "uuid": "7ade4635-6ea6-476a-bb4a-431d3a47690a", "comment": "Malware payload (Quakbot)", "value": "7c94d5ab21646cbd6d053509de55a80e", "object_relation": "md5", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331082, "uuid": "6d771850-be01-484e-8364-f1429026e736", "comment": "Malware payload (Quakbot)", "value": "5b0bf4defd88befa231c4ebe655ae860b180baa8e0331cd6c570d31f6751b9bd", "object_relation": "sha256", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331082, "uuid": "076c42f9-72ff-41d9-9a38-b62cdcac9fad", "comment": "Malware payload (Quakbot)", "value": "25c5a3b572ee7837061838cacccdc5fa280f8648", "object_relation": "sha1", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331082, "uuid": "3fdc50cc-769c-427a-bc48-d8cc414d4e49", "comment": "Malware payload (Quakbot)", "value": "59e75a80cc248bdf823196f5e3c6f5b4e7af36514fce8e5bd2297b20b61b1ea5e820382a427670238c6a34a807a9deaf", "object_relation": "sha3-384", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331082, "uuid": "f964d889-c87a-438d-a4ca-5fa2a53bb9b0", "value": "T13EC4AE19BEC3D1A1C83C187488A1C8F27638B865AD54D6477AE93F3F5EB31C25C560AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331082, "uuid": "2c0705d6-84f6-48fe-85c7-74365532593f", "value": "c900f0b45b7574481cc6a21428393566", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331082, "uuid": "a4357b8a-a553-47ed-a5da-c6726dbed771", "value": "12288:d1ghp5DubQKErdxA+zM5miTrqZj1kENwNmhxOMNU:K1rv05T+ZjHNwKOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632331082, "uuid": "b9b81a3d-66e6-44bd-a190-82c4fde94d8e", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632331082, "uuid": "8a0b22e9-97e6-4f8a-950d-073fc40d7204", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331082, "uuid": "441ea4b3-26df-4d8c-91bb-5ec3765ddefb", "value": "file.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30702321-1b90-11ec-8fa1-42010a9c0011", "comment": "Malware payload (IcedID)", "timestamp": 1632306664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632306664, "uuid": "cb45d0d0-12e6-48e9-817a-f048838ff468", "comment": "Malware payload (IcedID)", "value": "dfb289ef9f1987eba9a3b91b4bf8af42", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632306664, "uuid": "d0e5c855-97af-403b-97fd-13c903ea8640", "comment": "Malware payload (IcedID)", "value": "5b3791467736f1092e34142c22aabc83f681542c414c51115cbab4bcd7c17c31", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632306664, "uuid": "8b7b9451-f00d-4152-83a5-e0be7b7a3526", "comment": "Malware payload (IcedID)", "value": "15529a20ee0cd1f5a2ab6abe04362352885438f7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632306664, "uuid": "8740077a-46fe-45b2-975d-deaef6df669c", "comment": "Malware payload (IcedID)", "value": "0f3f45fb107fec7501932d798ed76392e495cb8826d2b0d44c766f9e67655eac6d8f4cc0d6407d72ffca73f70ce95b26", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632306664, "uuid": "7e36cd18-243d-4d87-8320-72087690f2c5", "value": "T1D6A36D9AE566C4CFFDE688F8C475709BD1B17A264E204EF7DE50CD102E25F60AA26307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632306664, "uuid": "a65e913e-f387-449e-bc66-2c3ff5f0211b", "value": "fb4c4adaeffcf5f6338ea6dfa31d713d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632306664, "uuid": "d05a8cf2-9685-4296-bf45-45f68fab21a5", "value": "1536:AvYlJEadCEFDRhfF/6IhQu3KlCK5y66ZKb7SZFoBKfZMGov:aYPbfF/6kQu6lcbKiZFoofZMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632306664, "uuid": "6209a34e-0013-428f-9626-ffbd015c6248", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632306664, "uuid": "2c109d76-d965-45cd-8fc7-029305ea77c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632306664, "uuid": "5d46d7a7-0476-4f8f-b135-23a3374dcfbd", "value": "5b3791467736f1092e34142c22aabc83f681542c414c5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fbd6dc-1b7a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632297473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297473, "uuid": "24aa7433-4a08-4cbf-afec-80f397e344f8", "comment": "Malware payload (AgentTesla)", "value": "6264d7836f78c93fd1cf69938d126ae1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297473, "uuid": "8f19ea62-31fc-4baf-85af-236e9cb4f4b0", "comment": "Malware payload (AgentTesla)", "value": "5b6714c7d4b8264f4b93db72dae7013c74b66656eca2414a4f37cb144b643007", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297473, "uuid": "ab6627e7-7c09-4f23-925b-f0f893df1a99", "comment": "Malware payload (AgentTesla)", "value": "4a2af246d2ca091eac0965cd28dd7cfd88a3fd51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297473, "uuid": "2884e1f7-1cb4-40d2-aff0-23de2055cd0d", "comment": "Malware payload (AgentTesla)", "value": "26ecf546154c6fb4e8736f6f59bf4b04c237de3232f3760632ae2558589e4e63c04dbef267295131e34924a01ee809ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632297473, "uuid": "4f8c484b-348d-47e7-a3a5-09055f1b679a", "value": "T1FED3E01037476C12C4392BF054E9E7D20BB1D38E6457CA6F399EA0756E627CA1390FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632297473, "uuid": "733b75ea-6508-4882-8b66-74f1e5676729", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632297473, "uuid": "fc2244cb-cd9e-4552-855f-788119603cf8", "value": "3072:eajDfS0h0CTXYmvFMQ4b1LfuQ/qMiShFq8ucyZ07Vr7+7:FS0hYmuQ4pf5SMiShs6yy71y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632297473, "uuid": "0634dfba-08bc-4b0b-9a8c-91e282ea7c40", "value": 132352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632297473, "uuid": "9995a5d9-9adb-4fa6-b818-65ae219dd399", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632297473, "uuid": "c60605e8-1e50-495f-8af4-c7f0db3f091e", "value": "SecuriteInfo.com.TrojanPSW.MSIL.AgentTesla.6dcd1b9e.26282.23162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6777c8-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316648, "uuid": "80ba4667-abdd-4d60-a01a-4469cd80e3a1", "comment": "Malware payload (Dridex)", "value": "75a9a62ddbff2d7579d015665b482972", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316648, "uuid": "efaa63c0-6622-4a78-842f-bafad6516027", "comment": "Malware payload (Dridex)", "value": "5b931421a8906cc7f351299916b3f35ea015b2262db56b879766e8105b220ba9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316648, "uuid": "9eb48c8c-297c-4451-9b33-ccc069c87d60", "comment": "Malware payload (Dridex)", "value": "63907eb282b1b3ccd9e5771339c73cfbf12bdded", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316648, "uuid": "49e0da18-20a7-41a4-a9ab-8ab7ea0e1f97", "comment": "Malware payload (Dridex)", "value": "c1b68f6f08268d841beba7646e377339a455170a5cea65a1f7686bf9eed5c6b9dbc8b2124187315e83622461fbf0a81a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316648, "uuid": "cb6c51f0-f063-4b29-b5ff-0d0ac9a0f905", "value": "T1AE85E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316648, "uuid": "3ef8703a-d78d-4e93-a00d-034f617e949c", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316648, "uuid": "a5513f54-c892-4662-a9db-bb8e8376a832", "value": "12288:GVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:bfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316648, "uuid": "fdf60629-8b01-435f-bbc4-4da56746c3cc", "value": 1794048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316648, "uuid": "7f84dde0-decd-4dd4-8c22-8efd97286984", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316648, "uuid": "40e88d6b-5224-4468-a5d6-2c5b2bbb0404", "value": "5b931421a8906cc7f351299916b3f35ea015b2262db56b879766e8105b220ba9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75f88d9-1b6d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632291831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291831, "uuid": "bc94ae00-8748-4040-8a82-19f69c604fb3", "comment": "Malware payload (AgentTesla)", "value": "fc7f66871c6d3cd918238eb78bda5369", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291831, "uuid": "eb93eb43-5dbe-4674-a688-ffe0ee2902af", "comment": "Malware payload (AgentTesla)", "value": "5bb3364af59e40b0ce47a44c17de642128094c4e72b1e232b795e24b6d8ccea1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291831, "uuid": "2ef137b1-25bc-456a-b746-106a8defbe60", "comment": "Malware payload (AgentTesla)", "value": "a32ca94a592dd503c3d706dbcc15b165fef35bed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291831, "uuid": "df7b60d7-efba-4347-9ae3-d923ae23c8b6", "comment": "Malware payload (AgentTesla)", "value": "acfa3b6627dd2d8901e3ef52d70ea34c34858210249b3edc60d8edc0758c201a1be72d394844e87d9b23606cd97cbb7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291831, "uuid": "166837ba-5d05-4bc0-888d-b3507c8b3e86", "value": "T11AC42239E374E7B4D92BC7BD402201964FB4A04E3603DB7E6B82F1C9BE07B4255259B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291831, "uuid": "ac63b9fa-3a1e-4b7c-8ede-610eeb64ad26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291831, "uuid": "93970e7d-9a0f-4e9c-8788-00109023df40", "value": "12288:8p8emtiK5oBRngsIV6Q9Y/bpReFr0USKSokyuxwuA/3:g+FoBysIwQ9Y/bPeFDbVk5eX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291831, "uuid": "d95db401-b163-4c91-aade-0430641744b9", "value": 574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291831, "uuid": "ea5fd6fd-c3ed-4f43-b877-350964055765", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291831, "uuid": "2ea5009f-2312-444c-bff0-5654136f1782", "value": "fc7f66871c6d3cd918238eb78bda5369.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446b2492-1bb2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1632321300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632321300, "uuid": "b0648cb6-f1c7-47f6-a5c8-c468443ec7a9", "comment": "Malware payload (QuasarRAT)", "value": "f017c25de6e9e9cb966782ec92fbe407", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632321300, "uuid": "978a401c-cf9a-4b66-8ce5-1d1b38f87306", "comment": "Malware payload (QuasarRAT)", "value": "5c0b34aff5e71ceed5b16e73b68435a85244a9631d7049ac0bb2898fdcbf6b04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632321300, "uuid": "5a867276-6615-4995-a980-6dedbc983678", "comment": "Malware payload (QuasarRAT)", "value": "5f3d779ea9bc1fa249f4dd25b70e21b665904eb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632321300, "uuid": "4de0010e-c56e-44e0-8f88-4654ab2df081", "comment": "Malware payload (QuasarRAT)", "value": "1816df5717800a106822e9e44de8060bc5a10399756fc5b6efab8ac8c50dcc04b68cf64df5e8b57b39ba1fb89dfbba0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632321300, "uuid": "cf1809e2-42f6-4daa-b02d-cf0510f167bd", "value": "T1CE05172C45585A9AFBA0C4FCB231ADFF17D4697F80B7B8B3D10DE68317A87E15406226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632321300, "uuid": "16d38228-f7a3-4595-9d33-c80570d957e1", "value": "cb0f17215753e2513f6e30650a54f30c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632321300, "uuid": "a177314a-7e3e-4f87-a56e-d2aa7edce7e5", "value": "12288:Kw6EkmechBNw7J/46pEbBiXfHTfZMoUaGOi02uT+WH:D6znchBI/46pEcHTfq8XT+WH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632321300, "uuid": "4e24c572-52e2-4881-8ab2-c52039832a7c", "value": 800168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632321300, "uuid": "157603a6-7d60-4deb-ac8f-1813d53f0832", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632321300, "uuid": "70f0dc96-d648-4d1a-9945-fca1c50eeb53", "value": "f017c25de6e9e9cb966782ec92fbe407", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3f20fa-1b9c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632312106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312106, "uuid": "20322f7d-8a85-49ce-b12f-84cf742fb758", "comment": "Malware payload (Formbook)", "value": "d234941b2b540c442a3b21662ac5def9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312106, "uuid": "684d4758-eacc-4bb0-b9f9-ad593da489e4", "comment": "Malware payload (Formbook)", "value": "5c0b8f534999387b9942b165576f97aa0803f191bb781ccfff9951cdea9a0549", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312106, "uuid": "57774d46-e32d-4a6c-99ef-21540dfb4430", "comment": "Malware payload (Formbook)", "value": "ab17dc3042c4ec968dfb37bffdbc528d7b6fddfa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312106, "uuid": "12ed2427-07d0-4df6-88f5-b7c5cbf81218", "comment": "Malware payload (Formbook)", "value": "f6774156c803dacd24bb5f4e5193b10180dc48fe454a9c7fd0ae18f0efbc4acb22959fe7cf14de439f4df7319f541621", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312106, "uuid": "07afa1c7-ebe2-4c92-aec6-6c0981cfbb89", "value": "T129D301F243BE2ACBC7565E3582525306775D1C728AC743CB2C05FA7A09B278E01BB35A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312106, "uuid": "6f3923c6-7dbd-487e-b2cf-5e527adebf32", "value": "3072:De6djVqrmX3M7eh2u78T5OF0Xswml7TRLO:Ddjb0uQTfpwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312106, "uuid": "68bb0a69-0ed2-427a-b382-369672ab2f8e", "value": 132392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312106, "uuid": "91bdd090-f733-4285-ab3e-6b79b74d6157", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312106, "uuid": "0725cd08-5237-4589-8e28-10b491fc61b7", "value": "Order IMIL0810.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d177806-1bc8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632330710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632330710, "uuid": "444f81f0-f2ae-44ea-9991-fc7bde068b6a", "comment": "Malware payload (GuLoader)", "value": "370a0a57b9d37b86fe57b24277654295", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632330710, "uuid": "b62c9838-edf0-4079-86e1-da0c804c0593", "comment": "Malware payload (GuLoader)", "value": "5c4b40fe89b036d415df2776865cb4c77b0cf6f4771c0afaaa4ca72524a4e4a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632330710, "uuid": "7a747a71-54c1-4487-a461-ee501a6ff2f6", "comment": "Malware payload (GuLoader)", "value": "620220353aa200d3fb2ef3bc7b607d69d7377f57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632330710, "uuid": "8519cd54-b959-4387-baba-2718550e2540", "comment": "Malware payload (GuLoader)", "value": "6f174814604db0aaa56188079384723d9675acbcac096d0cea604d3429f6e8e609954aede8c69a7e8d7d5105e1a7c3f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632330710, "uuid": "bc614a26-30dc-4c81-9332-41c3315cf3e1", "value": "T172A37BB57EAFDE27E0DD5630D096AAFC3904AC14F42B8F472E417DCA7D38E029661225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632330710, "uuid": "4aacd9d9-85c6-4f01-a462-2fe74494e599", "value": "4b82967fdfc14d4519122dc367d279d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632330710, "uuid": "a2c3b18f-ebc9-41c9-9ebc-bf11169d0433", "value": "1536:Xf+bO5o67fDTn77m7Lyf6PycZvGhWkk6YoB0l4hs5JhvX4D5/:po4fPeg6P5Zv1kkrblXID9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632330710, "uuid": "6d0e301e-48e7-4082-87ff-5bc4a17ec36a", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632330710, "uuid": "693fb3df-e03f-40bb-894c-21fbb7f540cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632330710, "uuid": "0e2b4736-7491-443d-bcb1-7f822cee4ba2", "value": "Funkt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d1edb6-1bd1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632334506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334506, "uuid": "a15fb977-7d69-4ac7-9409-8a3e1843855d", "comment": "Malware payload (Quakbot)", "value": "231b1dd8c7539e63839a72bee4113a7b", "object_relation": "md5", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334506, "uuid": "59697587-b5d8-4be3-8bd3-1b98f92bbef2", "comment": "Malware payload (Quakbot)", "value": "5d8f270f7b1d814d0e218381e129e808960350c181da47cd1e9ca9ac18acd842", "object_relation": "sha256", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334506, "uuid": "63d983fb-800d-4de7-acfa-f0714936a043", "comment": "Malware payload (Quakbot)", "value": "cd66b2ec8be8948398128773ace36eeb6aaa77a9", "object_relation": "sha1", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334506, "uuid": "9f6faed2-5b5a-4a0f-b234-948dd534986e", "comment": "Malware payload (Quakbot)", "value": "3935e3a67fbefd67aa95cbc00446377e3d5f35960c74aef30cfee4358b4c8b5d499f49429b26441455f430dbd976d957", "object_relation": "sha3-384", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334506, "uuid": "bcf7069e-1fd7-4d0e-93df-37bccfc812ce", "value": "T1AEC4AE19BEC3D1A1C83C187488A1C9F27638B865AD54D6473AE93F3F5EB31C25C560AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334506, "uuid": "e309c8bf-28bf-460a-b0e9-503d831528af", "value": "c900f0b45b7574481cc6a21428393566", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334506, "uuid": "609d425f-a09c-4fed-8b8a-8e9cfb3f968e", "value": "12288:N1ghp5DubQfErdxA+zM5miTrqZj1kENwNmhxOsNU:6qrv05T+ZjHNwKOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334506, "uuid": "b22ec904-e0ba-4265-9c29-4e505a1c79fe", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334506, "uuid": "643b740e-76ef-4e55-b52b-7a6a4775c7ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334506, "uuid": "918ca18a-5c37-4ea9-b125-da0c3602387e", "value": "231b1dd8c7539e63839a72bee4113a7b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2310e26c-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Osiris)", "timestamp": 1632316949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316949, "uuid": "d31a9717-ccf3-483a-bd21-e971572034d3", "comment": "Malware payload (Osiris)", "value": "5764f48fdd3277b92114e60010f14fde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316949, "uuid": "10b8bf5c-4421-4d49-8e57-f91b675b110b", "comment": "Malware payload (Osiris)", "value": "5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316949, "uuid": "6386c000-bc63-4650-bba7-599c039e1067", "comment": "Malware payload (Osiris)", "value": "759ca2314be4f0fa951ac4d410f1db79b594dc78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316949, "uuid": "95b6cf09-d1a2-40cf-a866-034f462c6527", "comment": "Malware payload (Osiris)", "value": "072251a4f14c3c4303dce12dbbef2c8818b631d1d0422b21d30b92a906adc470e4d40ffc46af0408e9ab4018378642c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316949, "uuid": "4127e505-c82d-484d-8e80-18c38b8b06cd", "value": "T184B4CF384185E7E1D7B2C3349CEDF5CD8C74F1002579B1EA93AD07AD99BEE111E2A90A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316949, "uuid": "064eb711-0a78-4cee-aa4e-88de154dd74a", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316949, "uuid": "9c01d88f-2c31-47ff-b262-0e3457a0cd5f", "value": "6144:m9X0GPt/p90FOKWU3TDPTuU4ldQZ7OTcaYEQSh9Ty0y6c4H3yEDFDQMb6Ph0VA4B:I02PWw9C6hlSZ6g2G0yKHp1VbWabfBnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316949, "uuid": "882f77e9-0b0e-4970-b1a2-2b6120ed84b9", "value": 540454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316949, "uuid": "c996fbe9-6d3a-4910-9f20-c654f79d3079", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316949, "uuid": "fd0e5565-9df1-4428-bd3c-ba107b8ae99b", "value": "5e240877008b5a5cdd5b9f84fb53760ee68268e935588b625f414ad633c727a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d21135-1bb3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632321813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632321813, "uuid": "b6df23cc-e376-43c9-a521-0a814cdd0c86", "comment": "Malware payload (Quakbot)", "value": "da03af474e59871fa4502f54b7ba5195", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632321813, "uuid": "4c7d0bcf-0952-4bbe-a148-f0f3443d1393", "comment": "Malware payload (Quakbot)", "value": "5e9f3da1a19859c920d3f12c0bffb8ae8b1773fd7f2dd9cc5dce3d4bb50dddc8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632321813, "uuid": "95226dc2-dbe2-4880-87f3-a7fddd5ef06e", "comment": "Malware payload (Quakbot)", "value": "9790e1335fd5c57e3d6acfe3515484d28d6ee51a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632321813, "uuid": "5ff31653-7feb-41fc-8a4d-c63974ec9225", "comment": "Malware payload (Quakbot)", "value": "fca48e38e4c023faff0ad647ec221b679b78286ce4ee2ade23b01a26e257f15b93712f3e737fbd9e67e04aeeb1c372f6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632321813, "uuid": "3e55bd92-309b-4b9c-b38b-6e79a2d485b5", "value": "T19E258E32F2A14437C5731A7CAC6B62999C3ABE107E28B44B6BF90D4D0F396423D652D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632321813, "uuid": "0b408e50-dbb5-4cf8-b273-d969b506f56a", "value": "ef7793fb29a91e2ec547fae0d4d77318", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632321813, "uuid": "c8163865-08bc-4b7a-9068-69d9aa07a8f3", "value": "24576:UFYpMTTHVlVTyv7o5pGyctKIvOO1CjdekTVzGLnHhtRfDVa:UQkT1fo+xlVzGLnHLza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632321813, "uuid": "f2846a51-c55f-4fc2-8e73-f62eef6498b7", "value": 994828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632321813, "uuid": "cd3343c1-dd26-49a7-8e3a-dc07c0d50e75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632321813, "uuid": "427e88e7-8435-4678-a7f9-a2eddfde6467", "value": "test.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e61cc6-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DarkComet)", "timestamp": 1632316974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316974, "uuid": "49e5711b-52a9-4383-ad11-21b12442d5ca", "comment": "Malware payload (DarkComet)", "value": "987a5d029c5c923724872bc013ba8eca", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316974, "uuid": "e6d5f8f7-2890-486a-b8b9-6f173a0ad77c", "comment": "Malware payload (DarkComet)", "value": "5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316974, "uuid": "a2cb837a-4d37-4d36-8e5a-f0a9da729954", "comment": "Malware payload (DarkComet)", "value": "97c2b943c9cd1625c273652f831860a72427bb5b", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316974, "uuid": "1d5e1c0e-8b11-4582-8de0-fc9731efb5c7", "comment": "Malware payload (DarkComet)", "value": "8f96794b1c37f6821b220ded33d8e121f1c697d6490ef42046c6f3e0b2e98f93625b94af1b42c850cd9bc26d47e5aa9a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316974, "uuid": "886b6ece-98f8-4e87-a3ad-36215ecf3de5", "value": "T181B4D0B1F144FC62E8D60DB1E11F36B117466F6AC898392F7584BD2E7CB3B45C0A291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316974, "uuid": "a2bad3f5-518d-40de-b3c0-c08f5c3b7718", "value": "f2d24d034ad8ae86f9dd9c6c9707e46f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316974, "uuid": "603aaed3-a1b6-4336-9ebc-c9b07c03c1a2", "value": "6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbX:f9fC3hh29Ya77A90aFtDfT5IMbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316974, "uuid": "c28c71c1-643f-45b9-91bf-0efe1ce69d95", "value": 532570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316974, "uuid": "6ec99cc9-ef4d-4b5a-8d14-23d2994f7e51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316974, "uuid": "dcaf756a-1856-48a6-b1a4-ecb8f65c63d4", "value": "5f02339f6ea514c24162fc3b22dc7fbd86a0166944280195cb931b00a39656ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfb73b2-1bc3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632328829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328829, "uuid": "090be69b-3349-4d1b-b00a-ef559d9b5ab6", "comment": "Malware payload (AgentTesla)", "value": "9bb2a3e18c27b683118ee6e51bb811fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328829, "uuid": "92383273-7306-4cfa-ac2b-720d2d56c980", "comment": "Malware payload (AgentTesla)", "value": "5f1201355e96a05bf405091064785a663ddfa0cf829bb1b5092b08f409f0490e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328829, "uuid": "0bf99590-7216-49f0-af09-4c00bd384020", "comment": "Malware payload (AgentTesla)", "value": "61df30ed804ede32d514e49b1cd83ca4fc41b186", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328829, "uuid": "fc1cfcd3-0da2-4a34-8e40-6d174cf58f63", "comment": "Malware payload (AgentTesla)", "value": "80660b67cd6e16abf17c67e1088276610b521c807b28863de7e8427e9faf103f4e9008ac9f5ace113cded23fb8ecfc5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328829, "uuid": "d9c8f0af-23da-4763-b5d4-b92ce4112843", "value": "T12472826CD16B41988F8667B8672F5F85008C722DF398913236BC97712BD2E7B502383D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328829, "uuid": "4075a684-c43f-4b2c-abb1-a9c2f102bc42", "value": "384:BpjyQCo0td9b1/iJREuxL1gGc1b+SnKrbzDull79PzWLVL3NzQ3:jjyQ4T1oUnKOlzIxzQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632328829, "uuid": "4c64898f-4804-4404-8f1f-f54f15c1c9ab", "value": 17513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632328829, "uuid": "96270239-67fe-455d-ae22-30580209afb3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328829, "uuid": "1ebcf8b1-2438-4f16-a4e2-4f007058f443", "value": "Paid Invoices.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a1e21c-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316657, "uuid": "b813a6f8-392b-4952-a8be-044c52eac759", "comment": "Malware payload (Dridex)", "value": "21c0eac5ff847c7b4c235f183d862606", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316657, "uuid": "c2b7f20c-49cd-46fc-850e-388eda21325f", "comment": "Malware payload (Dridex)", "value": "5fd931d744d7e4e2717f66c2452a6d405ac49d6f6e7dc497517848eeb6888da0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316657, "uuid": "a16c9fb6-b99d-4645-ad60-55482671db42", "comment": "Malware payload (Dridex)", "value": "02cdd2cf70fa271114e99871fe617839b41618c8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316657, "uuid": "40b31168-b36e-4f18-b982-b6ae997110ce", "comment": "Malware payload (Dridex)", "value": "d0f85b03d6cdb6ce6c7c1a0daf979ab38bee3987c3db82eebeb444cc38caf6f0e4001cda7d9f34552b2d9e497ce5802f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316657, "uuid": "e5be4cfb-f36d-4a7d-a9c6-15234091eba3", "value": "T10075D010EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316657, "uuid": "12e18945-df5b-4d60-84ef-d6ecd74e5939", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316657, "uuid": "a50de5c7-b526-4bac-a254-b207788784f0", "value": "12288:nVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:OfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316657, "uuid": "83c01676-6272-4029-9338-4783f92d5423", "value": 1671168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316657, "uuid": "3fc297db-fe52-4318-99ec-c1c81c58d43c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316657, "uuid": "df883b07-c87c-4039-b547-dc434a7f9e13", "value": "5fd931d744d7e4e2717f66c2452a6d405ac49d6f6e7dc497517848eeb6888da0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5dbf36-1b9c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632312022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312022, "uuid": "0ff8a433-ed78-4b9c-a269-d6792b4c2dbc", "comment": "Malware payload (AgentTesla)", "value": "4f33d8d889359795fb32886b0d6d9bda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312022, "uuid": "62462adf-d34e-4176-9d43-cf22d79f7c92", "comment": "Malware payload (AgentTesla)", "value": "5fe579e7a766967bba7c68841345367a09870e1c68533299191936de8f72b5ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312022, "uuid": "d5c10d9e-1b42-4ff3-a717-ddd7cbea83ee", "comment": "Malware payload (AgentTesla)", "value": "f417b7da0a4ee3a1077b852e73309c559fd25af2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312022, "uuid": "8162adf7-63bc-4575-8332-84ffe8ecf889", "comment": "Malware payload (AgentTesla)", "value": "8877d5b98e9fb4b51766ab63dfa9e3ce3bfad2c7e309e39c55d35cd5ae3ef20fec010cbe6e1af5384f7016a8cd9f3d69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312022, "uuid": "17d72106-1cf5-4c6a-8453-15537595e1c1", "value": "T170812A780DF806C0EF6FDCF76AB1FCA840FB721209C6158C714CB5660775720CA52192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312022, "uuid": "f166f65a-c36b-4904-9e02-54568c207c83", "value": "96:KbyXd2jUkvNFkp9c1BGh0teuaXE5slgEO/595crduzjs4:KbyXJQ6p9gSfVGEOhLgd8js4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312022, "uuid": "12b0b7cf-e8b3-4190-b647-5d7490d9a9bd", "value": 3840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312022, "uuid": "7359ca3a-5d8f-498a-a18a-0563640a7178", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312022, "uuid": "095e22fd-d18c-401c-9406-c3270eb69be0", "value": "NEW ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a47e4f-1bae-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632319710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319710, "uuid": "b4ebe4c8-10e3-4a2c-8d8b-562c1dd93467", "comment": "Malware payload (Loki)", "value": "46916d7e6207f371187c7ad388b74c90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319710, "uuid": "c93b47cd-bc53-4d04-bf1e-3340b6d36523", "comment": "Malware payload (Loki)", "value": "60660c7ee21173f40e54dd6c350af6e7d232544d96807650da8ff3dffd747f48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319710, "uuid": "0c4529d4-f23c-49a1-bb0a-7c556e11695e", "comment": "Malware payload (Loki)", "value": "893c0df50718dd02276702bab2baf2ef75413d43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319710, "uuid": "35d169e6-ca34-4c64-9550-a02af0eab141", "comment": "Malware payload (Loki)", "value": "fc80ce7c530217094153d67bc24178afc056754c12f79d739618c568f554564bd93bd8905290a55471552566c19e86ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319710, "uuid": "c3d30d63-23eb-433d-9622-2e7f7fb239a5", "value": "T1B2648D20BAE0C034F5F712F999B993ACA93E79B15B3451CB62D116EE26386E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319710, "uuid": "83ff11d7-15ae-4b0e-80b4-8199387bc7da", "value": "a2bc3921f9c8d145b9a6f1e3eaf1f8a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319710, "uuid": "08dd744a-c7c8-4659-8318-78ce9c64f1ec", "value": "6144:uRL4V4wpzlCYQ3sss/EVeSmKy7EJteY5D:c4V4wpzlcsL/EwSly7EK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632319710, "uuid": "fc5b4762-2ccc-4564-add6-017cfd988c3b", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632319710, "uuid": "67b795be-b9ba-4ad7-bc60-9e5c3864196f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319710, "uuid": "d9e868e0-6d4a-47af-9996-9ba087c0f88a", "value": "main_SOA_2021-09-22_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf21a931-1b3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632270852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270852, "uuid": "0cd8499e-50a7-43cc-8038-677334a9f1da", "comment": "Malware payload", "value": "b5cf7deeb63c75056cb1ad7a7a00698c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270852, "uuid": "aa434db8-a7a9-4425-8ae8-259dd659b190", "comment": "Malware payload", "value": "61fb6998bbb3f58435bbc64bcb0e00fe13777516109d7c9d22d16cc77bf5bb4f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270852, "uuid": "d0fd5f34-0d5e-4db6-b085-bd14a34f315f", "comment": "Malware payload", "value": "c244a3c03f7e7e4702c091a34bebdd22e8834d77", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270852, "uuid": "42b86951-98b4-43d3-b887-8ae5a73fdfe5", "comment": "Malware payload", "value": "02b8cb71189ecc1c774a1ee01fba13f34621ddc05d69f106955c308a02b49b9e5fec94f5a19ba6bd2ecd2c826fcac827", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270852, "uuid": "24aefd62-3045-4655-965b-280e2370d6bc", "value": "T1B93533D7CCA38CFAD5F34AFE2680EDA6ED2635D0391C175419649BCF8B060EA9743246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270852, "uuid": "3bc4bdea-0e57-4223-8f36-7aee4e590a94", "value": "24576:B2PcEEjO2nh9QtMG2CfI6DFNNLfqZMlcftjY9uUDenVJGBRhw:B2PXcOMG2CfI6DVm2cfNY9uUDkbIhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632270852, "uuid": "366f0c40-a290-4858-b678-a463519b7126", "value": 1098428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632270852, "uuid": "6e0cf0dd-88a5-4f21-b4c6-49b9d36c7cd2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270852, "uuid": "cf24be23-ccdb-4cd6-9692-a5bcdcc96bb7", "value": "\u300a\u6740\u732a\u76d8\u300b\u8bc8\u9a97\u8bdd\u672f\u66dd\u5149\uff01\uff01\u5927\u5e08\u6559\u4f60\u5982\u4f55\u6708\u5165\u767e\u4e07\uff01\uff01.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a558a5ac-1be4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632342938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632342938, "uuid": "b584333a-c26d-4dd1-b33f-96980471116a", "comment": "Malware payload", "value": "f8bae0d5097f7923556101e845207d9d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632342938, "uuid": "0457340c-43c7-43f0-84db-0e0ee97647fe", "comment": "Malware payload", "value": "6208411d5cee1faf8632b21733e4eab60de82945f22bb92c31a5305944b66df7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632342938, "uuid": "dedc4041-bce5-46b1-8d05-5efbb9110c87", "comment": "Malware payload", "value": "0aab9afaeeda576218ef787cb8be367511fe789b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632342938, "uuid": "345435af-d0c3-4a75-bc00-da3c4117f850", "comment": "Malware payload", "value": "8c58207bb2f2288e9e06a723628855b2a76b9608d619ada0bb008a01c6a61c83108449ba3f55a251945241a0019e10b8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632342938, "uuid": "16becd1d-bc13-4b5d-b08b-b7755189949c", "value": "T16FC4AE19BEC3D1A1C83C187488A1C9F27638B865AD54D6473AE93F3F5EB31C25C560AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632342938, "uuid": "98b93f4f-c009-42d1-a9cb-3d0a1b2e2a7c", "value": "027524c1b132b878765c94631d07a5af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632342938, "uuid": "e75587ad-5573-432d-ba41-fe51ed545d5e", "value": "12288:L1ghp5DubQvErdxA+PM5miTrqZj1kENwNmhxO4NU:oqrvo5T+ZjHNwKO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632342938, "uuid": "5cd2fb57-90b2-4a63-a69b-a1f6507ee05d", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632342938, "uuid": "6fb0171b-2c0b-49cb-badd-2b0858b6b8ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632342938, "uuid": "c5ceeb9d-e3cd-421a-b262-126fd3c7e7f8", "value": "44461.8550097222.dat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8fd2c6f-1ba5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632315966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315966, "uuid": "9bd4cb4b-4d92-4e1f-b328-921aeabd9201", "comment": "Malware payload (Mirai)", "value": "ed886124376377f15a8c1a7dbc207615", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315966, "uuid": "28998e67-26ae-47b6-8d32-28c2b5433967", "comment": "Malware payload (Mirai)", "value": "6277dd5aac8d4203e966cc9a4b69bdf163bd81ffbc2f3caec4fa7e6d071dccc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315966, "uuid": "f5cc94c5-513f-457d-bc6f-59c6c327c6cf", "comment": "Malware payload (Mirai)", "value": "6a99ea0935610a4eed8a2cfd4790bd2d82095de1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315966, "uuid": "0c14be42-0f76-43ed-94b4-b2ffb1c1836c", "comment": "Malware payload (Mirai)", "value": "b29ba46934a6c9424c76d168128ce9a55486a153bef1c2007dc00c1b496dcc53def7f4b40410e28b83baf22bfef7ef87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315966, "uuid": "ec4be384-6c9b-49cb-bf10-dc463396c77f", "value": "T16CC3F772B804DF66F40AD6B604D38B227E30BFA70E631662B31739669D331D52867F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315966, "uuid": "0567fed6-b9f3-479c-a3b7-3dc54de37a99", "value": "3072:L+YUpmc5hIof5UM7XgYjykKdHmm/QcuLB126DNb:LwU1of5UMPyk2Hmm/QcuLB126DNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632315966, "uuid": "cc4b9bbe-4f32-4fb5-8bd4-720fc8819819", "value": 118319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632315966, "uuid": "e2f23193-1300-4d86-8680-2fa88fad158f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315966, "uuid": "04ee2e53-a339-4cc3-b8ae-1e3b0250b7bb", "value": "ed886124376377f15a8c1a7dbc207615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95c7752-1bba-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632324932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324932, "uuid": "2fe4c668-dff5-4983-af52-b1108dd554c7", "comment": "Malware payload (RaccoonStealer)", "value": "ec7fdc10748fd14738be508678c2b234", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324932, "uuid": "9a060c8a-b920-427f-b72c-4e4b288dead7", "comment": "Malware payload (RaccoonStealer)", "value": "628cd6a9f062219788b44db9c55eca8492d56867a27f228137aa5e5839fa5469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324932, "uuid": "c7057ded-7000-40d9-8181-f9952a83b4f7", "comment": "Malware payload (RaccoonStealer)", "value": "84b7e5b999e347784b2b9d315576e840d20c84cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324932, "uuid": "aa58085d-9c31-4101-9036-7cac5836422b", "comment": "Malware payload (RaccoonStealer)", "value": "3345c92627e049eb0ddc7be675c7874f179518cbdb7d60d704368302b86670164724ebe1a7fc9ddae268e856498c30a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324932, "uuid": "f033eaf7-eb5a-4dac-a22d-cbd94ce59130", "value": "T1BB65001C37D638E3E094813F6911BB5D5DBBF30B2163892A29B11D9A7CC09E56908BFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324932, "uuid": "f462432c-4abf-409f-b298-3d7a0ca1c3c7", "value": "67260fb2ac11e8fa504fec7af97d8fe1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324932, "uuid": "e78d95ca-16cb-47c6-9256-89e7df6c8dba", "value": "24576:AgqmSOrR6F+HhZ8XzQbcJGhbioVDSu82kX4eTp1JpQDCuPUKSO+LxaKb8:81O946hqXzQbcJCzV581X4eTjuPtSOkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632324932, "uuid": "48ca1070-9d98-4d33-a13b-6d6cea311415", "value": 1516544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632324932, "uuid": "a0c01a5b-18f9-45d0-87ad-d54466f5378a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324932, "uuid": "d43d4fba-5b71-4638-b0cb-187149becf7a", "value": "ec7fdc10748fd14738be508678c2b234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5036db19-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tinba)", "timestamp": 1632317025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317025, "uuid": "e074d928-0181-4363-a719-d30cc4dc0092", "comment": "Malware payload (Tinba)", "value": "321bb8a5582033a0d74b6299a5a54d14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317025, "uuid": "34aa5e67-4eeb-4cc6-82fc-0b47c47b6ca0", "comment": "Malware payload (Tinba)", "value": "63e068a4fbf9f661711df113fc18fe8ebdfa01c34996f8d933b4096a430738a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317025, "uuid": "7830d04c-b5b6-4a20-ad62-bfd05adaed6c", "comment": "Malware payload (Tinba)", "value": "27ca2ef1b33e3664ea078388df60eba74c4e1bfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317025, "uuid": "8830f130-c838-4bd5-b7f8-c851e2de908f", "comment": "Malware payload (Tinba)", "value": "e75a446a603831ee61ae7de1cf44875c54693503e8cb94e563f283030235e3e66dd1e15ac22abf5b73c672ea1f5fa284", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317025, "uuid": "b71de47f-dc6f-482d-a3e3-3391c80bdca6", "value": "T190044CB1F204E48BD957D8F2991ECD3158623EBD99A0450D32E97F6D68B37D20059F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317025, "uuid": "4c8a4657-5d0f-41db-bc9d-26498e015f6c", "value": "043271249094384096fe3a6b9e4520d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317025, "uuid": "513ce18d-947b-4559-93a9-73b740d18a32", "value": "1536:YtwyCPx+riFFG1kF/m3wEYQqjh+rmKVsMiVPkSNRA:7ycYqdFEgjwqWsMMsaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317025, "uuid": "8e339427-2987-4f69-a784-35c1a950419b", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317025, "uuid": "bc6534fe-069d-4f05-b014-f87ac0e349d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317025, "uuid": "224cb6ee-fe17-4dce-8590-52e7e96a7d63", "value": "63e068a4fbf9f661711df113fc18fe8ebdfa01c34996f8d933b4096a430738a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9743bb31-1b42-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632273336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632273336, "uuid": "47a9209b-884a-4223-86fd-5d99a683db85", "comment": "Malware payload", "value": "e22d7cd27166ed12fd707e5b4b66c7d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632273336, "uuid": "fc9d55fc-db22-48c5-9370-4c17cc701406", "comment": "Malware payload", "value": "640ea5a2c4ea4a2d1a5018f446c0b722407e21f2ec5b81ce2986c037e3f11a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632273336, "uuid": "da4e32ae-3aab-4176-b1f0-765a16e1b407", "comment": "Malware payload", "value": "901720cc3f9e1a466d804c32353501f8cc36a90b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632273336, "uuid": "0ad470ee-5ca7-4838-8fdd-7e6189952ff5", "comment": "Malware payload", "value": "984f02832ecde54332f04b6f1996ed36a1b353b2e362af6db9b8fea5eba29f70511e2e9ae878a816259a5679ebcf6963", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632273336, "uuid": "2cef7d50-7453-4f85-9079-2ec9d3fe0c63", "value": "T148D548092B921760E79A7378D875925104985F131F68C0B64EB45E1E7C22A9EFC33FBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632273336, "uuid": "bc7cd74c-1753-47fb-8912-d0a754372908", "value": "f6c4d50d87d4e0d20a5772aea6d13e30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632273336, "uuid": "d4490c0f-4171-48a2-92e6-4d3c0e55af08", "value": "49152:GbsVWAYJjeTIqToZu8Pazb7iOWmOSRTlJhNpccM8sMTbL7rbL7rbL7pR:GbUWA8yhB7ihdSRTlJhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632273336, "uuid": "3884228b-f848-466c-a100-8b84395c9d2f", "value": 2770432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632273336, "uuid": "7d7c0a01-3e3e-4cd8-a484-ec4f484acade", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632273336, "uuid": "66db76e3-97d6-4b1f-8be0-96ca6329be8e", "value": "\u201c\u6c5f\u897f\u5c0f\u4f19\u201d\u5728\u201c\u8fea\u201c\u60e8\u906d\u9e21\u5978\u3001\u97ad\u6253\u3001\u777e\u4e38\u88ab\u5207\u89c6\u9891.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0d5c47-1b9f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632313394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313394, "uuid": "5a222de6-b2c6-4080-8444-b14ff449434c", "comment": "Malware payload (Gafgyt)", "value": "e565c935339dfaa5d954f24533e0bdfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313394, "uuid": "f7f2cb7a-c53c-45ed-942c-28ec337e6ac5", "comment": "Malware payload (Gafgyt)", "value": "64692b2f015f8e6fa4b5f588230e506a85eb804edb11630bb78b5b9fd9c0ad32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313394, "uuid": "b66c71f7-b561-4fbe-9c27-301e375e6035", "comment": "Malware payload (Gafgyt)", "value": "e6844573b2368494a7a6e5c7a07fe49f4eee61ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313394, "uuid": "a0151b17-5fb5-4e8b-88ea-53249ae56afe", "comment": "Malware payload (Gafgyt)", "value": "efd7f98d0827bfc2816ee570ab0f7786c6bcea3a8e56d585b08f2b1c61b7ceb1508ad90ac371c49d8d8ecd51b6012f95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313394, "uuid": "4e9522b8-710c-4f69-a018-03133c090a4a", "value": "T162835B27A551C6BFC0C74AF82BEB99614463B83A1B37320A73D8BDF92B159C41D69306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313394, "uuid": "71c80ce6-ff5f-4681-8ff4-91699ebfa7c3", "value": "1536:Vz7+JBXJVSqO4TZuwORPYA219H0QX5O3Hoh3TAmoIYuOVje+ZNne:RaVSMITRPVYUQX5yHoh0mrYuOVy+ZNne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632313394, "uuid": "bfb3888a-f136-4e57-8068-dace6b6c5579", "value": 85291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632313394, "uuid": "5e904a69-971d-488f-8d7a-91dedca6165c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313394, "uuid": "147d0f47-1a72-4ee7-8c73-828f69ec6ca3", "value": "x-8.6-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0f4c56-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632317122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317122, "uuid": "ba1e0762-6a9a-466a-9a9a-3ffea12cf430", "comment": "Malware payload (Gafgyt)", "value": "5db99228c4cb6410331c70b6aa6b68a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317122, "uuid": "4c31a3e0-cce9-4496-b8b8-743fa1ef61f7", "comment": "Malware payload (Gafgyt)", "value": "6475df2ea37e876334789dcd374c84fa7d1f6fdfe4625d3408b042d5780c2a52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317122, "uuid": "04c7d1d4-3f45-4efe-90c5-ce92cd2907e1", "comment": "Malware payload (Gafgyt)", "value": "df5b990a961735c61e67ad9a6dcbe622bc13a88c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317122, "uuid": "81917f5c-1303-4feb-9813-b66bf5af5368", "comment": "Malware payload (Gafgyt)", "value": "d1e394d24cca821680863594c10549758ea1cc195f4cb169805455b0563027077e3180f52e879947a9cff8c9a9931a8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317122, "uuid": "f5362316-cdb8-4548-8445-f3056815a04a", "value": "T118C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317122, "uuid": "d7973d4b-fc64-4303-964f-d03df57338ca", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpH+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8EF+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317122, "uuid": "c7a71a97-bdd5-412e-9df6-42e242c4f876", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317122, "uuid": "3bb122a2-2624-452c-b8a3-b756427693f0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317122, "uuid": "814ed49c-a78b-4128-8260-f2bb17dcc751", "value": "5db99228c4cb6410331c70b6aa6b68a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20e3658-1bb3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632322021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322021, "uuid": "00d33b60-693a-4ced-bf5a-4d621d9b8484", "comment": "Malware payload (AgentTesla)", "value": "190cf20ace9aa9cc41db31be3405b0d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322021, "uuid": "3c93b3dc-f547-4f5f-b47a-505c999bdf1f", "comment": "Malware payload (AgentTesla)", "value": "65dab97ed496ddf1b43a44e95c687805150d92a97bcc9b1b28600ad6a20c1547", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322021, "uuid": "d6821673-929f-4900-b79a-938552659dcf", "comment": "Malware payload (AgentTesla)", "value": "1c20e9718fca517437159b03173498a0a5c8dda2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322021, "uuid": "571d309e-82aa-472e-a7e0-4e9796ed5886", "comment": "Malware payload (AgentTesla)", "value": "424f3aeb01a3b2b533d4bc1780eb4cfdb1baa7dd22c8b48a777523d02fdaf7d0a8d4dcff59d073a80b9681722d681ee0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322021, "uuid": "bfb0f7d6-6627-4adb-ae5e-26c22ca3d17d", "value": "T1FDC4123DC25CA771CA6EDA7F206541510FF2A1C63A57E76EEB9A71C5BD0BB102100AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322021, "uuid": "a3c13b2d-b264-4eff-8055-9120e47a19d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322021, "uuid": "a8b4c9d0-9a89-4408-acbf-c4806c3ed536", "value": "12288:JQlLmtiK5oBGwPpDJEFvF+8l7+uVJZoEeXprBmR6b8Qou8PorZZjJLPAlS:A+FoBfB1EFvj7+uVT3ArBM6ZworZZBPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632322021, "uuid": "1fba1cb4-ad90-4283-a6b0-5f5ab1c9368b", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632322021, "uuid": "6cf5e6bc-2d4b-4b2d-a017-9aa627b83b27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322021, "uuid": "c626b7a7-6b16-4480-b57a-8bf3f3d7cdb9", "value": "190cf20ace9aa9cc41db31be3405b0d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a9fdfe-1b74-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632294665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632294665, "uuid": "8fca90aa-1b92-48ef-ba38-3130fdb37f7a", "comment": "Malware payload (Loki)", "value": "9339be8f2e3926ace3180a2043cc1af0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632294665, "uuid": "65213b9e-de8c-4427-9c24-cfa477791eae", "comment": "Malware payload (Loki)", "value": "667659ec54de7ba19f80b9f80cbb0ef507115e8882c8af51e06bdf4d3407863f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632294665, "uuid": "75f56222-4c35-4514-a557-9878b9d2c4ca", "comment": "Malware payload (Loki)", "value": "70841b55390aadd05fee7d027d5c37436fbdcabf", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632294665, "uuid": "4a60dbaf-bfae-40f6-8600-6c745c8acb4c", "comment": "Malware payload (Loki)", "value": "206d8814a50047450b3dd6f75378cdbdbd1f73ff15bca9401a480bbc30dd4a6bc2e115d0bd6278a29a12f9b32edc8153", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632294665, "uuid": "c752213e-656d-4205-bf96-926452959cbe", "value": "T1F214BC7F28EDBAF6F9857A3A07B0D2AE1555BC59E5A554BBD834730ACC38E7140C3402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632294665, "uuid": "b22256f2-b1e8-4ba2-96c7-5e0a3ac17142", "value": "3072:AkURwpvSq0s62dqKjkOxcXk+qFTD9guuHiUBs99gl0g4aMkPhE/62EeNvohKvL/:Abqr0s62dqSekPhD9guuCBil0g4iPe64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632294665, "uuid": "f0700883-82ae-480b-a258-0ff091d1d87e", "value": 194952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632294665, "uuid": "ac184c87-efd5-4c42-a0df-a0161e72c317", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632294665, "uuid": "ab9feedc-e310-4580-b26e-2da028019725", "value": "RevisedXinvoiceX2.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5dfa80b-1bae-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632319880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319880, "uuid": "146304b0-640b-4523-b43f-98cd8e1bc3f0", "comment": "Malware payload (NanoCore)", "value": "878f3ed2e9de4b289fd0e76891c7d56a", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319880, "uuid": "0cd528be-c89b-47d8-9fa7-dc2529fee2d3", "comment": "Malware payload (NanoCore)", "value": "676ed6ad256e26cb2682f15b52519fafa8bdad55a44312fde1287fdba2da3f94", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319880, "uuid": "974acacc-5dd2-4059-bea7-f11c1da8d82e", "comment": "Malware payload (NanoCore)", "value": "64948ce6f53e70c62e5d4c69e9b85557d8a0792f", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319880, "uuid": "302204d1-4b88-461b-8f26-a5d202627cfb", "comment": "Malware payload (NanoCore)", "value": "736d225b5c24d1b6d628c7ca47b5da831b6043064767f58bdb1ede1eeb2004ad3b83642cdd5fe8e44b8d433c9b063b75", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319880, "uuid": "472cd2a4-e35e-41c3-82ce-62688f1f2b70", "value": "T1DDF1133CEA0376DD741D5E2D09CB77295A10C0B5C953E6F9C740FBAC69EEA40AB51238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319880, "uuid": "4f538ed9-bb76-4c22-9564-874ca96be271", "value": "96:P6NTJhS9INIKMVGQRX8+HLz9spiINIVIWjnCQRX8Lnaa:P6NT2INIRRX8+Hm4INIVI8xRXAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632319880, "uuid": "0c788626-3208-4e65-aecf-e9e1a472d08c", "value": 7697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632319880, "uuid": "dec99c6c-1798-41dd-8381-215fb41c6c8f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319880, "uuid": "9c3763ad-4eeb-4852-b46f-fc8478b26c3b", "value": "14_Items-receipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c240c73-1b42-11ec-8fa1-42010a9c0011", "comment": "Malware payload (YoungLotus)", "timestamp": 1632273290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632273290, "uuid": "9296e908-6c53-4692-8a42-1c3edf48a141", "comment": "Malware payload (YoungLotus)", "value": "90fd196461d352414fccfaa316270230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632273290, "uuid": "da2373ac-26a7-4af9-9360-c4df278e2dc1", "comment": "Malware payload (YoungLotus)", "value": "677c50086e510566e3b7d2b0a1a7d799caf3fa2ccc30d60d3abb58e32de04bd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632273290, "uuid": "579e83f8-5be5-448b-b003-0a176bc7077e", "comment": "Malware payload (YoungLotus)", "value": "89c3a886a6f25365d21c4676e949babd8f7c4c37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632273290, "uuid": "57278915-b0e8-4f55-8569-910707050334", "comment": "Malware payload (YoungLotus)", "value": "93ff9424f1c4c4690fea9e37eee8696c02639c4df045ed7a5eed84ba78fda38857378d145e662689bdd6393231b76b08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632273290, "uuid": "4eab49eb-4a1c-43cd-93ce-5a06ce65a1f1", "value": "T184958D22A5844065C1AF197040AE3B37637DBE9C07E01DC74794B9E9ADF22C1FE35E9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632273290, "uuid": "a1f443ba-3926-4cf9-93f7-a186480fee1a", "value": "05170c3952c47a73573887e0f56a9cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632273290, "uuid": "aa639ad2-356a-4da8-acbc-c585470b418e", "value": "24576:/gEqjFFSse98rXUwqwYSQ4An/wHvXk/AcH1Th7++Vzdhl+tro2EcmmKApKKME:/g3oekwqwG/TK+VAum3pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632273290, "uuid": "a98f5dac-9d58-4eb5-b586-f9cb77347d3b", "value": 1978368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632273290, "uuid": "0c9a7f57-c00e-427c-be16-0f75c510a8a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632273290, "uuid": "ac756989-94cf-44cb-8de0-295aa7c5058a", "value": "\u201c\u5b89\u6eaa\u5c0f\u4f19\u201d\u5728\u83f2\u60e8\u906d\u6bb4\u6253_\u94c1\u70d9_\u777e\u4e38\u88ab\u5207\u89c6\u9891.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d9c944-1bc1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632327638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632327638, "uuid": "06fdda5a-b337-4cbe-ad41-ac88d6df723f", "comment": "Malware payload (Loki)", "value": "ed91a5f4f2ef0d2178d5d71a76702c68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632327638, "uuid": "41df4f5a-dc77-44b6-b71c-b7e468c89b38", "comment": "Malware payload (Loki)", "value": "67c9a935217e16723bf422dad6f651c20813c67994144d4919d86633049f4580", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632327638, "uuid": "52ee4512-936b-4898-8d04-996880977b1b", "comment": "Malware payload (Loki)", "value": "915a1722d1123f5bc48afec3498b0eee698c1893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632327638, "uuid": "f9a01af0-50a2-4ce3-9f87-70b23e175ae2", "comment": "Malware payload (Loki)", "value": "4a9ada9faec65f3f5279ce53768509261b481379e79244820b7c9f447ff3048a13bc399d42296ada3dd150be4a6e1990", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632327638, "uuid": "82eab924-f031-4c5f-b4a5-c78be85f1b74", "value": "T143B4E01572ECA036D132037B08AAE4619A6DFC706E7B096B3BCC1B8D56741D09B36B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632327638, "uuid": "4f718b98-8207-4f07-ba1c-8acb217b70fe", "value": "337cc3ba01595b56bed66bb7d8f07a5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632327638, "uuid": "ed8fe770-8d4f-451f-b0d7-648d8f41d933", "value": "6144:kuTCdGyheWYuvS9LUMhKYH1FBr2oqUecXkb2VTc0+iD31vL2BXyXz5FHxVpjoT:R2kGeWxvSgMlXmHOkKVTrhSXCjHxVeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632327638, "uuid": "138400c1-0a7e-44cd-83d4-640e886d52c8", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632327638, "uuid": "d2c918b4-2f49-4a83-a813-bb89f43d5226", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632327638, "uuid": "46aadf10-db76-47fe-8607-77ec46757f60", "value": "ed91a5f4f2ef0d2178d5d71a76702c68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb0ed96-1be7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344349, "uuid": "83fe252b-d14c-4ecd-82c1-a14e4b88721c", "comment": "Malware payload", "value": "043b216471565a2ffc680255c52930a6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344349, "uuid": "c226ffbe-64d4-496b-b5f3-015b4c685920", "comment": "Malware payload", "value": "67dc6d5433dccd9199d12ae66933a82450b06a83a753bb8eecffb63d20f30bb0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344349, "uuid": "596e90ba-8daf-4378-8bbc-7e15ce9cca37", "comment": "Malware payload", "value": "4f5e2e597d8a0c9ce910897b7d2a52aa87f3dd65", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344349, "uuid": "03b289f9-7fa3-4c9f-a09a-cf1c4f1bcca2", "comment": "Malware payload", "value": "f9605b2415a3276b536a18b12c774cc9ad4acc1eefc7a4e414e116f76081870598abdba49a296c0f1fe3eec3a52a4e92", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344349, "uuid": "856595f0-e165-4eeb-9978-7146000dc2e4", "value": "T13B9423B7A6D9E155FA7EB6B16A78D8E130D26951F33082DC00BF92DC41A90D0F5F48D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344349, "uuid": "03d4df85-7af9-49e1-b213-b8e0855f9fa1", "value": "6144:YvP6tbv83jdRRwxg300+iGD9NQ9AuKqF3aw7/qmUQT2qb8My1xHz62zIm4wNnis4:G3jdRRrEkd9ZFl7/qmUOyrE/GW6c75V3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344349, "uuid": "f2b70160-84a6-474c-810c-8556348e9269", "value": 446572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344349, "uuid": "b6c725f1-8847-44e2-8682-5f0f6725dcd7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344349, "uuid": "9229f8db-d89d-4bb6-9123-78b980e4e8f0", "value": "\u8fea\u62dc\u5973\u72d7\u63a8\u88ab\u8f6e\u5978\u66b4\u6253\u89c6\u9891MV (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2ec213-1bf3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632349177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349177, "uuid": "9ca368a8-a5dc-4cf5-9a4c-1ed84ffc2a04", "comment": "Malware payload", "value": "a77ee18833f79b86262d4f4876a252a9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349177, "uuid": "a9872c9c-d58e-4ff6-a1ec-4694669abe35", "comment": "Malware payload", "value": "68806e100eb54e0f0a02fc1e97f205eb72b768f2b8b238433b169749c3dec688", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349177, "uuid": "520e5155-0fc0-40fd-894d-c5dd8adc8ae8", "comment": "Malware payload", "value": "efcb36e4b40493ccc361541495d3084b4275f30b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349177, "uuid": "e42d241a-2cb6-4abc-a3b0-e2387381eb18", "comment": "Malware payload", "value": "7b5b56b9829e72a1a308144fc73a0a71b80c3c413518322bcfd5413a1fd390c2c899b443d96cbf01e7d56a8349717817", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632349177, "uuid": "fc492419-f339-4be4-9e87-be1f2214373b", "value": "T17AC4AE19BEC3D1A1C83C187488A1C9F27638B865AD54D6473AE93F3F5EB31C25C560AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632349177, "uuid": "46fed48d-fc66-40f2-ad3a-f69b5b87df7c", "value": "027524c1b132b878765c94631d07a5af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632349177, "uuid": "0ea69c14-c1bb-49f6-9e0d-462844838490", "value": "12288:o1ghp5DubQaErdxA+PM5miTrqZj1kENwNmhxOANU:ntrvo5T+ZjHNwKOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632349177, "uuid": "4b2ac7f5-cf29-49f0-8fe6-e7156a978e60", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632349177, "uuid": "25b6d85c-10d1-40fa-8ef1-91ab1ae45a16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632349177, "uuid": "f9e5d599-414a-46fa-8382-5ab165e2aabd", "value": "Xertis1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43be513c-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316575, "uuid": "e3e4dbeb-669d-4550-8f8c-39798a0d3589", "comment": "Malware payload (Dridex)", "value": "9fe6f14d90691909e807bcad199db524", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316575, "uuid": "bc9980ce-13c7-4f2d-a28d-469cc332c69e", "comment": "Malware payload (Dridex)", "value": "693cbd3b6ee55248f51234efad19ea4b76dec07ca308ed2dcf592d44d44bbbbe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316575, "uuid": "fd16d700-1bcc-45eb-8479-53765bd2c2e6", "comment": "Malware payload (Dridex)", "value": "832caf4bd5679a2f3143f41ac2d47ebf23f11436", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316575, "uuid": "9430313b-457e-42fa-839a-6b953b51f685", "comment": "Malware payload (Dridex)", "value": "7e3bfe0def7dd049690ad9ada30709f95bb5d64e35a6856cf411cb7513218fbbd5e55c612d3754a140d2b737de552b7d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316575, "uuid": "5604c010-4efd-4ae5-8310-6155d13fecbd", "value": "T1CCA56B10FFF205C3C09DF739789D3415B2B3AA65811F8A1D824F131E6CA5B912EAE95B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316575, "uuid": "79d59d8b-7e51-4512-b44c-1c8e0c57ab35", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316575, "uuid": "55a8f6ef-471a-4bd9-91c8-d57648f373c3", "value": "12288:mVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1JU:7fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316575, "uuid": "18bfc902-a579-4a5b-a2ed-a43d1e76661a", "value": 2166784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316575, "uuid": "203608f1-d407-4113-a71b-9362710dfb3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316575, "uuid": "3584c799-c5cd-4e27-b208-864b6b54266b", "value": "693cbd3b6ee55248f51234efad19ea4b76dec07ca308ed2dcf592d44d44bbbbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9fa6ad-1b56-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632281831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632281831, "uuid": "e6a41789-d360-4705-aba7-fcae1269cff4", "comment": "Malware payload (AsyncRAT)", "value": "fbcdcc592b157df04124c0f924f229e6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632281831, "uuid": "64a3fd90-bf93-4c4f-ac6e-5ec153fc2525", "comment": "Malware payload (AsyncRAT)", "value": "694f1fbb561908c9ec6de31247da72000714adb53cba81f4d03d4b9ecb99a7e8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632281831, "uuid": "11dd829d-5730-4eb8-b96e-f44ec42003d5", "comment": "Malware payload (AsyncRAT)", "value": "a691afcf18c94bd8fd20bd647f1b1d43d956a01e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632281831, "uuid": "f23dd1bf-e5a6-419f-8e0d-0e0bc0c75e6d", "comment": "Malware payload (AsyncRAT)", "value": "8fbfa4ecb78d2949ec567ab9420e034d5f1a4f551f47d0a4ad53097d8fd70471ecd353d9ff36b314e900a69a6e365027", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632281831, "uuid": "6cfbd77d-7fbc-4f31-adfb-d949381337a9", "value": "T184446E1661CCDBC2CC2E25350C9DF6587A629F973D23CE1B2E89F26D447268646B313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632281831, "uuid": "d0004e89-4b5e-41f0-a222-456669ff6411", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632281831, "uuid": "c2766bd0-dd28-43e8-ab6e-b3594e7423b2", "value": "3072:WudsbRjH0ScSqHXHnvDMKstl3FvdW2xwnPMYh:WesljH0ScSqHXnjstl3Fw2xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632281831, "uuid": "b345b03d-bcc7-4431-a039-6976dce1ad5a", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632281831, "uuid": "fee41282-ee67-4790-9dec-323b5fc072ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632281831, "uuid": "ae927683-ab73-4812-b43c-7cc15aa798b7", "value": "P.O-20210922120155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34742125-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632316979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316979, "uuid": "729ffde4-0fab-4057-bcb5-212dfa8ba81a", "comment": "Malware payload (NanoCore)", "value": "45739915b984a5d1f41bede850106f6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316979, "uuid": "a4e0da74-b12b-4827-9c8f-124d09231c94", "comment": "Malware payload (NanoCore)", "value": "6991325be32fe8262c81cb67d7cc82307e0cb4fa8a6b684e341be8676869c3f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316979, "uuid": "278dc1c1-783b-4532-ad14-d1abeb23f478", "comment": "Malware payload (NanoCore)", "value": "82091a6f32818f5301186410f9e1924362b0c1ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316979, "uuid": "a7112d43-6b34-412a-96b9-aa5c78d5124b", "comment": "Malware payload (NanoCore)", "value": "f2c28f52c0ef4d1dd156fbdb69c18ba869348440050319948169c7cb58834d1b317fcfe9a447c6ff74237fa64ba17026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316979, "uuid": "df5e908b-bcf7-4305-9dd7-d9021f3bd307", "value": "T17CB4C0343AEA8019F177BF798FD574A69BAEB6633A03D81D2091138A0713F81CD9157E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316979, "uuid": "8b6ea9fc-0eca-4ffe-99c9-7536fb49d46a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316979, "uuid": "ebfcd12e-0d9c-4bff-b641-c96e8eddc110", "value": "12288:WhgWHCM2K4CpaJMcmsbE8vImhk2qnVJIlKE:F3CpmmsI8Phk2qVJQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316979, "uuid": "407c37bf-8e6a-4d49-9f6a-219de337bfd4", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316979, "uuid": "28ba5d33-cb4b-4dd6-adff-e76a7661e20c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316979, "uuid": "5d899ca8-b9be-49a6-ad9b-b3c4b2f0bc58", "value": "6991325be32fe8262c81cb67d7cc82307e0cb4fa8a6b684e341be8676869c3f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9362824a-1bcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632333888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333888, "uuid": "809f5d15-c2d1-450c-b254-7a1320a1acb6", "comment": "Malware payload (Formbook)", "value": "53e6956b5341f29f79e6681ccf33b162", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333888, "uuid": "d19d7b40-9a97-460f-928f-927cdf4a7889", "comment": "Malware payload (Formbook)", "value": "699ac8f16c67cda47a80657cce69cbb8b42d711a9e4609ad6a8ff2ed84119b01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333888, "uuid": "7ba2b148-2aae-4cbc-b210-977145498f53", "comment": "Malware payload (Formbook)", "value": "7f921191452e28587b4fda895e674d21b51e4d26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333888, "uuid": "19b6f0f2-ea30-4da1-bb1a-803dcf233e01", "comment": "Malware payload (Formbook)", "value": "ad966e5374dd46b8cf08129d02b86b59e9fe3f8da857d31413101bbe4398203ef4d06e065ca902f285f2db0b6999f8f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333888, "uuid": "8ce525b0-749e-4603-8c97-b5bd83297477", "value": "T197B41238D266EE75C9BC937E212195950F70E18F3637EA6EAF8670C97E07B41801AC71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333888, "uuid": "4e80e979-d68b-4335-a15f-3a58fbf7f712", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333888, "uuid": "c42618b7-1d52-4978-81df-fb061bcd034a", "value": "12288:tNYa6mtiK5oB9b2bXyA8BEI+uZAg0YVn+b9LT/:o+FoBlTfETueQVna9LT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632333888, "uuid": "2102b729-5582-41a4-90d6-aa399cc7e7a8", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632333888, "uuid": "b8d22c70-d79c-4c66-84ad-fe5f6fb076fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333888, "uuid": "a6367fbc-9d39-47c2-8cc7-24825ba63476", "value": "53e6956b5341f29f79e6681ccf33b162.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99818cc7-1b6b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632290949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290949, "uuid": "1146f56b-5cb9-4f24-8899-77e332e7bcc5", "comment": "Malware payload (ArkeiStealer)", "value": "161788eb8dc284ebbfe395403eec8e76", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290949, "uuid": "f7d3f321-e145-4aec-b803-ce04bbf92f77", "comment": "Malware payload (ArkeiStealer)", "value": "69fb7b86d91b3770791529e3edab3aa7ed335c7cc66c8027f401fd4cd4088034", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290949, "uuid": "0e1b9e8a-fd35-4f2d-a76c-13d602ab8c53", "comment": "Malware payload (ArkeiStealer)", "value": "6e3399f069e48b621e7a914ee351b90103346ca4", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290949, "uuid": "49d1f8ec-43b2-408f-a0d8-fc9b7660e0be", "comment": "Malware payload (ArkeiStealer)", "value": "03b2d5468459bf7287f06829dc46e716dd781ee2632a9ded225acf8a706a864958bef8bceab8df2e4425424f7d847cad", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290949, "uuid": "fd4b395d-65d0-4b67-9867-4db3b78a1d49", "value": "T15465E025D281F033D2B3FA38DD9A9B7F9B387E103914180B6EE82D691B253C1B519767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290949, "uuid": "61da06bf-2f37-4e5c-a8a7-2503a54da23d", "value": "c32368f78c61cf2d9d6654d89861a9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290949, "uuid": "231e888a-f4a9-4c70-ab57-2b1c5f825b71", "value": "24576:HBuzcdGnDDANFX9qOZGPlhOCoNS8M7TRNF8mTWncJ4UdZpK:H2DsXxZwxiURNF8c/7dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632290949, "uuid": "da7eeeeb-8a4b-4831-a529-9131e0747801", "value": 1534976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632290949, "uuid": "3dde172f-a914-4d65-b7c0-ee68a6d14eab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290949, "uuid": "495b01b7-8b53-4643-bb1d-9148e11cb31b", "value": "161788eb8dc284ebbfe395403eec8e76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427dba96-1bbd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632326021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326021, "uuid": "9b0ba511-1a0e-4ebc-bae3-38e963616995", "comment": "Malware payload (AsyncRAT)", "value": "12c362532de942750b035854d1795308", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326021, "uuid": "1d85e494-dc0d-453e-b710-a3720e94b7db", "comment": "Malware payload (AsyncRAT)", "value": "6a8e8a128fdcb667d738763ed93b347cd14642059245283acdac17dcdc2c1ccf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326021, "uuid": "e9bceddc-35a4-4e3a-bbc5-4f9721f09c23", "comment": "Malware payload (AsyncRAT)", "value": "f4e8407dc6fcb26ccfb4b8d4862ece8548bfe4c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326021, "uuid": "a10bbdf6-9612-4b26-9e76-73747d5cdcbe", "comment": "Malware payload (AsyncRAT)", "value": "d378248b1b1ba857270a97ca3d1eb0808a9bd9a95ae12104f0d345b9556b6905a3e6bde63ac6c82199c6d7f56484c908", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326021, "uuid": "73e7813d-ba5b-49ff-9c3a-365424d3ca49", "value": "T1EBA45F2C45585A9AFBA1C4FCB231ADFF17D8297F80B7B8B3D10DE68317687E15406226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326021, "uuid": "a85dc106-aa59-4f1e-b80b-21305f4e84f9", "value": "cb0f17215753e2513f6e30650a54f30c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326021, "uuid": "007726ae-f31f-4c1f-95bd-d750b4576dc3", "value": "6144:COi2lYEkmDy4S2fhBNw7xccvTQ2fRXzC8+klVKiEgT8jc5J8:Cw6EkmechBNw7J/46pETAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632326021, "uuid": "869d2085-d068-4deb-9045-53efab018441", "value": 489896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632326021, "uuid": "e8aee50e-b138-45f8-b4a0-02d2105aea05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326021, "uuid": "e1954be0-865c-4274-a821-51cc4b8f2b98", "value": "12c362532de942750b035854d1795308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9bb9d6-1b6d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632291684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291684, "uuid": "b44de4e9-f89e-4db5-b2f1-6beeb2148642", "comment": "Malware payload (RedLineStealer)", "value": "bde697a262c604a556e743cc54914af8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291684, "uuid": "897e6f9c-77a0-40cc-8dcf-3c340f4a8fb0", "comment": "Malware payload (RedLineStealer)", "value": "6b273adc70d7d50f4109494b66ec0a10f0943dcee95dd93e762a9ee6d2bf79cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291684, "uuid": "ac80d6ed-94ae-4818-ae6e-8cd358164907", "comment": "Malware payload (RedLineStealer)", "value": "df7936a359bc094835cd6e64627a38d032bba67e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291684, "uuid": "db404331-ee20-4560-893b-8286779bff63", "comment": "Malware payload (RedLineStealer)", "value": "5534df3da66e3cd7fa74ee056c0783f58f9c962443810ec5faa07fe4f720fa10c916e4fab5878e78e74b8fa8370f3fba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291684, "uuid": "18f71fc4-31cf-4e1b-b783-2350d4ff9a87", "value": "T13864E0017EA0CA73C9A305318D20D6E07A7EF921F961DC47676AFB7F6E30690066635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291684, "uuid": "49366253-b53c-473e-b32e-17ae2d90f9ed", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291684, "uuid": "867ee93a-8303-4da5-80aa-feac75dfb422", "value": "6144:+qP/VGZqbiDuGJk896fUhK6kD6J7aBwjt4:zXV9bz89SUhE6NaBay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291684, "uuid": "c3d4e190-535e-4952-890e-15d3be09009c", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291684, "uuid": "1899796a-a02e-4f10-8a67-3c1906bac385", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291684, "uuid": "4759bafc-773a-4d5b-84ff-0c07489b2dc4", "value": "bde697a262c604a556e743cc54914af8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ccd909-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Osiris)", "timestamp": 1632316987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316987, "uuid": "8bf0286c-474a-47f1-a048-d407cba69e52", "comment": "Malware payload (Osiris)", "value": "556c756b428b0a6f1516de031c3bfdb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316987, "uuid": "df64f7aa-c353-4603-ab8b-373c7fce9f1e", "comment": "Malware payload (Osiris)", "value": "6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316987, "uuid": "4e146743-e283-45a9-ae2b-33ecf50e7629", "comment": "Malware payload (Osiris)", "value": "d4a8195611ac93a268b0ebdc14319a75de856725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316987, "uuid": "08c77042-f9c6-46e9-8fc2-62d8b093a988", "comment": "Malware payload (Osiris)", "value": "fb4059b87aa8786ccbf1e0f30168060af5f23a17ad185b638231eb45e600c952085da8da10fd7b72285bb5cc9758aed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316987, "uuid": "5e0d5ff6-b2fb-493e-af55-529602fb0429", "value": "T11594BF22F581C036D6B102B0CEAD7F3B96FDE524033599D7B78809951EA44E67339B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316987, "uuid": "a7ee5576-3afc-4805-9004-290f9f2cab75", "value": "cd3fc0dde37bf2787f0f054ef3b5a350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316987, "uuid": "b1308f61-5e88-4135-9792-335369ba27fd", "value": "12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK9SATTsx/SA/WegYfdNbrqnuh:rXh6XcBXo8TsL8Y8m/ATTySA/DrfdNb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316987, "uuid": "be7e58ff-5e76-4ff9-ae27-ca3fd771959f", "value": 444938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316987, "uuid": "749c4f73-b37a-4829-964c-b19015fe973f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316987, "uuid": "0f8ccff8-3bfc-4c45-ab12-e312fa061828", "value": "6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a6bd8a-1b64-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632287701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287701, "uuid": "28199c96-0105-404a-b0ad-2d0146807374", "comment": "Malware payload", "value": "3977a7d03e913549a307c67f3647eaa3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287701, "uuid": "e93e1d0c-4888-4d57-80a0-f4f495a18d50", "comment": "Malware payload", "value": "6bb6167724a69693fa01e4f920810c7472c4d63e79e78591811b9dab57899cc7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287701, "uuid": "b5acbdd9-ad3b-4baf-b3ca-f328e3fd4b90", "comment": "Malware payload", "value": "eb0ed6d5419871bdb9c0865472a13f957995eaff", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287701, "uuid": "170fef40-9608-4458-b1f3-4775964f871e", "comment": "Malware payload", "value": "f9c0114a0fc554a8141f81ebc9a8007b3a9b5f17046c069b63afd798c83da8a45df77003939a5b5083474546c571380b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632287701, "uuid": "0db2daea-7ed6-4219-a388-a8abca64211d", "value": "T134E31220CA0B64C5C4192074A4F990D333DAA35EA1C3E66E6756B5E3E329BFF1119BC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632287701, "uuid": "af80f326-2991-48d3-9b1b-a655fbc3260c", "value": "3072:ehmFB2jqv13hrHpcZ6EcY1A+4zJwvWmhN8Bw25f6Yc/v2FuBFwupCjH:L6jqv1PEvV4WvWmha22tc/v/BF1pCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632287701, "uuid": "e5e10a1f-abc8-46b8-833c-35c564a040f8", "value": 146404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632287701, "uuid": "ae0538ae-32d5-4b84-a339-55803ae1ada3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632287701, "uuid": "0bfd2e51-2444-4242-a387-4fb0b93997c2", "value": "INVITATION_Cross-Asset_Credit Conf_September-22-2021.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001a1e4b-1b3d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632270935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270935, "uuid": "3cb16f88-190b-43d3-bc15-c500010c77da", "comment": "Malware payload", "value": "09af15616934fc04b0b65d0ff58ccf98", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270935, "uuid": "81e51121-c6c4-415e-ae1c-1b6b9a3653c9", "comment": "Malware payload", "value": "6bde11071b59f9219d1bfb2d63e5da8d8a01772fcddf0cf97b954d5ecbdd5c60", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270935, "uuid": "5c1c0c6e-d283-4701-8ef6-e3e9447c2a07", "comment": "Malware payload", "value": "97aaa16988db62d21fc5504d5b2227d12c47e9c4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270935, "uuid": "ef4f470c-22f9-4a31-b253-7a7244692c7d", "comment": "Malware payload", "value": "c574d3cd59b1616c2a25cbbb4c8bca380b09a73602e8938f5daba13cb5c51996e9a9e9574eb817845ed739c86bb7b55e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270935, "uuid": "b40ed8a1-1349-4606-8be2-94650518baf0", "value": "T19FD433DBCAFAD6B1D30E2BE3D27B0C983F5C425AB91016715E1D7583200ADFA82D7609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270935, "uuid": "0176c80d-8e00-4d63-954e-21429a852e75", "value": "12288:mWYJN6tMvC6VRWzUtVYDN9yo6zktye0Dq8/ZgV2+ypCsU4nTlvUdeBVWzzr:ygtt67WID++o6zJDq8/r+ECsNFUdeBUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632270935, "uuid": "bb8d1e9f-82b4-464c-b3a9-30de333591c2", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632270935, "uuid": "82581a6f-b801-4d8b-82f9-b3524663d492", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270935, "uuid": "7b4287ac-0a0f-4298-977e-38392642d92b", "value": "\u300a\u6740\u732a\u76d8\u300b\u8bc8\u9a97\u8bdd\u672f\u66dd\u5149\uff01\uff01\u5927\u5e08\u6559\u4f60\u5982\u4f55\u6708\u5165\u767e\u4e07\uff01\uff01.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7dde58-1bff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cybergate)", "timestamp": 1632354655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354655, "uuid": "6bb2e54a-a345-49ed-a168-751435b6ab6f", "comment": "Malware payload (Cybergate)", "value": "38b802d5eb05d10c979f12f5049d2ce8", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354655, "uuid": "c74df568-a30a-49a1-a864-16608218feb1", "comment": "Malware payload (Cybergate)", "value": "6bed821958edf6eec984ab5358507b3188867e22cd2b180401c8b671f6496e4d", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354655, "uuid": "d16c2d09-5c5a-40cb-a9e3-7b97142a5188", "comment": "Malware payload (Cybergate)", "value": "9e37763eaf8aa440a0b0b7dbd4c93c42f5ab9d3d", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354655, "uuid": "37df7686-4032-4183-9845-22445b3353b0", "comment": "Malware payload (Cybergate)", "value": "d3fbf514957458f59440bcab9035e345f32e3e80b99fcfb59a26ec8224d7542d7780cb3ed5e071629c63f7ddaa652271", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354655, "uuid": "14eeb21b-6c9f-4e02-94e1-8fb183af9656", "value": "T17FF40103EBB6EF70DB38167F824577256F6E0E8141F13A8D714CB1216EBDE5288507AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354655, "uuid": "4c195fa8-666c-41fe-8a36-ec3b87feae7a", "value": "caa5e6a2892587c2324418efee31c648", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354655, "uuid": "62bb07b2-8f72-4a5e-9382-8064c2a90322", "value": "12288:IAAOFnmfkMJrC/drYrhHpB8PGVQ1Oer7VgWqEZE0/iuXAtVj6AURjQ:MOFmfkMJrCVMrppSOVKr7Vg2E0/iuQtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632354655, "uuid": "1566ecae-38b5-498b-b327-54d69cc88201", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632354655, "uuid": "2086d86b-a86a-4c37-a11a-194376b68601", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354655, "uuid": "a559f48b-7dbc-41d5-908d-f6b549709393", "value": "6BED821958EDF6EEC984AB5358507B3188867E22CD2B1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec5ddf7f-1bb3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632322012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322012, "uuid": "7204a005-0840-415a-8fc3-c48ee9cfb980", "comment": "Malware payload (AgentTesla)", "value": "cc5c9c131a1a28796e6a0ed1ef1914bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322012, "uuid": "be72ae96-0a12-4940-b46a-07a6196310c4", "comment": "Malware payload (AgentTesla)", "value": "6dbb6d26dc71f0e54e1164cbb7c338cc264c82b3bfc9ebd79ead61ef0a9b4abb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322012, "uuid": "900d485c-bfab-4987-93bc-0e028c11b47b", "comment": "Malware payload (AgentTesla)", "value": "8ad3e371408a3fede04ae8e953589121d954b075", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322012, "uuid": "3b36cca6-ccc9-4e0a-824a-8ebe0c38f826", "comment": "Malware payload (AgentTesla)", "value": "3667fe090aa45057477048523ab474195707bb8623883afab130086698f546dc59facb767a0c44bfb178bde331961303", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322012, "uuid": "5308e190-ca01-4a50-8655-472659e8bd04", "value": "T148C42336D22C1775C9AEC7FD205284814FB4A1CD77A3D3AEDA8BB08E3D5AB954100DB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322012, "uuid": "62a11009-ec76-4037-b61b-d0eab94b7d1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322012, "uuid": "769b9647-bb79-4b47-86a1-291009553879", "value": "12288:bGA1fXmtiK5oBJ/mv/qR4EiG6WBxAhcoYZ/lzcMJ3:v+FoB8/c1iG6CxdoYZ/lzcO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632322012, "uuid": "2bc55b0b-0f1d-438d-bfe5-3f1ad864ff04", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632322012, "uuid": "1919d609-899f-4d9b-b9b3-38f0b7d16167", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322012, "uuid": "1dc2f894-928e-4c8e-ac46-0ba41ef0cc00", "value": "cc5c9c131a1a28796e6a0ed1ef1914bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c14e12-1b64-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632287830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287830, "uuid": "5828d3d6-0109-4422-9dd8-f0f1deade3aa", "comment": "Malware payload (AgentTesla)", "value": "0d1bc95ed6baf95d78d5701d14e9b111", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287830, "uuid": "a5fe2766-0941-40ad-b51d-66336cabfca6", "comment": "Malware payload (AgentTesla)", "value": "6dcabf5165e8fa9d78641e12a55ddb45fb82e279bacdd034828a3d0b3a6a4355", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287830, "uuid": "26379612-230e-4b70-ae17-36d239f637e5", "comment": "Malware payload (AgentTesla)", "value": "e3711c6e7c1fad09b7bc1aa2d26f2deae4678d71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287830, "uuid": "99ab3466-aba3-4581-9127-6c01b83d7efb", "comment": "Malware payload (AgentTesla)", "value": "d8a02b1562f4767d9e7ebfa1cc61fe5e5c96860b7b8c43a0775f6c9e1cc45818147b5a8f4a44a8484364f9c60549d583", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632287830, "uuid": "7523fb96-9ef5-43ca-9a80-f8517719d3bc", "value": "T11F9423E5DB7A746F2E4056B50C3E36F7083685134B268459E83D172B5F34B6FCB25222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632287830, "uuid": "8e931913-3f93-4c10-8125-a92c8c3bc735", "value": "12288:IB5ZLoiCmBNFphE7Bh2gJOEHgCXNyjXLGrqoWcoL:iVjXHS7q+LXNyGOSoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632287830, "uuid": "3c51a3c3-5e36-4a1e-9ba4-4d382f4215df", "value": 443551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632287830, "uuid": "b7103f20-938c-449f-9ffc-f8df5f86f70d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632287830, "uuid": "e409cef2-668c-4f4a-9385-e43ef61a1860", "value": "Request for quotation against visit to your website.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d57df4-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316845, "uuid": "424af563-3fd0-4cf3-8640-a73833e9559d", "comment": "Malware payload (Stop)", "value": "dff0ca4793f1eb9f780d780eb0a19aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316845, "uuid": "93407d9e-f6ee-49f7-9a51-8bc3010c8f99", "comment": "Malware payload (Stop)", "value": "6df4065a2ec47c34f6c6c2642fb8bd12ba7e3c229de8fe6fa07be4aa7321a7f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316845, "uuid": "a9e2f912-7882-4b02-a5a8-c719aa1a99b9", "comment": "Malware payload (Stop)", "value": "011d403e4d95b1fbef35153833c7d271ff287eee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316845, "uuid": "f0d1ce4c-fe32-48b1-aeb3-9e720a90f63d", "comment": "Malware payload (Stop)", "value": "54ba27ee76601f50bd87d174e19ca4006518f9bbf9f54fb7d81ccb89146230c0f3904d07d0e2ffd26f29d8dca13d7c9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316845, "uuid": "025b7f6e-f74f-44a8-bcb3-f7f8f3098ccf", "value": "T1E7F4021DB2BDC062C585D9348075E2B9693F68626920EACF3F24372F2EF06514A35F5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316845, "uuid": "166a4703-d8cf-40a5-a137-8397678f7d85", "value": "b740348189b21a2cbef41493dadcafe4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316845, "uuid": "6172bda1-e7b6-44a8-80d1-529f6354c88f", "value": "12288:tDVekA5SdvonOps95MeE6ye4UnH2MMPwuAgKC0iCQpzKMTPeJCuh/gn3zkmN6pzI:thRAMdvo/ndIwuAg10ifJKMTPeJCudsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316845, "uuid": "1954b085-b0fa-4950-ab77-cb87d9f6503b", "value": 767040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316845, "uuid": "f0923c32-31b2-4cc3-93de-ef9c8e884ec2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316845, "uuid": "c193f12d-a9a8-41b7-8967-faf55030664d", "value": "6df4065a2ec47c34f6c6c2642fb8bd12ba7e3c229de8fe6fa07be4aa7321a7f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6659d8f6-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316633, "uuid": "722b9c57-9b4f-478a-92c6-9ef1d7e19a3d", "comment": "Malware payload (Dridex)", "value": "a172a280a6a4350c01c7351abaf7e932", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316633, "uuid": "dc5b96c3-d65e-45c4-a10b-aaf063b75bff", "comment": "Malware payload (Dridex)", "value": "6e32bcbbd1738abdc41bfdca712022aa024f34f052bedbaee02a55b6d56e7174", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316633, "uuid": "9a643b7a-c85c-4828-ab2c-cab117a1d114", "comment": "Malware payload (Dridex)", "value": "b1fbc9a85bff20c4be344a924fe780255f243d50", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316633, "uuid": "11ecdc77-234e-4dc9-a6e3-78d7fe1ebed4", "comment": "Malware payload (Dridex)", "value": "8fe91b4d5425940beb7bf3f7e7b37eaf3881a1e640707b6f495c7ea537af13b0966661f429e60e5907bf31506ae238fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316633, "uuid": "6e88523e-653f-41ce-9f3b-f97408587844", "value": "T1BA95D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316633, "uuid": "ca6b2783-c630-46ca-b2ea-807cc1642d38", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316633, "uuid": "85fbff9a-244f-4623-b6fd-869299b259af", "value": "12288:8VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:JfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316633, "uuid": "15b838d7-816d-46ad-84b7-bf4ed00d6c05", "value": 1884160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316633, "uuid": "02930515-94b4-4831-ad58-736b770543d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316633, "uuid": "885a5aef-512a-42e8-b0c6-e40fe236596e", "value": "6e32bcbbd1738abdc41bfdca712022aa024f34f052bedbaee02a55b6d56e7174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c245c9-1bfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632353755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632353755, "uuid": "22777596-7a63-4472-acf0-bfc52e8dba1f", "comment": "Malware payload (Loki)", "value": "2cd6617b9f9eaf7257b7ff5f9835428c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632353755, "uuid": "bf36cc5e-8ea6-4577-88d7-d0ce762b6994", "comment": "Malware payload (Loki)", "value": "6e7eebabcb0db7c5f981e6ad8096ff9470f04331e1acd8fbb876eeaa442b4cec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632353755, "uuid": "0ab94ea3-2565-4021-8486-b733001b93af", "comment": "Malware payload (Loki)", "value": "c0c18307b3750ea0b3af46542d43ddea5ec120a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632353755, "uuid": "aa29e45d-be87-489c-b2a6-5e53bfe1044d", "comment": "Malware payload (Loki)", "value": "3045911097277167ce2cf7756fd1347993c82e85c562deb332c5d738cd3dbf48032d33379e72306cd87a7d195c7e1b0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632353755, "uuid": "4500750d-65e7-4e53-b72f-d7c6f92f6f45", "value": "T1E0E458C56D888613C3A14632DC5D6646326C6C0A3723875BDBE93D773EFE283C22D59A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632353755, "uuid": "1b15d878-6d02-4ea8-af4f-df89c4bdf21c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632353755, "uuid": "2b2f33c1-8e6f-4358-bcc1-a1243952a1f4", "value": "12288:UImtiK5os4jCUtEhh2dLPujagscvy6fKXLZYNDodTUAj6yBk:9+Fos4tIc7ua/czfiZYDnAjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632353755, "uuid": "b680c82c-8490-44a4-9558-acfb84f5a039", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632353755, "uuid": "fe0ae6af-7523-4fb7-9529-0b91a6a7e46f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632353755, "uuid": "5f526426-9eff-4f6b-a438-47dbf7d9ebfb", "value": "RFQ77684459.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e588cea-1be9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344939, "uuid": "2dbc26b8-6d9c-41b5-b567-04dc1f8f8784", "comment": "Malware payload", "value": "6c07598dd1e69a3cc89babb648ba4752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344939, "uuid": "96689a52-8df7-42d6-9531-17509b5edafa", "comment": "Malware payload", "value": "6e8ab5a3a7188143d0130d5553690a1254a8bae199b24e4dd09e40c8f9361576", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344939, "uuid": "c256fe02-c3f6-4857-92d9-a9a261108b79", "comment": "Malware payload", "value": "af11e5b6763c232d84648f5ba7e52baf60c3aec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344939, "uuid": "8c867b55-eaf2-4f43-a2dd-c5840fe6d85a", "comment": "Malware payload", "value": "8adf5b9de64af1a97345605bde7ababdf9cdf3190410b790c1190d1963ce8009e84e0bde9c9d8e9119d945a5b8a98119", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344939, "uuid": "991d250b-d8a9-4729-8ecf-74cb46ff146f", "value": "T128D4AE11BECD88F7D54200324DE76B7AFAB6BC183E118A879368FF4EDD71391A51A610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344939, "uuid": "e6d2105d-e7c4-4311-b7d7-ac24c3200ac3", "value": "e2afc946bb1a7942e18b4d1a8f444ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344939, "uuid": "6c178063-0a17-45da-b1a2-6942cddb6955", "value": "6144:yc5s/L2PwnAFbCDCGkVcscYax9KCEyP3rQCzS:ycKzmwnAFbBGkaNxjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344939, "uuid": "bf10e83a-54dc-4045-b32b-2d81d5f19882", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344939, "uuid": "e519a1fc-03df-492b-8e70-fbd08af71d71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344939, "uuid": "180d70b0-17a1-4f8c-b3d3-43b06c38c359", "value": "\u83f2\u5f8b\u5bbe\u8b66\u65b9\u53d1\u5e03\u4e86\uff1a6\u540d\u4e2d\u56fd\u83dc\u519c\u88ab\u5f53\u573a\u51fb\u6bd9\u89c6\u9891.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8689c6-1bc5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632329526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329526, "uuid": "0c35b3dd-cec5-4567-b600-d45a0b63eb2c", "comment": "Malware payload", "value": "aee38bbc9fbcee39bd90a865fb94f296", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329526, "uuid": "5505b81c-ab26-494d-8403-20b46b7edfd5", "comment": "Malware payload", "value": "6eb543307dbe8b1e23007e7de58934795b249ec42e7c3361d5968e7e78065583", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329526, "uuid": "4d28301d-cc1b-4951-9c00-b8440a0e6944", "comment": "Malware payload", "value": "f797da62e5e1360bb80e3d5d8f4880e192c3d96f", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329526, "uuid": "0e9e55e5-84fe-494a-881f-34e014825f48", "comment": "Malware payload", "value": "e9bb097aa77b40ef975e0f9f6c24d50705999dfb107331050eb1cad12ce8ef1e5ed3ccda7d2d6144d49d006b86b2124c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329526, "uuid": "b376ca0e-b22a-4a07-952a-8f7d0051c9bb", "value": "T169A3022ED307A84CD193C67C493B2CF7402265744268FA8F99D5F3984C9769F9BCE244", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329526, "uuid": "29da62e1-1aa9-4d7d-8aa5-a990147190f6", "value": "1536:ahP0DWlwbhfZS7oHe9HIeF92MZP9MGwEJzpViGC631liqf+VMJ2XHQdo3mrIOgQ:aJ0DWlgFiIeCQ7zpViGJ3PmeJ2XHQdV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632329526, "uuid": "45b15312-8e10-4f30-b81d-87a18fd5dbf5", "value": 98170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632329526, "uuid": "dd6c62ef-4da5-4860-b955-9c3e28d7c65a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329526, "uuid": "e505555a-3dd8-40fe-b77e-028e6c1ef572", "value": "SecuriteInfo.com.Trojan.GenericKD.47001756.8777.3147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2bd3f52-1b6c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632291447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291447, "uuid": "6dbe50b4-bbf2-44f9-b69a-221c87375814", "comment": "Malware payload (Formbook)", "value": "f74ddbeba4a77bf5e3c1936eda01585d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291447, "uuid": "6218427b-83ac-415e-af08-c279852e3aa0", "comment": "Malware payload (Formbook)", "value": "6ec3a910864aa91b0bec91275ffc3ef7e3dcc0e1c7f247624514b1c9d4c16992", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291447, "uuid": "e752a0fc-2447-491c-8aec-3ae185c4df61", "comment": "Malware payload (Formbook)", "value": "135af2eb07c33270d2a686277557e60c5f4feed7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291447, "uuid": "aeaa1a67-29f8-4b35-b045-7df5a08de916", "comment": "Malware payload (Formbook)", "value": "8f46629a15a24f1090eb70a8d09a5e9e5e4565c2cc4272db2daa5b84fe51abe8f2885c7cc29910445f8596b8d8b9b5bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291447, "uuid": "0a56e44b-f1df-422f-a4c2-4426c69286c2", "value": "T104B41224DDAEB222CA7D877F61B409D237B9E8476E0BC62FA5F530CD48A679F401150B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291447, "uuid": "9c7b06cf-4cf2-4dfc-be93-2ed8dd812040", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291447, "uuid": "3819f742-ab44-459a-bece-6f5bc7c9950c", "value": "12288:XPdmtiK5oBhQMYMtEWafJOhzaV1jyY+xE:/d+FoBJYMSWafwR8uY+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291447, "uuid": "6cbcd135-56c4-4b24-ad21-dc35d01eb94d", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291447, "uuid": "441423c8-24bc-4067-b5f6-76904edba0fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291447, "uuid": "dec4a618-b604-451b-977e-214a54435b4a", "value": "New Order Specifications pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0abeb1-1b82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632300675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300675, "uuid": "084eff3d-87e1-47ae-bab3-7deced0e829b", "comment": "Malware payload (Formbook)", "value": "9ed15d0d735fabdee6d22895e5a500e6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300675, "uuid": "5626b3bb-a34c-418e-af24-b439e74f74a7", "comment": "Malware payload (Formbook)", "value": "6eecf994182c59cdfca4e92e5ee893bf3d48d818da7034f667f6534e77143c8e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300675, "uuid": "55254e52-bdb6-41ea-be30-fad676d9a890", "comment": "Malware payload (Formbook)", "value": "6a5a871141dd8f357c171c1b1a662f94701d2749", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300675, "uuid": "b68156b5-0ef7-4499-a093-3bd6a3cd2712", "comment": "Malware payload (Formbook)", "value": "1d9ddc440d1adbd316d23052398220fe0f62fa7ae464b77347be16542c4aa044dc49857693ef99d0a3c7cfe763b8c729", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300675, "uuid": "79b31615-d3f1-4172-a288-d215cc6c039c", "value": "T1D9D302EFCF71420ED1B1AA3B67657EC7C4F1CE1069C9F54B2292733E95B094298982D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300675, "uuid": "e02324c9-5f47-4360-a1d1-36c91f73e201", "value": "3072:uUhFDfVGkXcY4Fn5kztMmlZsIRnJR0Nu1tBhXwzeoD:N/fwkMY4zkztdsIRoNunBhXwCoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632300675, "uuid": "007aff9f-083c-4e52-929b-95c6f0d018bd", "value": 132376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632300675, "uuid": "5232d408-2a73-44ba-a659-89aac42fd4b7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300675, "uuid": "48b28acb-d7f6-4bc3-91df-2165e53d7838", "value": "PO no. 275.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd6a9f8-1b69-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632289936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289936, "uuid": "dc6a3253-55c1-4782-980b-269c05733e98", "comment": "Malware payload (AveMariaRAT)", "value": "c436484afa0bf471003b35a99bff69e9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289936, "uuid": "227c7b29-70a5-4d03-8d7a-b3bd060d1dd8", "comment": "Malware payload (AveMariaRAT)", "value": "6f0be13909a62a5d257151b140d27dd0902ad758449ea487a04e571a04bc1223", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289936, "uuid": "e9e99df1-bca6-43e4-81f5-5bd73cdaff67", "comment": "Malware payload (AveMariaRAT)", "value": "5044032f8cb5ed5e130890166e5f15913343c376", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289936, "uuid": "1846539d-26cd-4c48-85bb-c143690fd8fa", "comment": "Malware payload (AveMariaRAT)", "value": "06a023f9e921360aad8be16656634dbd27705e60e37c68c3a9dd7e89f21b7622cfb86053a5b6cab1ccbd3ac12d7215c6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289936, "uuid": "ab2ea704-fc4a-46a5-aee2-6fafd0ffcd04", "value": "T14F33F20EC3DC9139E2620EBC526EC193F3AE021AEF499CDD6595737889431E7078B997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289936, "uuid": "82cafe66-54c2-4db1-8ac5-747e7450e132", "value": "768:vvlY2cy1EqtmAuhcTJgYDm8ENFKSu1kopLuFSY1J2SyBUeH1tjN34/itJschF9NH:vvu2cy1Eq0uNsNfqpLwb4rFNZtJPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289936, "uuid": "76b09509-166c-4887-a9ee-44e9448938b6", "value": 54738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289936, "uuid": "32d956b9-3c21-4e3a-a3f6-da1264c36dcc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289936, "uuid": "14a74017-693b-458f-8b1c-9f23534fbbd6", "value": "DHL QA-Tracker.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7c40b5-1bc1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632327835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632327835, "uuid": "01ef05bd-2fd0-4349-909a-9d7fd30633b9", "comment": "Malware payload (RemcosRAT)", "value": "ac0d3ae2b09c7632f38077794e4358a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632327835, "uuid": "c9e7ea49-a497-4040-bdd6-9ec8c873bb6d", "comment": "Malware payload (RemcosRAT)", "value": "6f2111247977f79b9772ee487e9e96ee536b8dc901c27af2b2f309fc0f66f6c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632327835, "uuid": "f43a9d3e-97f5-4d22-9b48-7457e0864391", "comment": "Malware payload (RemcosRAT)", "value": "4008620c17beabb86265b9f44eea57141f629c4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632327835, "uuid": "ad25500a-f517-44f1-8fb4-990c42ff0b2f", "comment": "Malware payload (RemcosRAT)", "value": "cff86a55dd6082255e4a990c2419a3c49dd4019026edc24fc507e8150e504490e283d685174c402ca7e6c76b28076e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632327835, "uuid": "67ef2283-a060-4840-82c6-c1bab78d6782", "value": "T1B7157A394D2682F747EEC66CD08C1BCEDEA6A4837B919F1AC496D7D2025B70FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632327835, "uuid": "205d7432-43ed-4727-a658-078fa4fed147", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632327835, "uuid": "043113e0-0445-444b-bbaa-ae6c8c8382ff", "value": "12288:Q7/5YK3q4D9A9CXNr9lqT1elXQgPSZ4vAmV3qAYDNQ:I+x4UYNr9lqT1eGgPS2vAmdqdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632327835, "uuid": "64c7adbf-2979-4f6b-92c0-45ef0c666467", "value": 922112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632327835, "uuid": "4a0ac25b-8a49-481e-947c-c3a8612e52dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632327835, "uuid": "713ffd3c-7e0f-4b7e-8c58-3876270f39dd", "value": "SOA AUG 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e760c0f-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632334121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334121, "uuid": "b3f94aed-4b77-426d-a5b3-221087e65dd0", "comment": "Malware payload (Loki)", "value": "69c7ac7da4ed291933fc84d962388555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334121, "uuid": "a5f3a1ca-2140-4f59-ae32-cd5844ea3a25", "comment": "Malware payload (Loki)", "value": "6f81e9018b78b81e1c993dd58fd1024c771c50da29fa60f0736ec5824fcbfc08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334121, "uuid": "42e283aa-1004-4244-b903-6cf5b35a7908", "comment": "Malware payload (Loki)", "value": "47c605dbdcdbe02c0b47d1a6bc759f72bf9b46e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334121, "uuid": "806a65bd-c0a4-4931-9d97-f72427980686", "comment": "Malware payload (Loki)", "value": "416d99e7d2e77541d8d67808e59addfdac18452a48bd5e3f077642f9275185d542bda1975a64381976591ec2eed3c202", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334121, "uuid": "f00aad52-4c2e-480d-93d7-05156dfa2167", "value": "T1EF640235D7E986B8CA699BBD2061458207B1F14DB713DB5AEFC570C97F0B3A11028CBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334121, "uuid": "be5d8808-9163-423d-be0b-414daeae7002", "value": "6144:8gVOTNmtiS3/NpZZaBR6UZsm3qtflP5JAqDkRUGFl7v5:8gVEmtiK5oBUUZsm+fF7AokRHR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334121, "uuid": "8adc8d83-afd3-49f9-8231-37beda3addb2", "value": 328366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334121, "uuid": "958e1f58-5edf-4413-b86f-f220c03dc0eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334121, "uuid": "0f1e1fa6-b470-4f14-845d-6bfb37491af0", "value": "69c7ac7da4ed291933fc84d962388555.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacb0da4-1bc3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632328827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328827, "uuid": "74c223f3-7a67-43cd-908e-095c5a2bb20d", "comment": "Malware payload (SnakeKeylogger)", "value": "1d91895b2def45716498f9af9c6dafe7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328827, "uuid": "b981cb3d-1318-4475-9f43-1903b979c923", "comment": "Malware payload (SnakeKeylogger)", "value": "6fcd04b25214800c0db5d8e27ed501c105e596870aa9321f0f51d21056822ca2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328827, "uuid": "2511fb61-09b1-480b-a55f-5716b41bf9a0", "comment": "Malware payload (SnakeKeylogger)", "value": "ff8a1c79b68f83abf628258826e55e87fd726e50", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328827, "uuid": "8357286f-ca6c-4c30-a5b3-b9454797aeee", "comment": "Malware payload (SnakeKeylogger)", "value": "39d7518eb6daa42dc83ef552244c5f2f0120c57a7f98582de162a56b065283430d765a143cda04fefbc426c57f4d5a32", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328827, "uuid": "fcd89365-307f-4db6-a6d3-47db080bd370", "value": "T13E6252ACC45706A88F86ABB8671BAF45118C7A2EF784E533727C973817D1D3A411783D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328827, "uuid": "8712f478-0683-417b-9bda-c1d373e86d22", "value": "384:SzJZBA7741BCfbm9nksX4zSIk1C4jP+Ie0g3/lSioWK7EWnMDlT:SDu9iKsX4GIk1CL3NSim4WMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632328827, "uuid": "d84850f7-7bae-4397-b29d-1f923b05d917", "value": 14787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632328827, "uuid": "de06085d-b86d-4df4-ada7-11d4d9aac865", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328827, "uuid": "60d60e9e-fc77-4c0e-a534-fdae54ba135c", "value": "AVB CMAU6526450 40HC COI2100105.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696f26a9-1bae-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632319644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319644, "uuid": "9027d8c3-2c2c-4ab3-bdd2-a2d3958acc30", "comment": "Malware payload (Formbook)", "value": "feab1e0f9083ac203b6e7741b470bf8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319644, "uuid": "b76bc0d7-a1ca-4d2e-a3e3-ceab814afdfb", "comment": "Malware payload (Formbook)", "value": "7024147e75938acd54b804df172c63b57c794e1980632c5f8190ae1e9d0da82a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319644, "uuid": "bfe3ed72-9f4d-4e9a-83d2-17395aaaf5b5", "comment": "Malware payload (Formbook)", "value": "0972d90e8ceb80630af2c7e5add7ede9d3e01166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319644, "uuid": "8e540e5b-5f70-4229-9195-abdee1a82115", "comment": "Malware payload (Formbook)", "value": "0e1ee672375f9a144f2f3c17814bdcd30ec6ab4a52333e9e5c4b4002d2095de7dfcdf629f33f2057c144bf566b94be3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319644, "uuid": "4a5d4bca-a5f7-40d6-9f79-af26649c5c74", "value": "T182F49BC85D985613C7A44672DC4C6606366C1C0A3723938BDBE53DB73EFE683C22D9A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319644, "uuid": "f62e2b5c-973f-4a18-915a-55494ec8de1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319644, "uuid": "d3a13490-4984-44a7-b25f-9117cd222976", "value": "12288:iQmtiK5oIHr4EAe7BTHgh56ppM4KrtV0Ss5DBGH2U2oqBeyWCzk:n+Fomvgzoq4KZjsDBGVDaWCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632319644, "uuid": "c43a50fc-cbeb-47ff-adfa-0a944732426b", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632319644, "uuid": "07ae0022-0b4e-4e86-9e45-cc2c1ff2803f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319644, "uuid": "a2b93b13-1c18-4afd-b598-3ed37be6317e", "value": "bankzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d95628b-1b9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632312672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312672, "uuid": "ce4ede76-ce44-48f0-a804-4caa85fa6f7a", "comment": "Malware payload (AgentTesla)", "value": "1d2ec96484c69c3fc8e8081445772f29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312672, "uuid": "19a13f7c-54dd-454f-af66-b53e9454449b", "comment": "Malware payload (AgentTesla)", "value": "70ae80ffc78d97f9cba52c36b80113b183bfbc6c235d918cae8ecd482699a8d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312672, "uuid": "a9cc3802-ee68-4633-8999-28a140d71654", "comment": "Malware payload (AgentTesla)", "value": "ae4a7f5b21429f6bdca1a5ca0efbc83c91458fa0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312672, "uuid": "3323be36-5854-4d68-8c4a-280b01e1870c", "comment": "Malware payload (AgentTesla)", "value": "4564a4599ec9617a008e9c1d59d85603005c954e76aa0a0a1983a8ffe0dcd4e841d8c11a77a8444f0b1c3f774738ca86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312672, "uuid": "def10eff-45c0-4b00-8c32-1ba95a103439", "value": "T1B3849E733102FDEEDB2A0D78D5006C60DC9BFE7B975C90D8B9882689B0A6134DF69974", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312672, "uuid": "26807e34-4ddb-4ce5-ab4e-290c43d13abc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312672, "uuid": "2827b253-683e-4e8c-bcfa-b826fd07f060", "value": "6144:dhN+StxddUUYm14ieOCxUE1J1WhQStjxkMVbowZxxrTTNNhChjZnufiQ+r7+4NlU:NTd8IcMVZZx1NChuiBrTl74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312672, "uuid": "a5c136e9-4060-4e84-8a32-007d67ed4233", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312672, "uuid": "10b75aee-4606-4b83-9063-7fced2421381", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312672, "uuid": "7bb6fd33-a580-44d6-b55e-e842b6965f87", "value": "PO.21090351.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668b0c0f-1bc7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632330377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632330377, "uuid": "3dfa9f6d-04ee-4543-9d73-d6b32f950ed7", "comment": "Malware payload", "value": "4ad14eb3936f9142499b366af74eb234", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632330377, "uuid": "2790992f-9e11-471c-8b72-52f3d8c22ff6", "comment": "Malware payload", "value": "70fd080b01c383a415f62052617638b85cdc8fb32f7d21d4a709357d918ee08a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632330377, "uuid": "d51ab6db-cf4e-4f6b-858e-a5563e5ae521", "comment": "Malware payload", "value": "4d35f105399244f51f6b4f5948d3607b7c1e8d07", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632330377, "uuid": "ff1dca28-b30e-4cc6-b7bc-e47493ccc80a", "comment": "Malware payload", "value": "edebc436616b0d34ab67217da64e76b4c4f904290ea4cc3d1c45ef4096f2ba68ff09e00196288134d1bf547f79318f10", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632330377, "uuid": "d799b4f4-02f6-4357-8d4c-bce404c9bd35", "value": "T191E6121A7DA4AD3DC18750331062C256E314D6CEC849DA0F9ABA1649DCF2FDF1706BAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632330377, "uuid": "338bed83-ac39-40a5-92f4-9119cffb3d02", "value": "393216:sE3BkYpiVacTgHqTQcKp6Ta40XF/hR0ku79:s+kYKacTkcKET5GZhu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632330377, "uuid": "f05e5858-6949-4a6a-8bdb-2246e3f6b76d", "value": 14989476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632330377, "uuid": "e298b82c-1e98-49a5-8dcb-6a9b3b3eb164", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632330377, "uuid": "f3496614-9610-4ec6-b909-6d42ff019b16", "value": "FDPClient-2.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fee7dd9-1bde-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632340325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632340325, "uuid": "bddb3c24-4d72-4784-b55a-8729696a8a20", "comment": "Malware payload", "value": "4e3fe2ad8dc94dbf82847aa9c18e7efd", "object_relation": "md5", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "rob133", "colour": "#548677", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632340325, "uuid": "d290e444-864f-4de8-b7af-21b6c509fd16", "comment": "Malware payload", "value": "712fd163cc98f8fb2055573336c606f17c66a22276dce9f6e9f909e3d6d23f16", "object_relation": "sha256", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "rob133", "colour": "#548677", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632340325, "uuid": "4d341818-ac5d-427a-b7c9-1390b5a0a1d6", "comment": "Malware payload", "value": "c6623f75c837d4579e3282bd5871516475d8af3a", "object_relation": "sha1", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "rob133", "colour": "#548677", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632340325, "uuid": "7acabe25-7324-42de-8f29-9fe4788ea661", "comment": "Malware payload", "value": "d276ce88ba5dcbae5833a2523cea4019c10da601deb842a507953a9def8dc7b62021bd3968ed1703234cba694a080940", "object_relation": "sha3-384", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "rob133", "colour": "#548677", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632340325, "uuid": "3c99fefb-80e4-4406-a5a0-430645627626", "value": "T11F14133D4E48D518F171CE7E6E531CD1A7D220828A38889AD2B292CE9FFD50F1D9077A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632340325, "uuid": "3c554ee0-5fc5-4943-a124-133d6ad72d09", "value": "3072:3NR4/YH4EAk1JEn5r2RvF1R/g+4lYLM6nxIJ4bImhO8jNCSqVbUoB/wqui:dQYHF+n5aNFf/g+4YnxE4e8qpUoiDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632340325, "uuid": "7f8ccbb3-e52a-4f23-b137-938622d7c397", "value": 193267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632340325, "uuid": "faa5fc0b-2992-4849-809d-2e4897e0648f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632340325, "uuid": "c4e5e8d2-9614-4291-98b8-976e2269f4ed", "value": "invoice attachment.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edbc416-1ba9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632317587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317587, "uuid": "7e8d44fe-dfc2-49b2-9637-284d2ff77c8e", "comment": "Malware payload", "value": "46502e94750a8fbfb089c90229998f3f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317587, "uuid": "10ae7e4f-fe99-46ea-a324-ace25aaaf06e", "comment": "Malware payload", "value": "7152d4e95282e11c9004606f68d21d71e7f76419d8beb947295ddfbad2442880", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317587, "uuid": "c8097a75-6ad2-45f6-bc6c-b4812648bc98", "comment": "Malware payload", "value": "5329b26c38d4c8211566fed46516c6d63221ec9e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317587, "uuid": "4b60dda0-0a75-4647-8326-846391dc6ce2", "comment": "Malware payload", "value": "0d27fad9246bef1b0deb8e660e4b6e40319e358bb67f4d43ab48c5ca59b5d68ee8655ee5c8a84bdd2d15cdb32e71a91e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317587, "uuid": "3642c37b-5ba5-4bf5-8219-52fe5314231c", "value": "T127621AACE8B7425CCF566B706739EB88969C7A3DF3449432783C97312782A3A451387D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317587, "uuid": "e18b3933-1c83-4821-acf0-f2e3bb25f9cb", "value": "384:hw2CllznflmtlHlnua4qp7e0sKp31AFTJR51zBve1:WRl1dwnuaXpa3Kp31sFR5pB21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317587, "uuid": "5d44ed1e-adb8-4cfe-a7c0-7e6f81e55908", "value": 15003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317587, "uuid": "08538918-f6b6-48dc-b874-e0ff2e9f6460", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317587, "uuid": "3be09934-cba5-4420-9f43-0643672e0b35", "value": "fdsf.wbk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402ccf6d-1bb0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632320434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320434, "uuid": "736979ab-1322-42fc-bb5c-8c47e4bca158", "comment": "Malware payload (Formbook)", "value": "c545555a5f9114a0624f193881f64aae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320434, "uuid": "c43bc458-2955-42a9-b44d-ca5c38a2283d", "comment": "Malware payload (Formbook)", "value": "7162b4c9de1772aa721d26d185fd1b7e32a9de5c6ebfd86cab3ef0ed7561a837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320434, "uuid": "f4fcd4f2-d3dc-4f0e-ab2d-a8f39ab69570", "comment": "Malware payload (Formbook)", "value": "a81a2965cb5812fa7d9cca27f5514227870d9426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320434, "uuid": "82e99e58-422e-40e2-b687-4b9acd10e2cd", "comment": "Malware payload (Formbook)", "value": "127450e4a9f0aacc0fb0652d1da37c8654c669751d9afd16fd86cc19de5161b6415d9bb4766f57ede2538ab02b233c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320434, "uuid": "3d5e9fda-2f21-47a7-aa31-055d761dd65b", "value": "T1C7F48BC85D894603C7A44572DC6C660632692C5A3723938BCBE53DB73FFE683D22D986", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320434, "uuid": "d3e1db86-aea9-46d9-9d68-c2ee98cc280b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320434, "uuid": "7795409f-0d05-45d7-bf8d-1c7dbfe1c8cb", "value": "12288:FcmtiK5oOq8jJheWSy5BS9sPzt2aXe11MWWq+YZYeBokUjQicXXk:y+FoOq8jWWN5ICMt11MpY2eBokWQicH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632320434, "uuid": "8686361d-481d-4875-ac16-1abf492a3a04", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632320434, "uuid": "f2cbe57d-cabb-4403-855d-8e03e7def5f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320434, "uuid": "7a1c188d-b57d-41c8-bb83-15b25f60bdae", "value": "ibefrankzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6135e00c-1bec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632346259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632346259, "uuid": "aa73857d-e5a9-4852-bae3-af41ba78921b", "comment": "Malware payload (Loki)", "value": "ad94fdfe94fc8fe8d8e1e625a51182b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632346259, "uuid": "cee52ba0-d25a-4a81-badb-7a25d546d94e", "comment": "Malware payload (Loki)", "value": "725c23e55f96bbdb4052c2462dbcb4ee9936a74d67bc7d1263ecce20e56cb659", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632346259, "uuid": "234cdf6e-018b-43f8-a9a3-0c8a281b3056", "comment": "Malware payload (Loki)", "value": "af515e1ef5f64e1777c2047920d1cbc9bde5225b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632346259, "uuid": "bb431d5a-342c-49cc-9417-2eab4e715545", "comment": "Malware payload (Loki)", "value": "3b4169347ae0658c32c09856328ba8e2b3f7fedafdefc74c1a2f2af78ceb4c4c44de17f109b9f092f465a59893eb4324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632346259, "uuid": "e1907677-f8af-43f8-9f12-719c00aadba8", "value": "T11DE33A257395DB23CC2A78394C61259473F39BC33B53DA1B2FCDE6B85652BCA4B14222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632346259, "uuid": "dcdcad4c-c48f-4a29-a6b8-795dbf9dbdd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632346259, "uuid": "3104d3c2-2773-45bb-b4d9-84a8fa2006c3", "value": "3072:XdsbRjH0ScSqHXHTNLRv+8RvBNwZXwmy:tsljH0ScSqHXx5+8RvBNwZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632346259, "uuid": "a73858e3-6844-4183-8c95-e1327ff54b4c", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632346259, "uuid": "9ae9fb84-5b49-4031-95ae-cf2faa55ad6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632346259, "uuid": "21713069-98d5-48ea-85d5-035d08b3b52b", "value": "PO0983372.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de8575c-1bb1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632320806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320806, "uuid": "bec7838e-2cd3-48b8-b491-ea7e8dc3b390", "comment": "Malware payload (AgentTesla)", "value": "d6b0a1379e9fe3d1625d094011a1689a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320806, "uuid": "71d22299-82fc-4601-9b58-3407852fb895", "comment": "Malware payload (AgentTesla)", "value": "72684a74349ce5fc82b27e2a5db12508ff040c352f920ed69fc688162f722c74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320806, "uuid": "bc11fa23-c881-4eb8-b295-b855e03edf62", "comment": "Malware payload (AgentTesla)", "value": "9482e6abbc146ad0a8f385546bef96a63e2a2715", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320806, "uuid": "c17c816e-e0a1-4779-ab75-44fe0dbcc4ce", "comment": "Malware payload (AgentTesla)", "value": "d3d48c60ba6df2dbb43d44788e77cf60448de287e64070d07edb0f868cb8381a3449ca0e82f84f7b736c2b1f6950a853", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320806, "uuid": "a964f600-f595-4e5b-96d2-53189c068b0f", "value": "T145F48AC49D884613D7A44672EC5C6206326C1C1A3723939BDBE13CB73EFE683D62D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320806, "uuid": "fe42b19c-ccf1-4a66-b971-0dbf67865230", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320806, "uuid": "adf7d9ed-7ffd-4307-8ac9-865a6c092480", "value": "12288:pUmtiK5oX1kW98MPYzHGiXUTpFuBhE4kO5nSah5jEtkk:y+FoX+Y8RE2rMUf35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632320806, "uuid": "e40f0fb3-6eb0-45a6-bc02-1e324cd97d6d", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632320806, "uuid": "e290766d-02a4-4c7e-a78b-da45e0603c2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320806, "uuid": "3d6ac400-dddc-4856-b1c1-28af89d5d968", "value": "PO 166737.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee7ad64-1bf3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632349181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349181, "uuid": "a31e76a8-5bbb-4cd7-b38b-7dd06f291a76", "comment": "Malware payload (Quakbot)", "value": "6914ea6d7958fff64c588be284e972a5", "object_relation": "md5", "Tag": [ { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349181, "uuid": "fc8a7dc3-f648-4a5d-97e5-b890b835ec6e", "comment": "Malware payload (Quakbot)", "value": "7342103dcccaef9a164f7effea9b0c48e76409bfa163fc137803b03f3d539b3b", "object_relation": "sha256", "Tag": [ { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349181, "uuid": "017fc55a-a643-49b4-a583-2ea06d1f8ee0", "comment": "Malware payload (Quakbot)", "value": "4c8e33fcd0c9418817a984486368c1c92e6198ec", "object_relation": "sha1", "Tag": [ { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632349181, "uuid": "ffed7c35-7086-493c-803b-6ce9462a8ddd", "comment": "Malware payload (Quakbot)", "value": "b0e26b2b60b9ff74c4cdb013068e875f9735e9f5026971400390f03f9518cee536870f7be346c86c326686283dffb7b1", "object_relation": "sha3-384", "Tag": [ { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632349181, "uuid": "fc0239b1-acbd-4dc1-a323-95fca3d64f01", "value": "T12E940248B2A1C917D55A27385FE287A72F77FC156F6B4207762AB31E08B92BC0C0255F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632349181, "uuid": "999e68cc-b85c-401b-b90f-51563db958c4", "value": "6144:Sk3hOdsylKlgxopeiBNhZF+E+W2kdAQTwapS+jS82DPz6ST4+e3G0SbwduSgcVw7:R5t8etSkuSgcfP8JjZwrcND7fsXo/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632349181, "uuid": "91d54bad-1813-4c04-9008-f35b7e187ece", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632349181, "uuid": "bac05d88-72c0-4136-b0f7-929f18abfff2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632349181, "uuid": "e08d4ab7-da11-4c63-a509-631ee7aeca60", "value": "Payment-717642397-09222021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be9ac25-1bca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632331674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331674, "uuid": "a1bfe90f-260c-4d4e-add9-f41b2a0ce1d6", "comment": "Malware payload (AgentTesla)", "value": "e39c6db1274a46576cfb2cc4db22423e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331674, "uuid": "0ce411d6-5eaa-4aac-8aee-f566b38766c2", "comment": "Malware payload (AgentTesla)", "value": "73b2856d219ac1a904bf652d2e6a9104c3974c014a1c5d2c91863f3c3679af03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331674, "uuid": "a45b8b16-a3be-40fc-8b91-b49f437e686c", "comment": "Malware payload (AgentTesla)", "value": "d6da40b6c01ee2cee773751ca1d644336c485481", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331674, "uuid": "1d0c5217-97b3-402a-9319-88bd0f9e5485", "comment": "Malware payload (AgentTesla)", "value": "2f51fee26ba59d961d9f775a0d6fa25edf12343e2807207fcd33ef2c67c6d0a23ed4d577adc82a8c2b15389631b19329", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331674, "uuid": "32a27681-4580-4433-ae77-37557fde26f4", "value": "T1C2E4012D7690B1AFCD17CA7789781C50AB21E5AA9307C347B453129C9A4E6EFCF210F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331674, "uuid": "1d2ae37b-f93e-46bc-8bdd-887a18a7ecd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331674, "uuid": "697ae8d6-52c0-4f6c-b9fe-b25b9beb2c83", "value": "12288:VYjLvmtiK5oB2HFkdY1mkOquVB5q82qPftZMFCbxGskm3DbU+hI:w7+FoBkGydOqub2uf5Gsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632331674, "uuid": "5c633207-ad63-48ed-b522-82d18bc9b50b", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632331674, "uuid": "b4676d25-751f-4ded-b495-f705be2d6267", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331674, "uuid": "bfc794e8-cd09-4abf-b9a6-90b5631fedb4", "value": "e39c6db1274a46576cfb2cc4db22423e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96a2332-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632312584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312584, "uuid": "71154ef6-c19e-4749-a896-7304980cda4f", "comment": "Malware payload (Loki)", "value": "39d29b2b36b30e9b26139ab3e2d0f982", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312584, "uuid": "82f5d670-c3a3-4055-b120-48c65bb5007c", "comment": "Malware payload (Loki)", "value": "74484ebd3d27d09c34df24fc16ef5ce34a5f4d337c32d1dad9f3ee3e717f0ba3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312584, "uuid": "38934dde-56d9-4d65-8bf9-9e7dd1556acb", "comment": "Malware payload (Loki)", "value": "9ec3ccb051596c501b6d9a397de30e266ea8f734", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312584, "uuid": "03c6c399-b2f2-47f7-9b2a-dde5b7580aa0", "comment": "Malware payload (Loki)", "value": "6944b734594826a85bfa2aee6f4d8c432f72c3a0234ac04584e367d606a7883afe1e6dd47585f248abf392e383abb990", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312584, "uuid": "32e8bb8b-bd2b-4e03-a390-125a7fbbe1b6", "value": "T190837C11285E6EF5F38769BC0C36B6F0D0863D786F01AD73984CBA5E39726409362F69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312584, "uuid": "6da7133d-983d-4a84-becc-45675014654a", "value": "6fc1a2d244c958299fb32338306cc540", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312584, "uuid": "8e35a3b2-38a0-4306-ac5e-4c1229493653", "value": "1536:be1zW5WvgxIPp5Yq06e83gr1/GY9M26FNVd1t1DEsU8kz8xd/:CUibL0911M26FNVd1t1DEsU8kgd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312584, "uuid": "30711baa-c6fc-4450-adea-80d48baa1b7b", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312584, "uuid": "d05fcb41-6a3d-47b2-b233-866844352201", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312584, "uuid": "5553d8da-681d-4330-8db5-426447693fd7", "value": "39d29b2b36b30e9b26139ab3e2d0f982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc95e40-1b6d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632291818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291818, "uuid": "3a2665e3-1a3c-4c9e-9701-ffbe1c818cff", "comment": "Malware payload (RedLineStealer)", "value": "d3a8da9543df5d12e09d251cc1130a4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291818, "uuid": "8a5ed916-1474-44c7-a3a7-c6cba26adecd", "comment": "Malware payload (RedLineStealer)", "value": "744fb5f67ed2b1bed63d2334d16d938cdd3ce1d70a05bf829e3b06237377d3e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291818, "uuid": "6776da09-b24b-409a-be09-054255644fb1", "comment": "Malware payload (RedLineStealer)", "value": "dea469e4808528d832868adce057e4236341ae4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291818, "uuid": "b71b4c6a-e37f-4826-a133-f6ccdb68942f", "comment": "Malware payload (RedLineStealer)", "value": "8b404b5eb662f8c0baa04f79082082abb776658b155cabb5ad68f0450807f26178234bb33c187e6475f0b3b8c48cb0e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291818, "uuid": "19289747-bde0-4d52-bcab-c9e39652069b", "value": "T1D064E0013EA3CF31F59311714820E2E46AB6BD21F9A0DD47F79AFA6E6F302911662357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291818, "uuid": "cbd7f93b-ce97-4e82-a0df-0d8f1c700b64", "value": "6b158934b5de6d6c87c216a76be114df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291818, "uuid": "cfc84143-4680-4edc-b38e-b2c833222721", "value": "3072:+65HndcOOxed6Bskj2BDevQF5EBw1oPqTWA9HPXcfAk6PS5IlTfMMtMoWk6IxAwU:BuETk4Dekcyf2YnlQMtMBBwjt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291818, "uuid": "4820b897-03e2-49a0-9ed5-f0db199b5fa6", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291818, "uuid": "6af5ee6e-eaf6-4837-b5f2-a1cb54e37787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291818, "uuid": "71f994bb-d0a5-42cb-90b8-66907307a9da", "value": "d3a8da9543df5d12e09d251cc1130a4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306b1805-1bb4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632322126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322126, "uuid": "73a1cebc-ca8b-4780-aa95-020bf31360c3", "comment": "Malware payload (GuLoader)", "value": "1a992126fe2b85ea96a8c3f1331db213", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322126, "uuid": "d4f40f3c-4f6a-460e-8469-66c3a6d5eeed", "comment": "Malware payload (GuLoader)", "value": "745b09577210567e946eea915befdc93fcf38944f887be5bff76dd69caf8826a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322126, "uuid": "0fae4c28-eb39-45f4-babd-2130d0a25042", "comment": "Malware payload (GuLoader)", "value": "57d9d1beca83e0ae1dac872c586d37eec21cfbf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322126, "uuid": "4410dc75-899a-43e8-adb6-6fc29c9959e1", "comment": "Malware payload (GuLoader)", "value": "328cc1e5aee28f689adfb7611f2ef1b106d96ece03d2e367501ada76f73e33d8607241c9488edc1da045f6296ec14560", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322126, "uuid": "a0aef864-8d7e-44c2-92fb-a230e44f5fea", "value": "T192A36A306D9FEE33E2C82170E15AA7F53959EC40F45F8E072D547EEE39B2E614A1A424", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322126, "uuid": "e566e726-dc70-47a4-912e-d0bb1725f2c5", "value": "4b82967fdfc14d4519122dc367d279d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322126, "uuid": "22867b20-02b8-4bf4-962e-ed469ded6e25", "value": "768:K1NNOwPFrMtdnjD2Ql5xHe30yD1w0wfRqrs0kqjKR2HmxHLYAeKvcCswHcnpC/0y:G/pMSkfqkqhHerGKvcCfHcpA0p1M+S/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632322126, "uuid": "4c5fb567-c49a-4b8c-bf8f-7abb1e13795f", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632322126, "uuid": "e0dbda0a-e02b-4952-ac1c-4ee76beabf7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322126, "uuid": "18547c53-4654-4ec1-8e28-0c4b38ad2774", "value": "LAND.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa697f6-1bd1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632334545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334545, "uuid": "2a3f0624-ce9a-439c-a5f0-dd13d39b7852", "comment": "Malware payload (Quakbot)", "value": "e9a338892d9900fc821320c390b30f7a", "object_relation": "md5", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334545, "uuid": "ddc01a93-37d4-4066-94e4-b50ef226f9a8", "comment": "Malware payload (Quakbot)", "value": "751483305378ddd40bc1c640265e95f41d02b4b739a5c17188ad51ecc0679213", "object_relation": "sha256", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334545, "uuid": "9b2abd94-402b-485b-b35f-e16e45b347cc", "comment": "Malware payload (Quakbot)", "value": "84c30c0f634b2028677e2105dd44cc49a2ee8aa5", "object_relation": "sha1", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334545, "uuid": "42d466a5-17bc-444f-83e9-c41bdc07accf", "comment": "Malware payload (Quakbot)", "value": "4a752dc71b576273cbd5536ebf5864900b61d41a64677930aee5e18d24370fded31c1823a107163458f9a40a4f980439", "object_relation": "sha3-384", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334545, "uuid": "ee76f79e-0a48-48e3-b17e-c40e686669f3", "value": "T1C5C4AE19BEC3D1A1C83C187488A1C8F27638B865AD54D6477AE93F3F5EB31C25C560AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334545, "uuid": "73ac8eb6-b9ef-4e61-875e-6f66eda0e840", "value": "c900f0b45b7574481cc6a21428393566", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334545, "uuid": "dfdf11dc-48ba-479c-bbd2-f9fe62b8dc50", "value": "12288:s1ghp5DubQyErdxA+zM5miTrqZj1kENwNmhxOANU:L1rv05T+ZjHNwKOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334545, "uuid": "3bf30266-50ba-4c21-ba91-22ff75f3778b", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334545, "uuid": "cfd7d00f-b627-4e57-aa89-b5af7ee2cef1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334545, "uuid": "e0629711-f160-47bd-81a1-78023cc0a397", "value": "e9a338892d9900fc821320c390b30f7a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22b781d-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632334396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334396, "uuid": "5c9c9c22-c75d-427a-98ea-c0cbcfb44d33", "comment": "Malware payload (Quakbot)", "value": "b9b9d450d72ad904602c2cc0fc4c1652", "object_relation": "md5", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334396, "uuid": "63eb1aa0-2694-4241-abc7-a009ee19042d", "comment": "Malware payload (Quakbot)", "value": "7661002966c0c3621224d0c2618488393471ab9c72cd6e1f7592cc49163f23d7", "object_relation": "sha256", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334396, "uuid": "9a2eeaa7-09e8-477a-810c-8d917b0b40fc", "comment": "Malware payload (Quakbot)", "value": "8b93268c98d7ad6e2ee6d58a74b8d5368a721edf", "object_relation": "sha1", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334396, "uuid": "51b7464e-6160-4e5e-9802-7dea40f07ac7", "comment": "Malware payload (Quakbot)", "value": "0fe988321e7e816244beeb04dbfb67b3eeb8c5776f337cbb2209ab729f9b5d63833edbe900bf1a36614d0585f4088daa", "object_relation": "sha3-384", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334396, "uuid": "1b106059-9706-4cf3-97cd-eb1717aa6232", "value": "T14AC4AE19BEC3D1A1C83C187488A1C8F27638B865AD54D6477AE93F3F5EB31C25C560AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334396, "uuid": "06f600b7-1452-43d0-8bc2-8fbf714dc6a1", "value": "027524c1b132b878765c94631d07a5af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334396, "uuid": "eee99d0e-a8c0-4309-9584-e2b73e69d658", "value": "12288:r1ghp5DubQsErdxA+PM5miTrqZj1kENwNmhxOoNU:IDrvo5T+ZjHNwKOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334396, "uuid": "32b88aff-5d8e-4bae-b365-d384e71203fd", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334396, "uuid": "53a848eb-cacb-43cd-ac6d-4d8d87a6a56a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334396, "uuid": "91286b9c-ea99-4991-89a9-bb1afb3d64ae", "value": "b9b9d450d72ad904602c2cc0fc4c1652.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6ed048-1bed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632346954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632346954, "uuid": "471b4e0d-d40a-4ff2-a385-bd534f38fe4d", "comment": "Malware payload (njrat)", "value": "e93d2b8a66beccdcc9b1b769e870ed9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632346954, "uuid": "5e2c381c-1aec-4072-aa09-c6c60734ce4f", "comment": "Malware payload (njrat)", "value": "76b2407cbc713fbe9f164b22aa472f9c182fc898ae83b559dd56830bc57daa01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632346954, "uuid": "628c24d5-361b-454c-b07d-59c51cd62019", "comment": "Malware payload (njrat)", "value": "7b0332c8884d37d73035222708c2964e524b4437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632346954, "uuid": "9c4bca16-b8a1-42ca-84c5-465cf90ca219", "comment": "Malware payload (njrat)", "value": "75085f6d22dda4c71fe465839b204a26afc044e64a3617cef16c4685542c097e1d9759a0571797559be34cb1bdfba1b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632346954, "uuid": "0a6adca1-7c11-4c19-a925-5c3b7768b183", "value": "T1F1032A58B7E48710E07E6A7206B1861113B4ED1BBA26E64D1CC6F1AA2F77350CF15EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632346954, "uuid": "b1cf1ccb-a38b-450b-a4c7-49687444ebb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632346954, "uuid": "0909bdd8-1831-4394-b3d8-e63f40a63508", "value": "768:3ng/QpgHEB6eptD+aoLMdiwQAhOHKYz0cDCglw:X3yE8epW1HW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632346954, "uuid": "7ce53868-9219-4c0e-a5db-0abd3f0a62b3", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632346954, "uuid": "8b7c9aea-47e2-4308-b0a6-d4b12ada71e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632346954, "uuid": "3a479f1c-6201-4284-87d7-adcc8e0cc1ac", "value": "04_extracted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062701f0-1b78-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1632296285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632296285, "uuid": "04f70bb4-19f8-413f-979f-9296c01ab036", "comment": "Malware payload (CobaltStrike)", "value": "5f7b046db7f3fbed0c09d4200957bbaf", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632296285, "uuid": "eda0423a-37d3-4266-960f-742fe3b92786", "comment": "Malware payload (CobaltStrike)", "value": "7703da44bf261e65652af462d3d151498066a2dc315a9f6496204e51099b3e65", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632296285, "uuid": "fa8d1ceb-25c1-4972-8f24-6e816dddc681", "comment": "Malware payload (CobaltStrike)", "value": "e56ee2e34943a2c63863e576d33d1fe8bd898a58", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632296285, "uuid": "f4f64338-f7ff-43c4-955f-66e39edce732", "comment": "Malware payload (CobaltStrike)", "value": "39ce4332f6c33040dc01a7514bfcff2a234a63497a5e28361b19b5d710aa500836d2963671fafc482602a66767b6a672", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632296285, "uuid": "a822c9bb-c13d-49e5-a725-00d2d57b5761", "value": "T19024E0FC3A4FB331C04E58F25DDA09BA4DAAD67B4EC1BF1258E0E365835B01A1B055AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632296285, "uuid": "d305c064-87a5-4b9c-8f71-ccbcc2d32e5f", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632296285, "uuid": "e31bbc85-8c94-40ab-aba5-b9527d77b2d2", "value": "6144:FO2E3nPjJOl3u5PeWdDB8H4bcIL+OQxJ:U2gjQlEPd98qwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632296285, "uuid": "e4ade855-7e90-4af7-a95f-32af7e731dde", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632296285, "uuid": "f1aee974-c8d3-45aa-a446-97ec75abc9ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632296285, "uuid": "689508ac-9286-487f-8893-1e724e8cba33", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2284130-1bd1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632334799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334799, "uuid": "0e863ce4-4463-4c6f-84a1-088704ef7ec0", "comment": "Malware payload (Dridex)", "value": "5319bcacb40db3b1186aed3a6504bd3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334799, "uuid": "a295532b-0859-421c-8dd5-3d21242768af", "comment": "Malware payload (Dridex)", "value": "773791404ffb07d12425dbc1dfe58efbc66d6e1ecc05afeeb5aa3a8c90fe73f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334799, "uuid": "ea78b3f0-0eb7-4415-89a2-6889ebd8eefb", "comment": "Malware payload (Dridex)", "value": "2dc6b46e4a62237c96d474e44b0686c977fbdf9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334799, "uuid": "87d0a49f-1fbf-4d80-941d-3bd52daf4bdb", "comment": "Malware payload (Dridex)", "value": "29fffe2781c8dfdb5cd7b2fef0074003efce35b2fdd62be09f7b8c016446ad8b5a2b2cb6223be7b4f69151ccefb88a19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334799, "uuid": "8a38338c-9909-42b1-8ffc-98f38c5b133d", "value": "T19414D0D3DFBE82B5F1A67A790830AE39242D6741CB84E567F2D9CA908171521F02EE35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334799, "uuid": "e0fcffeb-cb6d-4f63-8b7e-722dd6b3df33", "value": "7ccd6f40a9c36cae6c541b1ce3dcb8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334799, "uuid": "76c24fd6-3c92-45e5-8e20-a60d1a721547", "value": "3072:TglCoxtHaw2NiohdCKwP/LXHiIDLSKsytAKPypyCRbXy1Vee1/TpzXAUjIK:TglCyt6Jrdf6XH9dJtByI6Ve1LpEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334799, "uuid": "21666432-a6e9-4e20-99e2-d47942d6318c", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334799, "uuid": "51ec4561-569b-487c-b3bd-02f371929336", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334799, "uuid": "3149ac14-0218-4367-ab0b-622e46603506", "value": "5319bcacb40db3b1186aed3a6504bd3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff01fb3-1be3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632342660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632342660, "uuid": "a022755c-7ac5-4ed9-8eaa-a1b8d7c47908", "comment": "Malware payload (NanoCore)", "value": "2b40046db5abc6023a401796c1a29b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632342660, "uuid": "589c98ac-2003-4fcd-b2e6-f9bb8880eee0", "comment": "Malware payload (NanoCore)", "value": "775f9defc7acbce051c33a9405a53f01cbc4dd40536baf6d77fd3637eb26a34f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632342660, "uuid": "cfae05d8-9709-4c2b-a132-5a06851f9654", "comment": "Malware payload (NanoCore)", "value": "0653e13acef8f48c2f4718bbe5cadd7eca074322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632342660, "uuid": "9f7f4e52-3d3b-41c0-9b5b-34c086b32894", "comment": "Malware payload (NanoCore)", "value": "89b893d726961b7e16f48023cfbc70b6f1d0ff932ecf2ffec6f8b4b49546b8d819582c78dcc90ab1057689961fa46411", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632342660, "uuid": "1a692dc8-f205-4b6e-abb0-ba1ccaf6aa7d", "value": "T1B814CF2677A88A3FE2DE8979611201129739C2E3D9C3F7DE28D455B79F263E40A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632342660, "uuid": "121e9997-5c15-4a91-a862-72b9e5ec6947", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632342660, "uuid": "23f53a1e-b969-49a2-92bd-f237d2593379", "value": "6144:sLV6Bta6dtJmakIM5Z8GL+1WUQ52F+/8Ej4e2:sLV6BtpmkxGLUcQsEEj4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632342660, "uuid": "f3a2c0d0-f355-49ae-b735-04fe0e85cd58", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632342660, "uuid": "e2d80cbb-e0a2-49f1-9549-82f2a70282a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632342660, "uuid": "f6584191-ac28-4419-9ea9-bec6e6d46cef", "value": "775F9DEFC7ACBCE051C33A9405A53F01CBC4DD40536BA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cc2a3e-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tinba)", "timestamp": 1632317029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317029, "uuid": "2d5c7fe1-31cd-45b1-b2f6-0486ff649352", "comment": "Malware payload (Tinba)", "value": "850afba7e314febef7e7863ed068eaca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317029, "uuid": "c07a60ff-ab7d-45a9-a606-05cf125e5a2d", "comment": "Malware payload (Tinba)", "value": "779d0c3cd37510028bbf736d01f44cb62da94d24724a092cc0bc7f000bd90f44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317029, "uuid": "7b76814b-c31d-4632-a3af-f9c6232c560e", "comment": "Malware payload (Tinba)", "value": "260dde99a51c28d9e359a7852e8013c30f87153e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317029, "uuid": "3b355dab-7f53-417e-8f17-88a48d0d17eb", "comment": "Malware payload (Tinba)", "value": "4e7f0248315ad499b343a9be5a2e18b04d64ff2ef411853411df443a80fba8685fe19cf6a438b5eb7b0b279927819542", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317029, "uuid": "d9998e27-9ca9-48e5-a047-5fd704df014c", "value": "T140044CB1F204E48BD957D8F2991ECD3168623EBD99A0450D32E97FAD68B37D20059F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317029, "uuid": "6e24e533-4a98-444d-b016-b3541bf8c2e3", "value": "043271249094384096fe3a6b9e4520d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317029, "uuid": "bfc52d64-72ef-4511-94d1-6e2bdaaab6b7", "value": "1536:3twyCPx+riFFG1kF/m3wEYQqjh+rmKVsMiVPkSNRA:CycYqdFEgjwqWsMMsaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317029, "uuid": "58c79ba3-944a-40c3-ab5b-6424c96dd9d9", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317029, "uuid": "dab4106c-7672-49d7-8abb-e294515c2d9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317029, "uuid": "0e7a805b-b2c7-417b-bcfa-43b8abd9b04f", "value": "779d0c3cd37510028bbf736d01f44cb62da94d24724a092cc0bc7f000bd90f44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0210b73d-1b6a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632290265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290265, "uuid": "f32dd75b-1faf-4509-9d63-c89802512359", "comment": "Malware payload (Formbook)", "value": "3112fc6f29302bda4f12e998fb7a9ccd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290265, "uuid": "f388f991-c4e8-4a8c-b702-c5254c199a29", "comment": "Malware payload (Formbook)", "value": "77c5f8c9d6625e5f9340db19cfcf39809c4693881c32509c57198be8c5edc771", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290265, "uuid": "1959150a-25e8-470a-902e-1e326ca16daa", "comment": "Malware payload (Formbook)", "value": "1b02b18ed420b8eaa442777d1c2f39d2298ab82c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290265, "uuid": "ce63e56c-8e73-41ed-a1c5-1160c3ade1c1", "comment": "Malware payload (Formbook)", "value": "be5b9824cf99edc6fb817ce2aceab07e9dfd768f0124ed44a1f14989fa72931232f893febcb3ed9d19a426d9bca7fdf6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290265, "uuid": "56f43316-0d8e-4507-b2b2-65c74d3b4c73", "value": "T18CC41238463AC531CD7AE3BE14B250460B73A28AB527E75ABFDDB0883F1B7545418EE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290265, "uuid": "7de4bda4-b132-4c1f-a4cf-0118de49b44b", "value": "12288:bAsd2/jktuIimtiK5oBJIFnTvBBBP08jwd9JE:S+FoBJIFTvBBBjiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632290265, "uuid": "1d62634d-2c52-440b-8e01-553b68652737", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632290265, "uuid": "9eb921df-3391-4a7e-a838-9d6570e4fce3", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290265, "uuid": "cf7d74b2-02cd-4ed1-b120-31df9aea7fdb", "value": "Quotation & Sample Designs.PDF.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42776a4-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316334, "uuid": "5bc2a4cf-df13-47bc-a5be-2f81c27fd969", "comment": "Malware payload (Dridex)", "value": "87fe0a564212edcf152ed63e35a4ef2d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316334, "uuid": "f93cb0dc-ac29-440c-901c-52c9d5c78f5a", "comment": "Malware payload (Dridex)", "value": "793f631fa7ccf1f40db34855f109327eef3b0108ba65cef1f4f1540a27aa5ff4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316334, "uuid": "c144dd45-4fca-4e95-ab88-fdaf4c6994b6", "comment": "Malware payload (Dridex)", "value": "16071f45f466d47cd3beba59b232fafe00acc110", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316334, "uuid": "7d5a3947-ed7b-4666-aae4-168434b1a882", "comment": "Malware payload (Dridex)", "value": "0d707519ba7d7a3fed23531bcc16985b49ffe5a02e009b20c3e7dd484d3ab1381ba46b418f206048801b0330ab14af39", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316334, "uuid": "ebca25c5-3252-4ca8-82e7-e70880adcfff", "value": "T1E6E5E020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316334, "uuid": "a1020a37-34b4-4976-9802-944a6ef99377", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316334, "uuid": "a4044d36-c485-45f6-9d15-c0fda0efcb88", "value": "12288:mVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:7fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316334, "uuid": "69e87bbf-6674-4a49-80f6-7b4911f0c463", "value": 3317760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316334, "uuid": "2353a824-b43c-4b7c-9589-a82a74e9b164", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316334, "uuid": "e1f6f43c-cf1f-4b23-96f8-b3c680fa74dc", "value": "793f631fa7ccf1f40db34855f109327eef3b0108ba65cef1f4f1540a27aa5ff4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371f72ba-1b56-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632281764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632281764, "uuid": "f2290494-7e9d-480e-af8d-32c93f567265", "comment": "Malware payload (RaccoonStealer)", "value": "bf980d718dad8be4ac7710ee607a6df6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632281764, "uuid": "3d37c7a1-1d75-4470-9133-7bc8142774f0", "comment": "Malware payload (RaccoonStealer)", "value": "7993aa8f71a91183bb5a480f80842e149b08a13a02dcc98f0a942ef178c03448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632281764, "uuid": "f42b0f77-abf5-4436-9a3a-56bb32bedf6f", "comment": "Malware payload (RaccoonStealer)", "value": "6904710b33d64fd70dd38a17951441bf182b537f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632281764, "uuid": "454a1d49-274d-47e5-8fa9-b159452cbf18", "comment": "Malware payload (RaccoonStealer)", "value": "94d5c87527d8551c87ed8be0d6476a1068befbcf0cfbad103ea38a2894e9b81d458dbdd6d7b3dfbc647ceb99b2273be8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632281764, "uuid": "5f3cdd33-80d2-484a-9604-21f09530673b", "value": "T195447D20A6A0C034E5B706F849BA97ACA93D7D715B3091CF62D53EEA56376E49C307C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632281764, "uuid": "838c619b-d776-4990-8aa1-b8cae4d6fbc3", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632281764, "uuid": "c44fa474-8554-4ecf-a78b-152ca3bb96ea", "value": "6144:Q5OzpeCKCXiALWergCA+oOaQ3K3M01UiGMUOfNr:zLKCXiALBvAWB3dyU7M1fN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632281764, "uuid": "2d8248ce-d232-4b62-a4f1-97304f22b6e3", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632281764, "uuid": "1179f420-75d2-4b1a-91a9-8297ddcb7c79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632281764, "uuid": "0e158f0d-17e0-438d-bb33-bc857a1b26a3", "value": "bf980d718dad8be4ac7710ee607a6df6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc987be-1b64-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632287812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287812, "uuid": "5e6415d1-2d08-41f8-87ad-fa7b7a7943d7", "comment": "Malware payload (AgentTesla)", "value": "95617f06883bcbfc383ee781db48cc20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287812, "uuid": "f5bfdf09-363e-46de-8959-80f949407a2d", "comment": "Malware payload (AgentTesla)", "value": "79ce8ede106de0310e19bacbad3a5307dc189acf8015fb99a40442746a932f58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287812, "uuid": "202d0590-8f6c-41ae-9194-b75945b3dc37", "comment": "Malware payload (AgentTesla)", "value": "339f3cb2b1730efcc293d5c3abac0089dd949684", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287812, "uuid": "070f8e8a-35b4-4d84-a514-b154d70c1e03", "comment": "Malware payload (AgentTesla)", "value": "c41a7664d7e1b69ca90caf29eecc0dce13dd42ca199ef72de38487d1fe1131f0ca2e3b5d2237744be68ecb7a61b840ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632287812, "uuid": "b01062fb-e4d9-43c4-822f-e9492910ff21", "value": "T13F0547394D2682F747EEC66CD48C1BCEDEA6A4837B919F1AC496D7C2025B70FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632287812, "uuid": "d2641151-fd99-4f33-bd87-658b4f0251f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632287812, "uuid": "ca3a932b-e864-4593-9295-861375e247b6", "value": "12288:Z7af9D0cIegASN3Ps/dx4vsCWtpgu49y+jgidm6gM:s9D0cGO/4vsruVw+jgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632287812, "uuid": "b434ab29-b2cc-4e00-9786-0b9f3da05cd5", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632287812, "uuid": "bb2f1d49-c898-4788-bda4-0f57526efbd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632287812, "uuid": "f30d2cd6-6707-4f8e-9605-859d684dfe16", "value": "pqf0009876545678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0090c83f-1bc4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1632328917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328917, "uuid": "741c2d65-3186-49a0-b8a5-321702bf8978", "comment": "Malware payload (Vjw0rm)", "value": "98ea7ba80213c564ff8f9413aed1ef2c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328917, "uuid": "5d1990c2-3e61-43c7-8a7c-de60b1b235e0", "comment": "Malware payload (Vjw0rm)", "value": "7b07f5c8544d1f7a6922848e574e265ddeaffa87b8d94a4e519c10196b7ad3af", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328917, "uuid": "2867f44b-fa77-4dde-aaa4-4f5b11727aa1", "comment": "Malware payload (Vjw0rm)", "value": "75f44be41b21837b8a5755cf13a4af47277c3c10", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328917, "uuid": "998c3f16-030e-4846-8114-34ff09277334", "comment": "Malware payload (Vjw0rm)", "value": "922abe6711a979c199a69dfeea3308ea112debbfabebf2da4812dde6025e4ee5da86d51efe5cbd60e84815cb0862ff59", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328917, "uuid": "aa1e62b0-783a-49c2-aecf-9b9ab327afdb", "value": "T19DD13259349E74BED1A320A55BFB111F73785CC1DE4D5128C19CF48438386BC927ABAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328917, "uuid": "b9c0dc2a-87c8-4b43-87b8-0e5afcef4c70", "value": "96:QqWhZekzpnEym6i2eUE7U8FkySffxxovWuvW/kcQ/TVb4V5rY22EEbD2+SbXF7fZ:QnZe6tmmeUEHSjf2H6V502lEvGF7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632328917, "uuid": "935d5d84-80c4-49d5-b89f-88cdb5c3345a", "value": 6373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632328917, "uuid": "b837df74-c708-45cb-8f2f-4870e338df88", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328917, "uuid": "f731fe82-b050-4a7b-bee9-5720dc392ec9", "value": "#TWF0027VAG.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b244f7-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316499, "uuid": "0702d66d-eb23-4d79-946d-52d64af5d83d", "comment": "Malware payload (Dridex)", "value": "bf916a4f1cb20d86fa5cde38f899086a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316499, "uuid": "e3f830cf-aa3b-4ac8-95f4-615f5c93d825", "comment": "Malware payload (Dridex)", "value": "7b18fab3c98319ef9924c17fbe764b1fb65b3f10661a61a4f9458d5761fa8934", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316499, "uuid": "fb2170c9-4712-490e-af12-7bb02b56e3d9", "comment": "Malware payload (Dridex)", "value": "7449c965d1709df755daa0f3e2c5c5480638d674", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316499, "uuid": "c1c50240-75d0-4fcf-bdba-e08aedb2cb49", "comment": "Malware payload (Dridex)", "value": "bac8e4a27e8b220d981354c1a48a7b8577d0870da4998914743fe1666fd2781c77c27d834595724ddd99e386b79f18ae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316499, "uuid": "d47bb0b8-4633-452b-9255-3958bba48034", "value": "T13BB5E110EF69E1E6C6B89F3E9408352317F93D75110D608CD392608F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316499, "uuid": "38fd6392-522b-40c3-bcd1-86918511e853", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316499, "uuid": "f062f556-3fc7-4b78-b241-d8fba87091ff", "value": "12288:rVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:qfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316499, "uuid": "247f443b-fcf1-461b-a364-663c74f26733", "value": 2293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316499, "uuid": "42bc082d-2710-4a55-ad7a-f69fa2537e9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316499, "uuid": "3b15a396-f433-4750-ac1f-e6aa4fe702f5", "value": "7b18fab3c98319ef9924c17fbe764b1fb65b3f10661a61a4f9458d5761fa8934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd9f50b-1b9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632313021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313021, "uuid": "9e6528b5-b867-4d1f-aaf1-206e62220083", "comment": "Malware payload (AgentTesla)", "value": "0e82d00d96417d91d257b968852d8866", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313021, "uuid": "de4a1f0b-8b81-49e7-a79e-809a2c43cc0a", "comment": "Malware payload (AgentTesla)", "value": "7b41953809b047db74ed61cf3ecceb535e0382a71976b24c1a966be3a5774c80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313021, "uuid": "b259fcc0-9721-4362-a78d-d2b72b69cd8d", "comment": "Malware payload (AgentTesla)", "value": "64d6465ed138f534bd4ae1a55b4f7efc1bf1f9a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313021, "uuid": "f866962a-6a5d-4d7e-b0ff-df4038b1c2d3", "comment": "Malware payload (AgentTesla)", "value": "4f4805e307f9d435f04b19e4d3fef5c4c3bdb3da71d3736b7657e39bd586aee041f48cf8da2b8283671daaf74f6ac33f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313021, "uuid": "caca5bf6-c5c1-47e4-9491-cb9d05b69507", "value": "T1ACE4C41E3B211EAAEC1CD57C4A191A75BB360E276284EBD207EB34C78B3F1671D09C94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313021, "uuid": "3557dfaa-8e2f-414d-b443-942c519fa107", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313021, "uuid": "a3085897-c778-4447-a2dd-775f308de56e", "value": "12288:vo7WWvgPAZktfOpD84sBzis4CrevgZ7u/:wIfOpD84sBzis4Crec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632313021, "uuid": "23ea2158-b8b3-4d1a-81e7-9223ef7f4271", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632313021, "uuid": "295875bc-323f-4312-89fb-ba97cd03063e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313021, "uuid": "4fe1edce-af53-4758-988a-440b9b3a061c", "value": "butorockmano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ae8b42-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632289489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289489, "uuid": "b860c454-768b-45e7-a9f4-fb635038bb2f", "comment": "Malware payload (SnakeKeylogger)", "value": "186dcb86172260b82ce4e5ffbd66790b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289489, "uuid": "fece217b-72a9-4879-b4ef-85177415c03c", "comment": "Malware payload (SnakeKeylogger)", "value": "7b5aa60070b0a766c23e15da0633e295ee1c2278ddc472f0ccfbbcb1265a8db1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289489, "uuid": "f5910644-edeb-4712-bf26-5d88ddc398e5", "comment": "Malware payload (SnakeKeylogger)", "value": "1d2a9f61da12fd097da772b8600c98592299779f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289489, "uuid": "c799fc9e-34e7-48cf-a07a-ae8088bf02d1", "comment": "Malware payload (SnakeKeylogger)", "value": "440ba376bad3686b46b124a8ffc85d450b2c786e0456514035ab0bedde61fbcadc5b3cb67d7a69a5ae46087cdf4b1488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289489, "uuid": "3b056b3a-8b2a-4dc8-9f2d-3ebe119beb81", "value": "T1DA54D01665ED33E6E5BA4FF85C21B21017787DA55C8AEF2A1E8070DE0672B0052B1F9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289489, "uuid": "87de8f4d-415e-4ccd-b083-074b1f48dd45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289489, "uuid": "4188df75-0f92-4c93-88e2-926987102508", "value": "6144:zJtvJ/xa0AzwNuiGco8PCHQzUX1y6PQWjJpfVvfKfxnA:zLFxVLWcvEQIt4WjD9vfKfBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289489, "uuid": "cc504548-bf5e-4ba2-bba7-567d92cbaf47", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289489, "uuid": "e325f5ab-4258-4be0-bb5e-e83670d6b0fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289489, "uuid": "7d1dc4b0-2448-4f32-a0ee-0b70811c601f", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8eae96f-1be8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344715, "uuid": "1b856d01-c0c7-4067-a8a9-da96b00c3609", "comment": "Malware payload", "value": "90c162c3d97004300742705644d38258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344715, "uuid": "0c1ee545-74f6-41bb-9665-c2c2929aa513", "comment": "Malware payload", "value": "7ba1d6484541570ac5e0b3d035164534312c32d4d7bbe330e4704a142f9f6ff2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344715, "uuid": "40fd10e0-8f2a-41ff-b5e1-7d03b6eae26a", "comment": "Malware payload", "value": "ece6ec1c15b21e8eb848016093b204d4fd9b39f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344715, "uuid": "64fa618d-bb3a-4e26-8387-3ff96edeea77", "comment": "Malware payload", "value": "e2974a25c90d0934ad0bbbb024f275a577981ed4527adaff9bc14b6ad336d3e214808956c5a89aee6b64f001389a91e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344715, "uuid": "9c0f5d48-3be3-476a-8348-b67be3f8a143", "value": "T1F4453A20D67DC870E16224B0452A37F2BE9F491C1BEB5CE74B23FAE5E4341E45D3629A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344715, "uuid": "1451400c-cfd7-4693-ad8e-5ea2e8741a2f", "value": "05170c3952c47a73573887e0f56a9cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344715, "uuid": "28b0e8c8-3bf8-4132-abfc-c2992b1ec671", "value": "24576:Kg4ye61K5UV7j+TjT1QgFhDd3Vcd5j5fr:KgL1K5UVf+jFUd5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344715, "uuid": "424127f0-f255-4297-9116-d346aca44d09", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344715, "uuid": "4632baf0-3a44-4b37-8b7a-d00c5f887511", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344715, "uuid": "d57148a0-a44f-4fce-bb7b-d2b540c44b61", "value": "\u8fea\u62dc\u53c8\u51fa\u4e8b\u4e86\uff0cDMCC\u4e24\u540d\u5973\u63a8\u5e7f\u8df3\u697cMP4.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc333d93-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632334413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334413, "uuid": "10f2a54c-f635-4bbd-a0c9-c641990dccce", "comment": "Malware payload (Quakbot)", "value": "5c4c1023d8ed47504cc64deaef91e40e", "object_relation": "md5", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334413, "uuid": "a387811f-8b59-4790-a017-d34eeacb1cac", "comment": "Malware payload (Quakbot)", "value": "7c6a9dc5626bd62584851b56ce9e386cf5a494e6c5c2d1e36032798edb9405b0", "object_relation": "sha256", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334413, "uuid": "6c94b9a6-1cba-4980-9ad4-1b094c5a9e8e", "comment": "Malware payload (Quakbot)", "value": "5b2cfc4f23aa8e4679d4434c73979c51f26c5486", "object_relation": "sha1", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334413, "uuid": "6ca0b7bd-1c85-4da9-a940-7e81e44cdbf5", "comment": "Malware payload (Quakbot)", "value": "6189c8d0ad7a0718e19883d1e627bb10f52e3f7d777e2a076d2ef57ae1a716f9c39224d8c34d939dd94bb3e988c895ed", "object_relation": "sha3-384", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334413, "uuid": "eea5a647-7744-4c33-8914-e092b32c76dc", "value": "T140C4AE19BEC3D1A1C83C197488A1C8F27638B865AD54D6473AE93F3F5EB31C25C560AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334413, "uuid": "fc66492c-a5f4-44b9-83bd-5b37c1c75325", "value": "c900f0b45b7574481cc6a21428393566", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334413, "uuid": "3182a385-2cc7-444e-b960-ca52f684954e", "value": "12288:t1ghp5DubQ0ErdxA+zM5miTrqZj1kENwNmhxOsNU:avrv05T+ZjHNwKOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334413, "uuid": "e10bae57-03bd-4a35-9e91-d1c03ff49772", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334413, "uuid": "e7a3e95e-eb54-4d6f-a665-b8add5764ecb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334413, "uuid": "9ddedb21-1ecf-42bd-b509-505b967617bf", "value": "5c4c1023d8ed47504cc64deaef91e40e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372ca3d6-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632316983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316983, "uuid": "6ddc60bf-f1bf-4b7c-8032-87bfd69f2c61", "comment": "Malware payload (AsyncRAT)", "value": "09af79e03049e8cce8796ca34c686813", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316983, "uuid": "153bd483-d58d-4acb-b184-d85b906e6075", "comment": "Malware payload (AsyncRAT)", "value": "7ce959339fe4a6de5ccd99f6eaadffec65bdfef6fc101621d04fcf48b815596a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316983, "uuid": "969491cd-98a5-452e-bc10-8ff3d55c1cda", "comment": "Malware payload (AsyncRAT)", "value": "a0e668dae0d6831578e4401cd023123fdf9c3c7f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316983, "uuid": "ea92eefa-037e-44dd-bf7c-e7c96ad48e09", "comment": "Malware payload (AsyncRAT)", "value": "69fecc1f41947f41d98f036635ca32ae78567b444d051c844148510e3fe61911e44e3605d4c26468a787ec3371647d91", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316983, "uuid": "e90fb75d-3d5f-4851-bbce-bcf744918098", "value": "T170A4AEE1A6405CD3EC7A4FB2B0A2DD64563BBF8BB16418AE11C033CB4A6695D540BC7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316983, "uuid": "16e73a10-6739-4654-9e6c-952a45cc76f0", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316983, "uuid": "1d1a4195-a195-4ef9-8909-f573135f7f27", "value": "12288:yqyqC/KyBg0eFzbfrCm5N/Y7m/80cPAYVNL0:yl/Ksg0iCGA7oJnYVB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316983, "uuid": "fa5bb15d-c51f-43c3-93b6-2b18a31bc522", "value": 473761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316983, "uuid": "1af264db-e9ed-4d52-8f73-afb0f7c8b3fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316983, "uuid": "ea7d7fe4-05f2-40f3-a0a9-35969d441731", "value": "7ce959339fe4a6de5ccd99f6eaadffec65bdfef6fc101621d04fcf48b815596a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55491c2e-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632317034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317034, "uuid": "8c049574-eac7-474b-bb0f-3304273a8b8b", "comment": "Malware payload", "value": "03d784c0cc97f78e6118daba029470d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317034, "uuid": "45f4be12-ad2f-444f-b113-dd2c48b3ea48", "comment": "Malware payload", "value": "7d2dd54dac570031bd046328d174193d686de90fbe180ed7bf520b08ea6d0783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317034, "uuid": "1e22f62e-9d4d-49df-972f-492dd14be183", "comment": "Malware payload", "value": "97d6acd2bab0c1212e821fa71720d0e4cf7cf014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317034, "uuid": "80e73c0c-fddd-4665-84dc-ec3ce832a6f1", "comment": "Malware payload", "value": "0b974308114ffa585106708cbd1d75346095849dbb9eec96aeeeff2db2c290ec2cdaec487389281f1c74e25a6ba75e23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317034, "uuid": "838ed427-6de5-49b0-8bb5-0bd7177d5f44", "value": "T19AF3121671AC8C5CD2CB22701F6FDC966FF4EC64DC26566E1542363DA080EA0372ABB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317034, "uuid": "2a1d199a-0c2c-4dab-a959-6cc3b0f2c631", "value": "514c554c4eccf8b5d18d8453867113c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317034, "uuid": "2c3fba82-0421-43be-a318-b2b61c2f4b5f", "value": "3072:cJ5EFKOO6OzSmxs8VHgXPc8XASOg17MTvuout0:PFKiOzC8VEXAouuoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317034, "uuid": "5b9e3f02-8ce2-44dc-8483-6b28f4c883b1", "value": 172933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317034, "uuid": "9df68931-4afe-43ba-a2fd-c1cbd28da9cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317034, "uuid": "0ee6f21e-0445-4fcf-99f7-e6f7ec968718", "value": "7d2dd54dac570031bd046328d174193d686de90fbe180ed7bf520b08ea6d0783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07ebdc8-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632316301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316301, "uuid": "26f307bc-8c72-4698-be6d-4f9a6797c9e6", "comment": "Malware payload (njrat)", "value": "6f68152e33b3f07967f9b575eb5603fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316301, "uuid": "1c8ad3d2-a6fd-4fdf-a138-7070a429f12e", "comment": "Malware payload (njrat)", "value": "7d858d325c067fb66472fc149041de01c544a21575b873db54478758a3977b54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316301, "uuid": "59a8a332-a64c-4898-8d56-f39549e70ccc", "comment": "Malware payload (njrat)", "value": "2d803c53bed75b39160bd62c032e0187a95edd93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316301, "uuid": "93d8ccc3-2799-436a-b2b9-1fb0c0f128d6", "comment": "Malware payload (njrat)", "value": "e9e30d3c9dbf049f2110150d7e9c63cef24aa673d662aac8794a16701dadf517c158d305479a5f8b5b8951acbe728b35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316301, "uuid": "6364e065-437e-4708-be9a-d8ceebe05f77", "value": "T1AF063311BAD080B3DA7218365E38E3117E397E601E61C65B57F86E9EDD786C09320FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316301, "uuid": "1b0df8fe-f818-403c-bebb-599d5ca71629", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316301, "uuid": "de57c306-ee0a-478d-b03a-d7910fb703be", "value": "98304:UlU8GwWPow4Kf9lC/5Iuy/n7ZcGd1Z2CDaGn:iGwWPow4wjZc61ac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316301, "uuid": "ddfcd980-ae3d-415c-8fb5-728b3813bfbc", "value": 3793859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316301, "uuid": "d0e8e15b-30fe-4525-b720-fba28c077b20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316301, "uuid": "275505cb-ec71-4ab8-9fdf-93c3db5d74a0", "value": "7d858d325c067fb66472fc149041de01c544a21575b873db54478758a3977b54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501a5406-1bca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1632331628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331628, "uuid": "64258e4d-e040-4d25-8751-c5e3a1b44aa5", "comment": "Malware payload (STRRAT)", "value": "331f9c680e6d7337eccc1fda2456df20", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331628, "uuid": "c8d6e44f-30c1-4ace-9aa1-3583c4d0e013", "comment": "Malware payload (STRRAT)", "value": "7da1778761f30c8fb589ee5757bec158f72e818c55949a305fcd11d8ae3117a1", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331628, "uuid": "bcaa1cc4-933f-4870-b48c-89b822c19725", "comment": "Malware payload (STRRAT)", "value": "25c176fa9bb0e508dc6ade35a6affe6d6db6689f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331628, "uuid": "a3841c8e-58ab-4462-a78e-5df5d47d8890", "comment": "Malware payload (STRRAT)", "value": "df4fd7272a00d545852fa79c09233748ff37eb0ef94b732505522e294c46351f4b9f91ef46fda99a9d75e513f13c47ed", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331628, "uuid": "433222cd-0fd2-4f58-a1ea-a90e1ed0b8f1", "value": "T19D04F19BE9DACDF0E91701B379645572A30E1058E20990AB34FD7AC55DB2C3C0F5BA8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331628, "uuid": "ffdad581-95b4-4832-a5f8-2d38a9dd8be1", "value": "3072:t8NxIzbcUqnPfu4hKnU5Wscr3WehEPd3vbseFMcbxyliCN964phEKD/UCG3Fvpgt:t84n9qnu4t5W/KPFbMcbTrEL+VvpgBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632331628, "uuid": "cecf6b06-7ef9-42fa-b7e4-341568fb4e5b", "value": 188318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632331628, "uuid": "ad6d972f-1593-4d62-a07c-9eb8c01c469e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331628, "uuid": "d9e477ae-8280-48e8-84b4-1f2a1ad99584", "value": "RQF 10020213.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a848477-1ba0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632313499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313499, "uuid": "7e39c2c9-8526-4fa2-87a2-bb7d5652955f", "comment": "Malware payload (Mirai)", "value": "096c49000b2d16611566c7caa6cfea60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313499, "uuid": "bee46e57-134c-483c-bb79-d80d3f940dc8", "comment": "Malware payload (Mirai)", "value": "7daf976263c696bdfc4057ebab568745e5b74f4ff9b22199a10842af314e07c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313499, "uuid": "931d6cf3-675d-474d-bd0a-69176c6e53d1", "comment": "Malware payload (Mirai)", "value": "6505e1513fc6d2b1f62f26e1c8d134a724445c6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313499, "uuid": "56aa37aa-5627-4a42-a6d3-66e3600e4153", "comment": "Malware payload (Mirai)", "value": "ca473c2a8ed068dac2c4e75e55e65d1a99818842d20c3ff06de78e3c73ef517d1b517b4395c13913fe8a5425b9a5b1ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313499, "uuid": "5138008e-da54-477e-90da-cb113b9931ae", "value": "T11DB339376251C97AC08342F526EBD5729C13BDBF0732229A33947D60AF368DA1E99F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313499, "uuid": "03635190-cd9a-47e0-adb4-c7fd2328b597", "value": "3072:uirMUYZMo/QJLRZDsqtxqLX5I/uJioua2yd1m7FnVqfJXoebNb:SKo/O8qtUbK8bm7FnVqfJXoebNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632313499, "uuid": "ec323e36-d688-446c-a937-3049221aaad2", "value": 116760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632313499, "uuid": "8e4e7602-eaec-451b-9cbf-9ffd79d6acc7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313499, "uuid": "a1a8cf20-596b-40a6-905f-97c900288c75", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f87df43-1b71-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632293375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632293375, "uuid": "8c168132-0e43-4af9-a89f-3922ad9bb075", "comment": "Malware payload (AgentTesla)", "value": "bf74e6f0dc62e6946f7fd80795938c96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632293375, "uuid": "7c25207f-374b-4987-b8b4-af159de3dadc", "comment": "Malware payload (AgentTesla)", "value": "7db1d2bce6130eb878df9a362c9a2021422cf281fbd7db1d59f00986ab3e049e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632293375, "uuid": "c5bf98c9-f371-4bda-9cb4-d9293c8a7804", "comment": "Malware payload (AgentTesla)", "value": "dc64a838de46f7165c6c96dba0e40afe11f69f97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632293375, "uuid": "6db5e65a-34a7-4ef8-b4ef-5a424f764fd7", "comment": "Malware payload (AgentTesla)", "value": "c998ffc043533ee7470a6d0175f221946bdc1581cdc7aa338c296a4ba5096dfd3ca01e2d08507f8b10646ab3bfc98a0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632293375, "uuid": "5269bc4a-a84b-4a22-8b63-20f36f8333bb", "value": "T1470538394D2682F747EEC66CD08C1BCEDEA6A4837B919F1AC496D7D2025B70FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632293375, "uuid": "89654446-f48c-4555-bd1d-8a0b29431ee4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632293375, "uuid": "0ba8d1f0-f081-4ace-bf1b-0a4239af7e89", "value": "6144:Xjx23EJN7scNwkZPSn/4a0rVLdWSPLxLgN4z2YbcU92H9P3NHvBEO7GRYqJ:XjAEO6aA3d5NLgq2wcUK9NHZfaR/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632293375, "uuid": "aa1e4325-a624-4c10-af54-b243d3cf15c4", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632293375, "uuid": "9bb18dc1-61ce-4e10-9425-aa4e37d35edc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632293375, "uuid": "5f4dcd24-f149-4699-8d7a-b413538233f8", "value": "PROFOMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b652a9cb-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632312472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312472, "uuid": "f6cec9d8-879e-4fbe-a060-7938cb78c101", "comment": "Malware payload (AgentTesla)", "value": "529454524fa498813d797d4ab782e3ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312472, "uuid": "6dec72c0-8ae6-4751-9cbc-b8182483543f", "comment": "Malware payload (AgentTesla)", "value": "7dd08bfec3e9bdb2484ed9aa42e1cb4221ca190cd9f084d603fcce1ae65b7e5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312472, "uuid": "5b790b46-7a64-4e99-810d-1f4a60174c64", "comment": "Malware payload (AgentTesla)", "value": "dba125c4d2156f4850bfce89da5e2eaee9fc5b53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312472, "uuid": "360fc1f4-a579-49ee-b4c7-759c734d1d6a", "comment": "Malware payload (AgentTesla)", "value": "36d2ca459d469ea3809611e069eb6b72b98af4712073515c214c06a935b02d2a248aac7cdc8cc1369a4984e50e8b72c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312472, "uuid": "797c168d-e74c-4bbb-aa9f-e5adfe1d2773", "value": "T1E1C42334D37D6B76D5AAC7BFA01580498BB4B58A3B03CE8AAF91B1CA3D5BBC01415D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312472, "uuid": "9728a51d-a2e8-4a5c-acd4-9ab599b32aad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312472, "uuid": "e2e82a37-11b7-4703-8448-98c996b67c8c", "value": "12288:qkRg5jcVagQmtiK5oBdc5oF4K0W7rwofvMKRqXei3E7x77uIaqhCdZRpn+:++FoB1F4Kdrlfkrei3ENuIaqCdZL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312472, "uuid": "e3aba663-9878-454b-b22e-3041e93db2fe", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312472, "uuid": "7e59a3f4-fd49-49b7-8e5d-d5bbbfe7738a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312472, "uuid": "cf3dd789-5fb1-4a09-aadb-ca7607c3f7a0", "value": "529454524fa498813d797d4ab782e3ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8436d16-1c00-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632354969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354969, "uuid": "6d2bfa45-df58-4ff5-9374-681dcb72d774", "comment": "Malware payload (Mirai)", "value": "80a497cf712d5078108c092aace940e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354969, "uuid": "2a67f286-68c9-4f15-913d-309eead79362", "comment": "Malware payload (Mirai)", "value": "7e0b6f1d0ab4991b969255dca6cfea64acca75c1f43a0fdb8ff801700085327f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354969, "uuid": "d6f2084d-cef8-4086-b6a2-41c1306b3c16", "comment": "Malware payload (Mirai)", "value": "d06b23036d5b1ff49e6b52a9f88d861db6dcfa6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354969, "uuid": "fe335771-074f-451d-baa9-a1f1d5d262eb", "comment": "Malware payload (Mirai)", "value": "566011c60a43c3a8ba89ea8cec0f9c9c1d45bea09f44b9f957137fc6822332ac37e975fbbfc06db3e886308a209a384a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354969, "uuid": "05e4c78d-6b9b-4027-b417-e7ae86874486", "value": "T12533AFA2C039BD90C0054774A8258B780763E90697A72EF66B84C6B6904BEECF31D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354969, "uuid": "31702515-15e5-46f9-bbdd-5ecb3e66a1a8", "value": "768:MadRc4wtD8MP8UlIYeM+OnYQ6rVc8jD+Ui9R/hOK/qoC+oh3dT6xC0ImUz:Mag4wtoMoO+nOUM1hX/qoWht2C0ImUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632354969, "uuid": "1db4d54e-7148-4bc5-9d80-8b4672e4cbc6", "value": 54952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632354969, "uuid": "bf9ed175-33d8-4a6e-b365-482e71a27144", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354969, "uuid": "7faf366a-b354-4dc6-830c-2675f15c22eb", "value": "80a497cf712d5078108c092aace940e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e184938a-1b3f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (YoungLotus)", "timestamp": 1632272172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632272172, "uuid": "d5992016-035b-4022-b7a1-47191eab0c5d", "comment": "Malware payload (YoungLotus)", "value": "5c2c312c218ccfa377a60d137f1b23a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632272172, "uuid": "811c94a3-b276-4bb0-8cb0-ff3ddab69551", "comment": "Malware payload (YoungLotus)", "value": "7e2a64b1518d22cdb493edbbbde9d69d3e81c2c4da3fc8bd3defd931b989ba8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632272172, "uuid": "a4220e10-2303-4295-a48a-cf94ab095e24", "comment": "Malware payload (YoungLotus)", "value": "2fedf0e6524abb785897667b8be852df810d15d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632272172, "uuid": "18299470-e1ef-4485-82b4-ee2ba036dc03", "comment": "Malware payload (YoungLotus)", "value": "cf72d07ae2cc69d5adf8ad084099e772424dea7957a892eb600da2442a4851a194aeddcabc35b9a2a9acda6289e73d94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632272172, "uuid": "67b4c309-3602-4bc7-978b-905044f304fb", "value": "T144656B57BFEE8C71D27A1530045A52FC54B6A8313F61C1E723B8BA6EE9713C29927702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632272172, "uuid": "67eb364c-5194-4281-88c6-b525ab087c09", "value": "e2afc946bb1a7942e18b4d1a8f444ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632272172, "uuid": "28c67cc9-13cb-4a71-a324-04abcd11bdb3", "value": "24576:RfnAFlGkI9i7sAVsbFoaHAThny4U5Ep9SO5+2BgiqinuKhLJWkI:FnIAkIAsAVmHetxPrdnuKhLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632272172, "uuid": "92f80dac-4567-4ca4-8fa1-d6fe40b95096", "value": 1470464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632272172, "uuid": "275a21f2-cdf0-46c9-a04f-5194dfd469eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632272172, "uuid": "b14d5cc7-eaa2-4b0f-a364-2f85dbe56d22", "value": "\u9a6c\u5c3c\u62c9\u516c\u5395\u788e\u5c38\u5973\u6559\u5e08\uff01\u53ea\u56e0\u4e0d\u613f\u505a\u6821\u957f\u60c5\u4eba.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbfb5e8-1b53-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632280618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632280618, "uuid": "e497d248-7614-4ea8-8881-cf6e4ab7ab6e", "comment": "Malware payload (SnakeKeylogger)", "value": "e6a8dc271e75663a16fef9e05843b3b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632280618, "uuid": "9d2ef515-8af6-4f65-8690-1c0702950daa", "comment": "Malware payload (SnakeKeylogger)", "value": "7f9304674714101d313e54aa23fc8fcbb1634ba8e2532f15cea0279de2189e1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632280618, "uuid": "722be002-e983-4070-800a-556c53dcb9c0", "comment": "Malware payload (SnakeKeylogger)", "value": "3fdeee44f212f89060592440920b1db840e25a20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632280618, "uuid": "8b8d2689-6325-4d0d-957a-f871d7052acb", "comment": "Malware payload (SnakeKeylogger)", "value": "506344df4b356ef5899fcba3d74aa0e03d29f428f6ea04b2bcfc012a21a821c00e371fc22a67d3bb7ab3dd483ddc2907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632280618, "uuid": "066ae204-d08e-486c-8e29-0acbd8a80f34", "value": "T15EF407394D2682F747EEC66CD08C1BCEDEA6A4837B919F1AC496D7D2025B70FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632280618, "uuid": "ee781997-ccf4-4379-a6ea-83acdc746c18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632280618, "uuid": "cff52eea-adfb-44ea-adef-3309a3bd0223", "value": "6144:U7h1PWtAMgYej5XAnOFabuU5Y7rK5/Bfrhgn08bNrK9fUUUsR1YpxB:U7njxAG4f9H8bFK2UUs8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632280618, "uuid": "8756ab95-2ca2-45d3-89d3-2b11f91142c6", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632280618, "uuid": "df1114ea-f1a7-40fb-afcb-833e6710a1ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632280618, "uuid": "8e583347-dfaa-4bfd-af72-25cc5e99cb23", "value": "SHIPPING DOC (CI,COO,PL,BL).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb80c87-1be7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344296, "uuid": "d3df1355-4142-4aaf-8e98-0040ab8a21c5", "comment": "Malware payload", "value": "169d4e1aa1dcb3e0ee55127e6134ba5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344296, "uuid": "f3b07ef1-255a-4d9f-9792-2546c6ff1f4a", "comment": "Malware payload", "value": "807d64d7a9a6c61df643d03a7c8750c69e7f76bbb8ad9cb939a1af7c63f1471e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344296, "uuid": "26e6370e-78ff-4f36-afcf-8886bf02b886", "comment": "Malware payload", "value": "480819041f6d330c34414b8b4f21efef24baf60d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344296, "uuid": "272619c1-c939-445a-8303-13fa289eb0a3", "comment": "Malware payload", "value": "1f8e6b4f563e7f21b30b24b24a3e5445028fb7b80b00610302534f1ca6c335f947a0a6f7427825d027b2d46e93f901fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344296, "uuid": "09241290-fd46-4543-96d1-7eda51c6ef0f", "value": "T1F6756A01AD4C54A3E9A610F0B18A32F5A39DAF252B60BDD74700FEABED353D159342DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344296, "uuid": "dc937e59-7b42-435a-9325-1b5012a3ecdb", "value": "e2afc946bb1a7942e18b4d1a8f444ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344296, "uuid": "c97fe021-a6ee-4b87-921f-538f6b08c5e3", "value": "49152:+nIAkI6+nixxqUQWAJjaVYRV6JQb3oq7B7fkcK8ekQd9HFmsGGyXCfp:skI6IWqUQWAxaV26JQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344296, "uuid": "277e1ac9-9ea0-4029-a9a7-b004f26cab24", "value": 1617920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344296, "uuid": "8ff94a5c-6904-4fda-89db-ea3cc3714023", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344296, "uuid": "2dfd529f-a57c-40cc-b9bb-32e2bb4f9708", "value": "\u8fea\u62dc\u6613\u5f69\u516c\u53f8\u5973\u8d22\u52a1\u88ab\u8f6e\u5978\u81f4\u6b7b\u89c6\u9891\u6d41\u51fa.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f908664-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632312407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312407, "uuid": "06638adc-87d4-4013-b451-37186cd1ef6c", "comment": "Malware payload (ArkeiStealer)", "value": "8735452c0788d7e75b1ae31619ddfbcf", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312407, "uuid": "6e381b7b-4610-44f6-a9f9-8a96f300f933", "comment": "Malware payload (ArkeiStealer)", "value": "808182a5687fb8a151d742c30da41e9eae1f3c57d192587425afe65f006c626b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312407, "uuid": "9048fa3b-3cfb-4c90-9767-2ce15328757a", "comment": "Malware payload (ArkeiStealer)", "value": "bbe3fe70b594a66894d00db9b61d5f059a6a5f32", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312407, "uuid": "b1c30477-e22c-47f9-be89-670c4ba4a9b1", "comment": "Malware payload (ArkeiStealer)", "value": "87eca32add08ff725adeb83d0f67487f8c33b26585ce6f35b623b381013fbd11aa665cfb8a52581b13dcdbfa5963d037", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312407, "uuid": "4b462849-a7c0-4a5d-8c28-da51a9ffde94", "value": "T18A648D207AE0C035F1F712F8897A93A8A93E7E71AB3491CB62D516EA56347E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312407, "uuid": "88069f46-90c3-4c3e-a80c-9a9d8aa6a001", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312407, "uuid": "9368f0f3-371a-47cb-aa3d-eac3f5da7b4d", "value": "6144:Pk+BXY6MIv25gakJF/VC6RF9Q7t93CMWhFCZ9u5:pBXY6MI+5QJq6Rs7H7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312407, "uuid": "1e4b89de-802b-449d-a80d-38fcf0970eac", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312407, "uuid": "a2c15d6e-670f-4c66-b071-9c376c692263", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312407, "uuid": "c3d0a6c4-73a0-443b-a62b-fc1cd8202e01", "value": "8735452c0788d7e75b1ae31619ddfbcf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a20db6a-1bf8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632351348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632351348, "uuid": "bc050b25-4b33-4404-b046-b2e3ac724916", "comment": "Malware payload (ArkeiStealer)", "value": "1078b2da3e05a9553ab90db21124a14d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632351348, "uuid": "21a29160-a274-42a6-b08d-0a57fb08ea4c", "comment": "Malware payload (ArkeiStealer)", "value": "80a4368647ea647206896e0bf47e3340ad3b8cb21d54005b151f1975086ec615", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632351348, "uuid": "0eb18eb6-c365-4dcb-a73b-b1f4de4b7ec0", "comment": "Malware payload (ArkeiStealer)", "value": "8cc677bb0536e685ee9170b1356babd2d91d052f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632351348, "uuid": "453f6671-88ac-43a2-b1b4-6de00bd07d12", "comment": "Malware payload (ArkeiStealer)", "value": "b0eeca948a302cdedfc3ec1bc0c13b7715f6723ba2f651266628a3b750516b05844fb8fd9f7ddb0055b7b93a7ef97c81", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632351348, "uuid": "dbcffd0c-7cb4-407c-ba5a-f172d85d9efc", "value": "T1F7F4021077E0C034F6B356B945F982A8B93EBEB1773485CB62C126DA5AB46E0DD30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632351348, "uuid": "549fb6b0-8961-4812-9453-ce6e7bda054c", "value": "f74a0f3da1e112835a6ac32552c0a4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632351348, "uuid": "76df6397-866b-4fe7-b79b-23388f7f2fa1", "value": "12288:UaiBVohFZebXvxiyAxURDCeqdqyIjtbmRkChr3ImQxpQAf/Tf39amM:CohObXb+8edqyIBaPktpQMFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632351348, "uuid": "5d56381f-c385-4cc0-9337-89ea52685faf", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632351348, "uuid": "8e1359bc-8b2d-42e4-a230-20b19a3c6beb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632351348, "uuid": "b576fd5b-3cda-42f7-b859-abd1603e9677", "value": "1078b2da3e05a9553ab90db21124a14d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ac1637-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632289661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289661, "uuid": "7e54b52f-3d2c-41db-ae43-c0a77b11733f", "comment": "Malware payload (Loki)", "value": "88659bebd1f537a3bb060619d47abbf5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289661, "uuid": "232fd1fb-4038-4259-a7db-c447c440cc90", "comment": "Malware payload (Loki)", "value": "80aa19dd2e84b75f2ce08977d5e60015a1ac79ffb7df34528a82c7980c0375b9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289661, "uuid": "7e8a808d-8042-4585-bc74-9f46ecb43eea", "comment": "Malware payload (Loki)", "value": "6ce8f625b08231c7ec1c23b373df04c53ca5e7eb", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289661, "uuid": "0f6e327c-cad1-486e-b915-62dd1123674f", "comment": "Malware payload (Loki)", "value": "86140f6aabb246537ac211ea9b68956c23cfcfec0314564122a3aadf4546fae4cbdefa8caff5ad3b8051e98d0b1eeadc", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289661, "uuid": "812fd13f-f617-4097-b144-0480a99f01ed", "value": "T1ACD3011937C87149FAE81F772C885445D7A1EC233C5CFA16C426B24CC571ABA3B22A73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289661, "uuid": "6031f342-5f83-49e7-aed4-f6831505f6a0", "value": "3072:As8ghpQhXB5Frb/wq0fPhKG3BBMZ5LuZJ:As8gLIxb/8nhKeCaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289661, "uuid": "507de1b8-406f-4eb1-8831-72eae58f1884", "value": 132568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289661, "uuid": "c15b42fc-0650-4cf1-a127-544ddb27b291", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289661, "uuid": "48a8fdbd-e124-4b6a-941c-0cc2355c4f7e", "value": "RFQ_final version.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6494067c-1bde-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632340252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632340252, "uuid": "e05dfa12-96d1-4578-aca4-fcc8dd3e8c24", "comment": "Malware payload", "value": "1a1a9b3969abcd2fccd2c6ce20be68ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632340252, "uuid": "31014400-19c4-4a81-805b-cc2865f0758f", "comment": "Malware payload", "value": "80b539d191e840c8f421b2a1c34dcdd34961675d43d678d08b55d17f1e97fc63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632340252, "uuid": "80b80457-3ae9-46f0-9ccc-b1bc8fc8c064", "comment": "Malware payload", "value": "4aa438483d23766f72ba0f4e2bccb2dd30689845", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632340252, "uuid": "9deecb1d-6810-4ce1-b08d-3df5a5c23e55", "comment": "Malware payload", "value": "41b6de1f72fc89e7a7d789c026e6affb4b5c7b1229d1eea63972311fc436305c8ce51a76c80298b17eb5be4ff3066ce9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632340252, "uuid": "72de4002-5e88-4fc2-930b-949cb28fb4d3", "value": "T1DD256AEA7384E5B0ED34763EDA45B16D0221BBF52D030D8CDE643EC696A4B50BD4E983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632340252, "uuid": "7a347ea5-a7ba-4ead-b0c3-90e7d832738f", "value": "91a12f22e7f2305a107edddf42c40880", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632340252, "uuid": "0580b495-4b50-4202-8f61-e2fc88ccc117", "value": "12288:FYfGUHuv5bSkBsFkT5m3GpOAz1DeoAdrL7i:FYOUUtBs2YqO8ArPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632340252, "uuid": "a0bc54cd-07a1-4a20-a23a-a71495c77dc2", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632340252, "uuid": "115dfbab-bcb6-4fda-9dd0-32a434412e3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632340252, "uuid": "99b22216-a56f-4d3b-b6c3-ef8ef52a63b7", "value": "1a1a9b3969abcd2fccd2c6ce20be68ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1a2365-1bcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632333982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333982, "uuid": "507c0154-ba23-4a8f-8cc3-0093cf6574d8", "comment": "Malware payload (Dridex)", "value": "d691fac192a32e8685208be4292ca391", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333982, "uuid": "fdbee2e6-67da-49f3-9d3b-b10f5f5f10dc", "comment": "Malware payload (Dridex)", "value": "8149ceb39ff2e6b8be8eec851ee2e63b2befc3dc4976e38a11a0e8563c725d53", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333982, "uuid": "3147ad6a-77c5-4e0f-9712-0c9210a626d3", "comment": "Malware payload (Dridex)", "value": "50404a856a4b0417d747d4144d6e5e00b8c1be89", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333982, "uuid": "60ef6a3b-26d4-4c9b-9a59-e58d4f2bfccb", "comment": "Malware payload (Dridex)", "value": "4a47feb4b6bbed27dedf9b6dbd48d4725ed5db17af7d08a74bc6482c194deeb9565fdf2d444c308b1d6974e2b312f907", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333982, "uuid": "3ae756f5-8463-469a-a962-3f59b5ec2cd4", "value": "T16F14D0D3DFBE82B5F1A67A790830BE39242D6741CB84E567F2D9CA908171521F02EE35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333982, "uuid": "03dc18f2-5f59-4f66-a0ef-09b44711d88e", "value": "7ccd6f40a9c36cae6c541b1ce3dcb8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333982, "uuid": "a61880a2-f649-48f2-a046-2aabe97f8fa0", "value": "3072:AglCoxtHaw2NiohdCKwP/LXHiIDLSKsytAKPypyCRbXy1Vee1/TpzXAAjIK:AglCyt6Jrdf6XH9dJtByI6Ve1LpEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632333982, "uuid": "32ef0e4b-1376-4aa8-98df-456b7ab3a677", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632333982, "uuid": "71ac9e11-2f31-4cfb-8662-0303c17c9b8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333982, "uuid": "0efdf0f0-0be9-4172-88ef-c5ffe7ec6360", "value": "d691fac192a32e8685208be4292ca391.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2844b0b-1b9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632312868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312868, "uuid": "96867f90-1cc3-4be5-a856-d0c347fbb8a6", "comment": "Malware payload (Formbook)", "value": "66474aafcf1b5dae6da44f0965ee5e29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312868, "uuid": "2ac2b7fd-0498-47a2-aceb-cd67e83725ef", "comment": "Malware payload (Formbook)", "value": "81d263a31fc8b6fe2e2db250efd4314912eb09a11027a6cfc67257d7fa5e071a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312868, "uuid": "1a6ce628-d879-402f-be35-1057c6485c7d", "comment": "Malware payload (Formbook)", "value": "d6bbe45bccd177c75648ddf45db11f0e6ee808e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312868, "uuid": "118cd3f1-0b6f-42d2-a231-5ff347d4b2f5", "comment": "Malware payload (Formbook)", "value": "caefa485280751b331bc063d256cf36dd59a8fc1428aaef3dfb54fe19ee372ddd7a9baf77f4135da5f0583d83abb4be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312868, "uuid": "373d923b-9b83-41b2-818c-fdc4be2643c4", "value": "T177B41238E1A8D774DA788BFE2021412D0FF4E08AB523F75A5FD670CD6E067969005EB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312868, "uuid": "299013e9-37bc-4f41-ab2b-3cb397fbfa8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312868, "uuid": "f3e2b5f3-143e-4a38-9c67-e2f60369566e", "value": "12288:ixEx9mtiK5oB1E+kMxFmw5FAiJ+pGlmhSYcfGUkc6vZxhe:v+FoB19fmw0iJNm/cfGUkdZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312868, "uuid": "676adf79-b8e3-4f2a-81ea-752a50b00a0e", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312868, "uuid": "51d444ce-158a-4aac-b139-01147613d9c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312868, "uuid": "b3a5ca39-ff59-4b6c-9e62-79bbc5948bf0", "value": "Updated SOA 210920.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e6d427-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Osiris)", "timestamp": 1632316709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316709, "uuid": "e19937e3-71fc-438b-b521-0c7347141377", "comment": "Malware payload (Osiris)", "value": "a1f481baa8334ad8a5c65919af2b6346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316709, "uuid": "087bcd03-12b2-498e-a057-35562fa622e7", "comment": "Malware payload (Osiris)", "value": "81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316709, "uuid": "530a0e2a-e547-4903-8329-2a5f6311d295", "comment": "Malware payload (Osiris)", "value": "aec7cd3a72d96948bf741bba48048c1b5cf3f036", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316709, "uuid": "b759d57e-3055-485e-93ec-6852e3752f75", "comment": "Malware payload (Osiris)", "value": "6f39b3670785edf6b753ee2e8283b66954614f83c7247cdbed2245a3a78beec30f362be51df9f4022f63a5dc8c460992", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316709, "uuid": "6996dd0e-71e0-4b27-aaf1-fb7fb92a151b", "value": "T16855C026F6D08437C163263C8C5B57649839BE503D297C462AF91E4CDF39BC13A7A2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316709, "uuid": "b6546edc-1106-43d1-9aa5-e7bca7e83cc1", "value": "e9ee54cc14ff2b781a4098b903b56f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316709, "uuid": "695b5ba6-fe52-4699-9123-52d669246037", "value": "12288:u+rq0yKJ7KZeBA4DVzlzEyn2QFqTjCAjkTnV/QH7OTzId2nfpN3fXz:FW0yreAkpzP/QCAjkTmbOwYRZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316709, "uuid": "b5d02c5f-6b7f-457f-8fc9-429dc15acba8", "value": 1309194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316709, "uuid": "ec698c7f-6277-407a-aace-a462da0a6f48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316709, "uuid": "91c4c50f-a492-475f-8bbd-fa5f458e0131", "value": "81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d70980e-1bde-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632340321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632340321, "uuid": "b3685991-4fcb-49f8-b5d4-9c411bcb27d2", "comment": "Malware payload", "value": "e305e556788f5cc2dc034149a8d9e8ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632340321, "uuid": "a6a964a5-ba75-4ff5-9e8c-435340d079a2", "comment": "Malware payload", "value": "825e36e7c6f0544f5a09df5b381fc386b56ecbdcd656939738269d0dc71d9582", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632340321, "uuid": "6fed43bf-6e6a-49a0-8008-b16d9a9ee7c6", "comment": "Malware payload", "value": "1cd255bfd6cdac1753ba2f83ebfc124afe91056d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632340321, "uuid": "d5e4da2e-17df-47c8-9816-b1cfa20ccfcc", "comment": "Malware payload", "value": "2cb93d3e9599c217b050ed7e5117ae474a1e1ca74afeaafe0ac71cfd9d8f1c512e0f772362fdb93d9a8056ec2371836f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632340321, "uuid": "4f76cb43-7f98-439b-8a35-cd414c73228d", "value": "T16735AE394D2682F7C7DEC63CD58C0BCEDAA6A8977A914F1EC495E7C2026770BE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632340321, "uuid": "d1fcc1a7-b6cf-49db-aedd-b7e2b8ca74b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632340321, "uuid": "8f1ece51-3163-433a-83ff-cdc125e0118d", "value": "12288:F/yRVfOKBHcfTibql+LfXnheY5xncaNTYdQVYJUEKl75jQWmc:QRV7B8fTinvhpcUY2VYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632340321, "uuid": "3d4bf9da-67ee-4c38-8471-86e554d3508a", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632340321, "uuid": "1101d086-76c4-407d-a6aa-95601f944dab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632340321, "uuid": "a1f3f80e-cfc5-4b29-9ffa-bd344dc0cd08", "value": "bank slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4a448c-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Osiris)", "timestamp": 1632316992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316992, "uuid": "0c3bdf33-f4b0-42d7-862d-cae58d0b626a", "comment": "Malware payload (Osiris)", "value": "4b8ea3f7be543e21300e56992b08d6ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316992, "uuid": "e7777bc7-ae4f-4bfd-81e2-0648b128d3ac", "comment": "Malware payload (Osiris)", "value": "82b13cf8f768b3830b50622eba4da3593a8a724ffcefd55793ee87a4f0ea57ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316992, "uuid": "078355bd-47e7-43db-a82b-bff888790438", "comment": "Malware payload (Osiris)", "value": "dcfbb5dd3087ec2edc6c3a779916b1b2585d42eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316992, "uuid": "872e92cd-abaf-4141-81ef-2a6165cc7775", "comment": "Malware payload (Osiris)", "value": "d91ac56865fcea61b316bcb8a41200b68552739788bf9c22f22a4fb4a212ab6af08471d73fa74c256820debaeb987a4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316992, "uuid": "5ecbf7b4-c37e-4265-9aac-c9c80934cee3", "value": "T18D94BF22F581C036D6B102B0CEAD7F3B96FDE524033599D7B78809951EA44E67339B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316992, "uuid": "b917d772-3c66-4c2d-948f-c70abae5ef90", "value": "cd3fc0dde37bf2787f0f054ef3b5a350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316992, "uuid": "eca7bdf9-38d5-41b7-9d1b-23f72b860c90", "value": "12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK9SATTsx/SA/WegYfdNbrqnu4:rXh6XcBXo8TsL8Y8m/ATTySA/DrfdNbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316992, "uuid": "a522d25a-cd07-4ffb-b476-2bf4d121f7a2", "value": 444938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316992, "uuid": "63f57555-7aa4-4792-827e-c08561e52831", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316992, "uuid": "69357531-1d1e-4030-9c50-2544174e02be", "value": "82b13cf8f768b3830b50622eba4da3593a8a724ffcefd55793ee87a4f0ea57ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19c9e1f-1b9c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632312008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312008, "uuid": "3beff628-4393-44d9-b69c-2666915b4849", "comment": "Malware payload (Formbook)", "value": "9959d407a749bd1e62be0b694b14fa36", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312008, "uuid": "2d17ea47-e0d6-4b58-9362-2f1e4da8b4bb", "comment": "Malware payload (Formbook)", "value": "84fec53104dacb65fa87340eba3cfa241dcb5d751cf809a45cce4a1371b143b9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312008, "uuid": "21f327fe-f7f3-44b9-a281-d1acb94fa68c", "comment": "Malware payload (Formbook)", "value": "d99f4eb935e83b7d08b1ae1c52717648faebb253", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312008, "uuid": "0a5fa43e-831d-4837-9e3a-136ad44b68fa", "comment": "Malware payload (Formbook)", "value": "8e8f8dc9e930fc38ddf3640a4a3907a2775177d3b255f0458a69e43d64abbefdaece9ec7fb9725a67225222fe2e4e019", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312008, "uuid": "c92e7540-1050-444b-90ae-160a0a1c2757", "value": "T1127282BCC46702988F866BF82B1B6F85148C761DF795A132367C97386BD2D3B411287D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312008, "uuid": "e8be7ace-0066-4e18-894f-6bdd858a1493", "value": "384:S1j20C80Iz12N2fJes2ysR5lzMdqQiWKnGC/Im2+quLvpH:c2X80Iz12+JcysjlodqQKnGC/DJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312008, "uuid": "c4786ca3-6f9a-40bb-a193-44fad8a13a99", "value": 17522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312008, "uuid": "adee4c69-c290-4fa7-8fac-b0debe3815ac", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312008, "uuid": "06e3ff98-34b8-40b9-8b58-8ad147eee639", "value": "RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb2e750-1b9c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632312166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312166, "uuid": "f2ba0ca7-4e35-45f9-82db-8487dd377bc9", "comment": "Malware payload", "value": "8688430cd5349ed7e6eab9686e6466ac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312166, "uuid": "1ac80266-cbe1-4330-a6af-652f0335f31d", "comment": "Malware payload", "value": "85d24fafdef30b0c93a29db7c904589679f4c008d3f1182c0efcce5158cde60e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312166, "uuid": "0a915bca-5280-4a4d-b75e-5d8acc1b8880", "comment": "Malware payload", "value": "10a47dc5b529e6bc208d7510a1b9ad91a01e84e7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312166, "uuid": "d85b2516-74a6-4b22-95fc-53c6db512954", "comment": "Malware payload", "value": "712db334603189695df3a78c0961fbe58e62393f019bfb852153ca012ba1218184fce9592e30fd8e1c4ec111d570c8c0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312166, "uuid": "547e55cd-349d-4941-9f18-6ad15b053442", "value": "T1EBF561C8EE15E86201572B7BAF13D0F5E7AD1C6822CC9DB8E2487065F09D9ECD1E9790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312166, "uuid": "12469d24-5a55-4054-b575-bc819161f0cb", "value": "24576:RavsFb2mfOAV7BLRzEOUIJOnYAlXegfEbuFlWTpoy5c9z9Dlo43nh4YCa+iSnsxR:UGon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312166, "uuid": "95462c70-3778-4f72-a2c3-4b76aaab4a1d", "value": 3621174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312166, "uuid": "07565396-9066-4040-a633-941c914dc281", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312166, "uuid": "a08fa871-ede9-4f2b-94b1-c2aa2555d84e", "value": "Moneygram_transactions_list_xlsx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9af9325-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632334409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334409, "uuid": "d1f1a798-3b5a-49b9-bf1d-518b93f6f422", "comment": "Malware payload (Quakbot)", "value": "c5d1ee46c11db0a3def28ee906e576b7", "object_relation": "md5", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334409, "uuid": "5a57bdda-c25b-4d5d-b0fa-c3dfa1007082", "comment": "Malware payload (Quakbot)", "value": "869d4eb12740dfd04266c42333ecff7d3fb655ad0bad17044678b28de3bbdb22", "object_relation": "sha256", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334409, "uuid": "262c91de-c509-4d97-9b3d-dd8b87bac682", "comment": "Malware payload (Quakbot)", "value": "fb53fb0614e67bd219edf7b2af7826c02501bb09", "object_relation": "sha1", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334409, "uuid": "91238d5c-19d4-4d54-8c82-28bb11963e82", "comment": "Malware payload (Quakbot)", "value": "a16a9456df8f6b5d1d33dec53ef96fe55cab9fd938396effec5e47addb5de4bdd3f40f2e66baeea269e3ff46d4e58aad", "object_relation": "sha3-384", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334409, "uuid": "2948f4ff-d54f-46fd-bee3-f0fe558702ac", "value": "T153C4AE19BEC3D1A1C83C187488A1C8F27638B865AD54D6477AE93F3F5EB31C25C560AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334409, "uuid": "bb75c0b3-8590-40e7-b468-b0749e684fd3", "value": "c900f0b45b7574481cc6a21428393566", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334409, "uuid": "fc0cf699-e06c-4fc3-a3f5-5adf76dbd8a0", "value": "12288:N1ghp5DubQpErdxA+zM5miTrqZj1kENwNmhxOENU:68rv05T+ZjHNwKOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334409, "uuid": "6d32c781-621d-4b59-9247-53f74dd3f227", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334409, "uuid": "34db704e-2029-4fb6-a0ca-583489d3e51e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334409, "uuid": "fa89fb83-7e47-4e61-9a00-4b24aced335d", "value": "c5d1ee46c11db0a3def28ee906e576b7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba7d350-1b80-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632299891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632299891, "uuid": "fe59b92f-ffa7-473b-9059-1828ec47a657", "comment": "Malware payload", "value": "ace09926494a8da126b047fc4bf2ddbc", "object_relation": "md5", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632299891, "uuid": "2e7a5a78-47f6-4ce9-ac4b-37c51fe82109", "comment": "Malware payload", "value": "877bb5ce43b8c4e8618fe8cbb78d0b6a0e4483bea2ccb6f9d7c6cc503ecd620f", "object_relation": "sha256", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632299891, "uuid": "d50e178b-dbb1-47c6-bc5e-17667626ff2d", "comment": "Malware payload", "value": "f96ba2a85b7491f6557db7b72825c9d15fc71a98", "object_relation": "sha1", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632299891, "uuid": "da672a6e-43a0-4314-9380-5f99dce4a3be", "comment": "Malware payload", "value": "923085c6fdc16b3876a2ae1b4ccc307044efab4ac018f497c7eab126d392e004ecd2693c46caded4244058ad47a56e31", "object_relation": "sha3-384", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632299891, "uuid": "8d71c777-d13c-484e-9557-336ff8e96abb", "value": "T19C73D577016155AAC5891730F4A50F4B7A78D6341A80B69CB04EF2EEEC0D79D9EF83B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632299891, "uuid": "c4a29470-90d2-4bfb-90d1-9c7ed32d4fc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632299891, "uuid": "a3e974ab-693a-41df-adac-7e98b7c8c2f3", "value": "768:+tlMnH8f9vjkr8wYjg3NR7VLKdyNbJOahLzn3nqvlPARFHBPvc0kdPMWRv1ZCDqr:6aHUrkr8wcgj7ZzN9RVK3e75I3spUkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632299891, "uuid": "8aef73f8-ebd7-480e-9071-7312a5b3ab74", "value": 78840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632299891, "uuid": "f611fb7f-d474-4020-8b10-a804f91711bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632299891, "uuid": "bd1f7f47-06d1-4602-94ac-305b08eca7da", "value": "877bb5ce43b8c4e8618fe8cbb78d0b6a0e4483bea2ccb6f9d7c6cc503ecd620f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd34ecf0-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632316832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316832, "uuid": "e1e6cf29-78a6-40af-b7b1-36ec69867eee", "comment": "Malware payload (ArkeiStealer)", "value": "069af8b2095e8ea6cf4baadd6919fea8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316832, "uuid": "6c2ec3ed-72ca-4e49-bcdb-9e2a93f41cf2", "comment": "Malware payload (ArkeiStealer)", "value": "8824c8925e085ca11ef0ce41f6cf0d2fed532a0785113f5f34e89164ab4022bd", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316832, "uuid": "9249ba76-c4a3-41a7-bcb8-402958f96435", "comment": "Malware payload (ArkeiStealer)", "value": "1c116bcbbd7a2d5bbd29b413fedd3d5fd53ff8a7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316832, "uuid": "ccf94e70-bf3e-43e7-9d0c-b24d4bc45c3c", "comment": "Malware payload (ArkeiStealer)", "value": "80cf17074606c2f187c0de6884228d29418b872554868e03a9f8e06f2417a3212fdae3d6c23729d213f097bf8e5991c1", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316832, "uuid": "d719d3a6-5ec1-4fd6-91b2-dbec9a2c1b9e", "value": "T15BF40120B790C039F1B752F919B983B8A82D7AB05B7451CB52DA57EE53387E89C30793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316832, "uuid": "24db07ce-086d-4612-b507-52926f1246cc", "value": "1bd6d269463cc591268b8d14694f5ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316832, "uuid": "7007f847-8c8e-4580-89ca-5d4c4883bbbc", "value": "12288:8ZEn79QsAUx50gpfXQ0iqqRd2y+gNYzZa9lJXugx3cbaRhcRTaJxLK5D51J2:82n73VbiBzOgNYzZMX/QQcRTaJpK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316832, "uuid": "7512b8ed-a460-4b14-9327-3f089fd6f02f", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316832, "uuid": "71e3bac2-79fb-4e4c-a952-8444790fc739", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316832, "uuid": "c367b16a-6fe7-42a2-9104-2725ba8aa16a", "value": "8824c8925e085ca11ef0ce41f6cf0d2fed532a0785113f5f34e89164ab4022bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ae3c03-1bdb-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632339068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632339068, "uuid": "29d2ff7a-0c95-4177-8f24-ada152f3ea6d", "comment": "Malware payload", "value": "10d236571f2a51ca6decbbffc95fe8ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632339068, "uuid": "c7ccabca-576d-499b-b960-e2b9bf2b6444", "comment": "Malware payload", "value": "89792562a252d77300c0e91cb0d2a96af9a244e6dce2ad89560a4ddc71781dcf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632339068, "uuid": "5294e743-6116-4bf3-931e-bac4db2a6c55", "comment": "Malware payload", "value": "14f413c8250c43599e077f4764ec8d504505d0af", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632339068, "uuid": "01141092-2991-4f67-bef8-12c4392d0000", "comment": "Malware payload", "value": "c7a66fb478c524b400e3eb67ac11801320e6a66e553fbe89071ce86e178616208599e469c4ed88ce423989f8dc761d9c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632339068, "uuid": "a24bca1d-2dd3-4021-b4f1-30bf07f67de5", "value": "T160C4AE19BEC3D1A1C83C187488A1C8F27638B865AD54D6477AE93F3F5EB31C25C560AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632339068, "uuid": "2f4f4206-cc58-4ddc-bf7a-72fd2702ffe1", "value": "c900f0b45b7574481cc6a21428393566", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632339068, "uuid": "c0dc0791-8d43-4071-b504-3b26da38bab7", "value": "12288:71ghp5DubQeErdxA+zM5miTrqZj1kENwNmhxOANU:YJrv05T+ZjHNwKOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632339068, "uuid": "c5ab3688-0b17-4b47-8bdf-2094a6e7884e", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632339068, "uuid": "1142c7fb-cbb6-4918-b524-abe3e1989800", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632339068, "uuid": "482bb53b-3fce-4bb7-8095-ba0ab980dbaf", "value": "44461.7586239583.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fecd1c5-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632316917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316917, "uuid": "bfa4031b-e086-4931-afa6-88176f981cbe", "comment": "Malware payload", "value": "14a1c10ee20c9b0f61fa6a2c03fbf49e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316917, "uuid": "64db3d75-438e-47d8-a77e-7536c3c05efd", "comment": "Malware payload", "value": "89cb042e2ffbaa056e4cfa561e0928373884a079dd719183fca1151fbaeb6530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316917, "uuid": "6590e508-fedb-4eef-bfd7-5d21fca4151b", "comment": "Malware payload", "value": "dc6830bcafbc241555b74b777db6586369be1004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316917, "uuid": "ed1a24a2-6000-4f73-a2e9-a13964ecc6a5", "comment": "Malware payload", "value": "4c0ad9b6b8d3b32d961f9a96508784c24519a92013d05aee62e83c3ff3aadeabc0b6de90ebe24065432142993ba26be8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316917, "uuid": "41672a7f-fb5c-4cef-8f17-a71a2470c188", "value": "T16DC4C6A7949BB5D3F814B4B192F3F5A108B2D97A386304D1B80D2D7F0D92983175BB3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316917, "uuid": "de51ff17-aae7-49d1-97c1-cd710f216f24", "value": "514c554c4eccf8b5d18d8453867113c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316917, "uuid": "31a3394e-8e66-48c9-9b6d-e07d2242ec2f", "value": "3072:cJ5EFKOO6OzSmxs8VHgXPc8XASOg17MTvuout0y66Lq:PFKiOzC8VEXAouuoSdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316917, "uuid": "00fead54-13a6-408e-a741-aa6213aec75c", "value": 592760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316917, "uuid": "78a7b50a-05da-4e63-b865-83a19a64dcb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316917, "uuid": "a500c349-a29f-4619-bc13-7d673852970e", "value": "89cb042e2ffbaa056e4cfa561e0928373884a079dd719183fca1151fbaeb6530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daaabc4a-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316828, "uuid": "a68269b1-783f-40c9-b9d4-102dc27797b5", "comment": "Malware payload (Stop)", "value": "42641148d169c91748209ac49b18cdd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316828, "uuid": "8ae5c1d1-8020-42b1-8460-fd5ef3e979d4", "comment": "Malware payload (Stop)", "value": "8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316828, "uuid": "2687e72b-1f9f-471a-9a5f-a5e0baf3e6f0", "comment": "Malware payload (Stop)", "value": "815394e3e3fe21a9f3103446c558496571a5ad31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316828, "uuid": "eb878fbf-0bb9-4de8-bb6a-d8baa7992ad3", "comment": "Malware payload (Stop)", "value": "94655aede85d3abae144ca0b8d8d4a0166178dd6acba3070c91da4f5900e9f02759d1b237f2ce4c5e58934f76dd81044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316828, "uuid": "4a8fa753-f6df-44e0-bbb5-22033a2977a9", "value": "T1B9F4022066A1C035E1B712F956B59378A93EBEB1AB3481CB62D527FD23342E4CD31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316828, "uuid": "fbb762ea-aa90-4119-a573-86c8c4685713", "value": "7be124dd1509e56149d37e4e5fc24f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316828, "uuid": "25395e3e-1aa9-490a-9869-6dde39e20cd1", "value": "12288:5ZyDfJn+tWH0eTzx8VU8fjVibfoez4tedeeFhhbit6kNV5XoQmo:5YDfJVPiVVfJUsHeFPbYYQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316828, "uuid": "55af1ba9-188e-495b-b3c7-c5d782f538bd", "value": 781312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316828, "uuid": "43e7d5eb-ab6c-49cb-b9a6-e0cb4ad45634", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316828, "uuid": "c3d21d30-d851-4632-a404-016859269ec1", "value": "8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0c484f-1ba9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632317419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317419, "uuid": "8cc263b8-5fea-4acd-a588-67b99cbb9c22", "comment": "Malware payload (Gafgyt)", "value": "b61604e38f534f20e6a4e53236eb633b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317419, "uuid": "760f613b-c026-48ab-b2b8-74a3504d76f7", "comment": "Malware payload (Gafgyt)", "value": "8ab09fa31266ad6fd27faf1a743ea61679114bcc68d99ac74dbef2f3d3a84bcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317419, "uuid": "4f30abe8-c14b-4fbe-89a5-9458215d57db", "comment": "Malware payload (Gafgyt)", "value": "8a066926bc1391d412796e78b14d0c51a7e15bd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317419, "uuid": "716ba672-c7cb-44be-8a8e-8b2271396c7f", "comment": "Malware payload (Gafgyt)", "value": "eccb4a4dbc888c36f2abf14525c1f358baae4755a984b42e4d0c3e1499004ec41bd38a03b52c8fad4a9f424ca3c87350", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317419, "uuid": "b637f57e-ea09-488f-bd60-64885e820a82", "value": "T11DE34A05E7408B57C1E2277AF7DB424A33339B54A3DB33099928ABF43FC27995E22516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317419, "uuid": "e0acf2c8-894d-43cf-9dae-a76be8cea757", "value": "3072:cNIka4IulYWH8Eat/3cRhcno03M/98L1mpwfvRQfZn:cSkaLulYI8X3cPcnoMM/98L1mpwfvaf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317419, "uuid": "b7488303-bb2b-48de-9fbe-a522be1cc95a", "value": 149793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317419, "uuid": "f2dbbbb2-0c5a-463f-962b-ea4aae31acd7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317419, "uuid": "66c508ed-aecc-4f22-96a9-29e182fc64db", "value": "b61604e38f534f20e6a4e53236eb633b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfea3e5-1b6b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632291035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291035, "uuid": "be6043b7-12af-4656-8d45-d33641bb0301", "comment": "Malware payload (RaccoonStealer)", "value": "cd6840322e52a0d876091362be52d5b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291035, "uuid": "926048a7-12f4-47d0-a3ca-369ad4eb02f5", "comment": "Malware payload (RaccoonStealer)", "value": "8ab51cf2cab4229fe066408371523e0eaa78c3fa743636b58e58100258380b88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291035, "uuid": "e92656d6-f880-4b0c-8961-4b34293ab938", "comment": "Malware payload (RaccoonStealer)", "value": "35240c3eba48dd3f02eca1c129451035ebac0467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291035, "uuid": "6168b7ed-7acb-40fd-a887-3a9812716331", "comment": "Malware payload (RaccoonStealer)", "value": "03c959d0bddbe557cc2d47651a8113e7c01b41ec7d9343287ac6756402081f6d5a1de382b303523583cde4d3e9a24215", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291035, "uuid": "70947ae4-b80b-46e2-8f1a-79eacd4f7525", "value": "T186647C20B6E0C035F1F702F989BA93A8A93E7E719B3491CB62D516EA16347E4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291035, "uuid": "7085f8bc-0fab-4160-9364-cc49d8706aee", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291035, "uuid": "2e16a56f-f9c4-44a1-909a-4b10634ba333", "value": "6144:CLpAWERXIMn55a1MF/VZ/FFHm8WYFL2ChJJ:YAWERXIu5CMh/FoTDChJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291035, "uuid": "a37fb27f-a1dd-4904-9e69-76eaee55c221", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291035, "uuid": "81010145-36af-45ea-8215-686118bace34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291035, "uuid": "eaf4e9e2-bc39-40c3-85b2-18726d51e93e", "value": "cd6840322e52a0d876091362be52d5b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a232e5d8-1bc9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632331336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331336, "uuid": "4e553e17-5056-40c9-8a22-80ae1f707235", "comment": "Malware payload (AgentTesla)", "value": "3073440c7c095f7dfdc349018a592447", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331336, "uuid": "e3c5996b-9ef5-4dc1-a3ff-9c7bf17af3a0", "comment": "Malware payload (AgentTesla)", "value": "8b630a14b747cf4ab2964814a0ffe646e25e7301f4eabe2e3a93b60ed7090875", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331336, "uuid": "fcc02873-daeb-4f89-aca9-d30d1df3efe2", "comment": "Malware payload (AgentTesla)", "value": "88e3d71c3bee912fc22e08f832e7a3f567a1109a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632331336, "uuid": "292a8589-cd55-4a18-9188-41e19f91e67e", "comment": "Malware payload (AgentTesla)", "value": "18e11e1b4fd9e7a2815a7f509699a9845a1588a372277698a1ac6de58b0cf38eb0a0f8ea86446564322bee061b5b854a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331336, "uuid": "55a33e01-1819-4923-8625-805a40a2193a", "value": "T1C7B47562A527294DE92A3171D052F36D86058FFC4D37DA4CFC49B21ED272B831CB9A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331336, "uuid": "c5a965f9-be63-4c92-8b89-fe8b71fbb8be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331336, "uuid": "2caf1aa4-a06f-48f5-a5e0-17ad54088f6a", "value": "1536:77KqMz9wg9vKv9Q5/y7iRIeDl4+KhAMbOlpl6yfCWwAUubk3f:fKnz9wm5y704+SAnev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632331336, "uuid": "ec7e4b79-09f6-45e1-8d1d-1e8c4a4a2468", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632331336, "uuid": "e185d528-96b1-439b-b6e5-18a3d840fb7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632331336, "uuid": "adf99fbe-4d1f-4866-88cd-247b99212c5a", "value": "DHL STATEMENT OF ACCOUNT - 3300315209_PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ccefff0-1b6e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632292055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292055, "uuid": "946c015a-415b-4870-bd7d-9aec3457b8ae", "comment": "Malware payload (Quakbot)", "value": "375159dfb4ad054084520b16c4526fd4", "object_relation": "md5", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292055, "uuid": "6cc78812-070f-4c03-9628-632a9569ee98", "comment": "Malware payload (Quakbot)", "value": "8c7d789dd04f3b02e35d0e710dca3fedd52f22a0b8669f3c42464069f6ccf4fe", "object_relation": "sha256", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292055, "uuid": "1743d672-b242-4286-b6d9-27caa78085fc", "comment": "Malware payload (Quakbot)", "value": "48dd701bd0117a1755a66ce92976357c004ada34", "object_relation": "sha1", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292055, "uuid": "6824389a-cb38-45d6-a0cb-9d3e24c4f3df", "comment": "Malware payload (Quakbot)", "value": "a4166f6ed50e667ad4da56b2b9de81169981e8b509d06e18299aead3ca9c9b513f698672b9bd3baae7ff080952a2575f", "object_relation": "sha3-384", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292055, "uuid": "899fe088-98bf-4150-9553-f0b97fb0d37f", "value": "T19E149257A9058AC3E51C93F8BE434ED92F066F08E9563EEB21153F8A7F742530D8A11E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292055, "uuid": "59076139-5d29-408d-bddb-d0e4707dcbd6", "value": "6144:AKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgOSrofSHq8oD5+:Y1F55+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632292055, "uuid": "6faf3d6c-eee5-4127-9656-98af40ba9a6c", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632292055, "uuid": "0724bb44-9e37-4f50-848a-8df3a1bd9c35", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292055, "uuid": "ca33b675-5c02-4e92-ad88-8117c572188a", "value": "Payment-687700136-09212021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f2af1d-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632334129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334129, "uuid": "21a1c766-f6fe-4836-969c-9e24ea9c3229", "comment": "Malware payload", "value": "f53bab18a386c1aaeb33eb3af77fc72a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334129, "uuid": "4fcdee9c-4b62-4d91-b02b-0a65ef2c941c", "comment": "Malware payload", "value": "8cd6e5dea82722c90661af6b2f93009a28aa5e896e02ad035d4294c1d8bf1eab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334129, "uuid": "e2947284-c55a-44c9-9ba3-d40411e00342", "comment": "Malware payload", "value": "70b68e8fb2e890d1e63ca028ce91ed2565216edb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334129, "uuid": "69bcc0bc-be34-4baf-88fd-65907aafb663", "comment": "Malware payload", "value": "53f8044be673922f5e1c6d46b20d5cbf11cc504b7de3cdc3ac927c097e39ed4a9076e33cbf583c2974f26a2c2c983b73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334129, "uuid": "e86a90f2-9ddc-4873-b042-46169dbe2331", "value": "T13EE26C301AA1CC72C48564705B39D3B2AA3D643220A5ED87B75A6F315E31693FF3A70B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334129, "uuid": "baf15d5a-8f64-40b9-8757-062831ed7a3e", "value": "768:AdcAWyVbmbxAM2OHQycaXGLDa2+VFNw4qIXTOE:AdcAWyx0+YHzXIaBVFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334129, "uuid": "bdb2dd62-82e9-4e87-845d-756f39b80023", "value": 31526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334129, "uuid": "586de05a-9789-4601-aa39-0dbe858ad6eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334129, "uuid": "f74c5912-d702-4055-bc55-0a5fc78f8fe6", "value": "f53bab18a386c1aaeb33eb3af77fc72a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ac8dbe-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632316764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316764, "uuid": "434d4577-39fe-413e-91c0-ea2f774afacc", "comment": "Malware payload (Gafgyt)", "value": "58dd8375a499f2b15330386dd926ba83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316764, "uuid": "b83d6fbc-26e6-46aa-a086-4f9553ea75f6", "comment": "Malware payload (Gafgyt)", "value": "8d003220d4c7ec630f7786d2268a63811bc2371b5b6cb7b16816a6f56f5c7a0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316764, "uuid": "ad7b8f84-6dff-4c8b-a9a6-8a96d1739c54", "comment": "Malware payload (Gafgyt)", "value": "65f02a5f942b796c4845202d43ebcdc843f4c15e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316764, "uuid": "fd7a0845-d686-4f33-ae44-23975446acb0", "comment": "Malware payload (Gafgyt)", "value": "bb5b65bfcd7610d5ffc54ff1a791b62ac8dea77317488c576f27ea049d5a62d342cb06ac7fd179e1f14a201fb756536f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316764, "uuid": "6980fc4e-584e-410f-9573-631a5d87626e", "value": "T169B32801D5508B57C2D227BABBAF825D33332BA897DB33115A24BBB41BC279D1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316764, "uuid": "ad7d3693-313b-4b6c-bfa4-bd3083f6b5aa", "value": "3072:7BtataD2temCIan6IgDxYBt/4kbmTQOWsXAOn:nataD2m6IgDSBykbmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316764, "uuid": "4767e81c-2827-4874-a2ce-f7d3119dea4b", "value": 111016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316764, "uuid": "3538ee93-78c2-422e-ae20-179b8be7e865", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316764, "uuid": "ce57e846-9b23-4963-9ea5-85e2ba0840d1", "value": "58dd8375a499f2b15330386dd926ba83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1790b89c-1b6e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632292019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292019, "uuid": "cd219f67-de77-44de-98d0-442784323b22", "comment": "Malware payload (Formbook)", "value": "24960042ad6c12059fc424d9119ebbba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292019, "uuid": "bb549214-c029-4239-88f8-245f4446b7c1", "comment": "Malware payload (Formbook)", "value": "8d536146e57d878eea148bc98170d2f7cad77ea57f0fbefedf3f3c0dcce40ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292019, "uuid": "0738da91-bc55-4bb4-85fa-66ed32bd2e1c", "comment": "Malware payload (Formbook)", "value": "a5b44dc60c82a59c6eeeab63b8d38ec9ed2a171e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292019, "uuid": "3ba23d8f-f505-4dba-b5c5-3e94f1f43d70", "comment": "Malware payload (Formbook)", "value": "ad986e88fe12282dd534e261a255c0c1583c5f4a366444b84ff3387ad881ad50873cc5d88ded8968e7b6d977e4c8328b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292019, "uuid": "848d5539-88b3-4203-854c-fb5bb8e35fb9", "value": "T1030548394D2682F747EEC66CD08C1BCEDEA6A4837B919F1AC496D7D2025B70FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292019, "uuid": "1de30581-3a26-4262-a5c3-c85ccd564e4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292019, "uuid": "baefe57e-024d-40ee-a97d-33820c7e0cc6", "value": "6144:s7JD1lC/qw6Uz/ZL50bRiH4NjdkyPlbvZVnIWyGMT4h+4Ji2lK/97sf+9JZvIM:s7d2qw6UzxL5wiYnLNZVIWp1msf7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632292019, "uuid": "3ffc547a-5427-47b1-81c9-02f8d8dc582f", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632292019, "uuid": "3878d76f-674c-4725-bb21-be7d671a293e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292019, "uuid": "da24cc8a-f81f-46ca-a61c-582054de1d19", "value": "PAYMENT ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b53b079-1bb6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1632322949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322949, "uuid": "3d2d48b4-30fa-435d-ad45-10add0841c9b", "comment": "Malware payload (DanaBot)", "value": "8712755dacf26bb2b8ea2d7e350d660c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322949, "uuid": "ae16c14e-34bc-46e0-b1f1-c54a65206465", "comment": "Malware payload (DanaBot)", "value": "8def99998e3a697036a41b772611921145566aca6366ed90ebbaa36dd95a4cb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322949, "uuid": "be4366c3-25df-4d27-8c0c-66b89f6de0f7", "comment": "Malware payload (DanaBot)", "value": "e23332ece73bcf4e7ebdb13f4fa62c71c49db594", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322949, "uuid": "2682d631-239b-40f2-8095-f31c4ed4ab5d", "comment": "Malware payload (DanaBot)", "value": "915587ee0c7506b9d856ec1393dc6314ee32748fe302c405a814af7acb83e5c0b64a4d897dd39bac4780b0073b797b02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322949, "uuid": "3103f6f8-e768-494c-be18-882282d31c4e", "value": "T1E9663322F780D876D8160FBA4632D7779E1BBE684E784619F15CB60E3E70650B066F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322949, "uuid": "a2934f2f-4544-461d-89f3-b8a3775f7fac", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322949, "uuid": "e4ae94d9-1244-4721-84e0-e53c8842b596", "value": "98304:GZPYm5osh8vMLYaTwJhguJ9qkbrdwTJFndRsjlZktwhgwqRLC4u/vghwEF:G9YmDh8vML23g0tSyl+WsQ7YWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632322949, "uuid": "216dc0bf-de64-4a7b-8ab1-90dc83671046", "value": 6521575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632322949, "uuid": "ebb8e81d-cd48-4ee4-8366-dca2ff4dab2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322949, "uuid": "655db47a-e46e-4565-9f9d-df7dacb370d1", "value": "8712755dacf26bb2b8ea2d7e350d660c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70586e5-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316365, "uuid": "488b7e9c-23b4-4749-8cb5-7f1a45ce0df5", "comment": "Malware payload (Dridex)", "value": "cb26500033b94ab02dd4fe689935464b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316365, "uuid": "6500d3f9-0e02-4e67-aee5-31691e647ec9", "comment": "Malware payload (Dridex)", "value": "8f241220413489fb05abc0610962c84195dd55472744c37521eea39fa1d1335a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316365, "uuid": "9b069000-94de-42cc-9468-25b381901b0a", "comment": "Malware payload (Dridex)", "value": "2aac2b7d4a18405ad3f8fece16d4a4e53888acdb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316365, "uuid": "eee4b9f5-34cd-4d4f-a7d6-2c037ca39733", "comment": "Malware payload (Dridex)", "value": "32e60742657561381a01cd3f089a71a6800b07d9ec62fa18850650ad3333a060d6f786cde0b9df68113e7d8dc43b1e8d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316365, "uuid": "5d05c2b8-60a7-460f-85c4-023e6ed46028", "value": "T114E5E020EF69E1E6C6B89F3E9408352727B93D75110D618CC392704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316365, "uuid": "08ffa1b4-4063-436d-807b-699377a8fef4", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316365, "uuid": "b6b2b094-67a3-4431-8b38-c70e7e5b3a58", "value": "12288:lVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:8fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316365, "uuid": "f4579162-10ac-4f2d-8dd9-60e3cbfd35bf", "value": 3137536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316365, "uuid": "27f64065-c2e2-4d32-ad1d-3b4de6337d3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316365, "uuid": "effbf85c-e3e5-41fa-9b63-bb33d94810b7", "value": "8f241220413489fb05abc0610962c84195dd55472744c37521eea39fa1d1335a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b949487f-1bd1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632334811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334811, "uuid": "35053a3a-0968-47c3-a957-aa679af5e462", "comment": "Malware payload (Dridex)", "value": "5a66fe2fcfd1de0b4d27f65c23f9b59e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334811, "uuid": "e044695d-1bc2-47eb-972b-d33011a49446", "comment": "Malware payload (Dridex)", "value": "8f2e0592571ad0147ac0a4fb9c8e8a5fff9ca8ef450b4522ae66aca6243f5138", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334811, "uuid": "f617e0d2-1d4b-41e5-b52a-8310636dbb64", "comment": "Malware payload (Dridex)", "value": "159ac0ac6406a39564840edb3550e554f0cdb9b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334811, "uuid": "d538c46c-432b-4ebb-8cc4-d32d4a4df06d", "comment": "Malware payload (Dridex)", "value": "fd9ec74020b69bf16296fae66dc2f5249c5f1aaf4f5061579a8b41ccf095d7425e6a03dfa86b35a52059a9aebacf8b2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334811, "uuid": "a7453e5b-8a2e-4299-be1d-1b7c9aec8f8d", "value": "T18914DF13A6B931D3E19B383F92A1E7B16E386F43C338C45BD6D4F46899712A354A5332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334811, "uuid": "7fdffd0e-2f13-4826-9437-d8f0443588e4", "value": "bc9115da123ae49443de76ad96ad8e1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334811, "uuid": "ea51dbeb-9c1b-4d7c-8c42-949ffe2e7037", "value": "3072:Dwd4sevPYabz9RLhPO8f3zRCyvD6meTuxn2ZjflxomQYIE5HbiK/n1:YsvQabz9C21Pmb82xnwiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334811, "uuid": "04381065-5a0e-4505-a1ae-4f9f2902d328", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334811, "uuid": "56fe534a-990f-4b50-8ce9-c1e00e03a197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334811, "uuid": "60264cd2-ac38-40c7-a0bf-2e6e44e8a7fc", "value": "5a66fe2fcfd1de0b4d27f65c23f9b59e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34d14fa-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632312547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312547, "uuid": "3899ec21-9d37-4a63-86fe-9f74cacd3e72", "comment": "Malware payload (RedLineStealer)", "value": "5d059f6a5da9c90b000ffdff0ec71cae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312547, "uuid": "80b0e1e2-4ff2-4e32-8443-34d1654f5dd8", "comment": "Malware payload (RedLineStealer)", "value": "8f6395ba8bc75356ab43438f8378a40925a6aeabc3c446a626a484c54cac51fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312547, "uuid": "28863992-a9d4-43f3-b7d4-181fc0d45441", "comment": "Malware payload (RedLineStealer)", "value": "88feb4e71368b4163ab4a3afd6995211ed5fbcb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312547, "uuid": "cb2fb356-93ef-40e6-b24a-1adacfc1c34b", "comment": "Malware payload (RedLineStealer)", "value": "d96fab0b70b6e714906aefd8f6061d3ba12aa751dceb75ec26a156969d22323cc4d511fdd84197cb6ea45189299fccbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312547, "uuid": "0ec28882-87f3-4391-bd5c-f529359620c0", "value": "T12684AE20BAE0C035F5F752F889B597A8A93E7EB15B3490CB62D126FA16342E4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312547, "uuid": "02ccaa9a-08f5-4e64-bc21-719787cfa4b7", "value": "0f0c12643909b692a9be3510bdc965e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312547, "uuid": "9f1e8244-d75f-423d-9b77-564adb5a2f6a", "value": "6144:R0CUuPW9d+jjFPYacga9PUWOJRDJFuqmLnq6ELLwUAE6dLfV16t:xUuPW9d+3FY9P6bDWrnql6dLVwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312547, "uuid": "e2fba60c-9aed-45de-b234-199d04b209d5", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312547, "uuid": "b2bb17c6-7894-47fe-a846-844c62dad060", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312547, "uuid": "fc6bf36f-560a-4a14-b718-3e3319284a6a", "value": "5d059f6a5da9c90b000ffdff0ec71cae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88c62f3-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316771, "uuid": "dd24cd68-7ae6-43c6-a898-92a4853faf0a", "comment": "Malware payload (Stop)", "value": "14861e981c488e4cbe324e7ef0049cba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316771, "uuid": "cafd70f3-48a7-4b5b-932a-1afd6cf05b65", "comment": "Malware payload (Stop)", "value": "8f832c3312ae8baf2e05024d0ed62d29903b7ee0ed08329a06d3cfdc9982594c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316771, "uuid": "3f173c47-aa78-44bf-9d35-65c75530442c", "comment": "Malware payload (Stop)", "value": "8a84faeba9d939338b2a390fdbb566a9ba61756e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316771, "uuid": "5ed89360-ba3d-443b-a642-95902ad3f4fd", "comment": "Malware payload (Stop)", "value": "fecdc90fb0556bc745774178b770b645458984b54bd0a9211e5627133a32402b03df84cd3fe167bbb887fc93f9f03351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316771, "uuid": "13965b7f-a659-42d1-884f-84d0814e557d", "value": "T1E1050120BAA0C035F5B726F448799779A52DBEB19B3440CF22D636FE56352E4AC30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316771, "uuid": "65ecdc6d-b5ec-404a-b5f0-7eee2e7a2075", "value": "a07e2478ced6ea4bff168cbb215d0722", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316771, "uuid": "3f712f18-db51-49c1-82d9-db3b86ea2f8a", "value": "24576:vkLX35wT3e96/ZSICJ10jvP/jvVveZyMFRr:82C6UI818PxJMFRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316771, "uuid": "5f0b4b0d-21c0-41c9-93cc-b17aafbeb6c5", "value": 853568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316771, "uuid": "a90ec3aa-f2bb-4caa-93c1-43763877c6bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316771, "uuid": "8be470cd-4371-46ed-8b88-9e1d83aee677", "value": "8f832c3312ae8baf2e05024d0ed62d29903b7ee0ed08329a06d3cfdc9982594c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc552d07-1ba0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632313771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313771, "uuid": "5a943c59-5a58-46cc-a806-306a59959ebc", "comment": "Malware payload (Formbook)", "value": "b74c4168222ae27a7cf68fc783f440f5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313771, "uuid": "f5bcb7f8-d2da-4fe0-ad55-015ccc168e0f", "comment": "Malware payload (Formbook)", "value": "90086266feb549b0e4cd0a96a2ed5752ace95ba47bb15479cdf1e7e4fdbfeb2f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313771, "uuid": "76c6d538-226d-45b3-93ae-9979c001c3c5", "comment": "Malware payload (Formbook)", "value": "037062095ea8f0bda86f5affa083c3b3e6a203cb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313771, "uuid": "888c3d6f-3735-4884-b397-821d41707d61", "comment": "Malware payload (Formbook)", "value": "51994e9c8f5cae16bfce9e5e71513e252c66dc7bbd8ff1e0b40dba57eebe6ab93dab515bb9626604fce1280c9759fcfd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313771, "uuid": "cc0ef450-fd1c-4689-bfb8-a325767b5554", "value": "T1C4C42311725FDF2A526B4086947D05D40BB3B7B6D012BFE087E2E6B45AFF018FDA5222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313771, "uuid": "25dc052c-bb0b-490c-a7e2-de6e0293df4e", "value": "12288:nB8vCQea1Pyf/hpaySeKm5U6rIbm/niPcRKF9WungtRuPXNx:CZe5B2n6MKviEsF9WungaPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632313771, "uuid": "23db1b93-773c-497e-981f-ee6c43f22f06", "value": 583182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632313771, "uuid": "d7b17f58-720d-4d22-8ea8-ac93f27956ba", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313771, "uuid": "848871b7-c75e-4e2f-9ff1-a60d28a0e6d9", "value": "Amended SO of 2000KVA400KVA.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e156c3d3-1ba5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632315980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315980, "uuid": "b3370df2-9c01-4c46-a34b-93f8eb18011f", "comment": "Malware payload (Mirai)", "value": "e41fa95243ed204458e5d6d3c2626c06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315980, "uuid": "28139204-12e5-43d9-8a74-108a10681ed4", "comment": "Malware payload (Mirai)", "value": "9049b5848025ab2cca5c1ac00cfd4936a5dfccf97784ace8a8c1bd5883ef7018", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315980, "uuid": "79b32f95-8b1d-411f-8ea9-9e5b6846f8c6", "comment": "Malware payload (Mirai)", "value": "d10be67b7ca8175b9cc9b95c8012e4c2a0d764c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315980, "uuid": "36c7c618-5ead-4d59-932d-b06ed84684d7", "comment": "Malware payload (Mirai)", "value": "73ff2a3a608f8ab81cb8160c5a46f4d9ec83fb08f990b3520db9d6f8cc6fd6870619ab8baca021df92e13704cb5102d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315980, "uuid": "894e9b4a-928d-405e-8064-32563bc2131d", "value": "T1E9D3C73B27170E23C0C950B101E74332AE75DE9B34B952D7AAA07D686F37A843856BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315980, "uuid": "7473dab5-4ec1-4941-9e94-7a1f9d162cfd", "value": "3072:3v8G4ZNBQTZiNPR6Iwd9g+plAOhmm/QMurB12CGNb:RrUlklXmm/QMurB12CGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632315980, "uuid": "09221c8b-365c-4701-a92f-b070c13450c2", "value": 130121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632315980, "uuid": "cccb8507-7651-43e8-8e48-d7e19930a5a5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315980, "uuid": "e591259a-3508-4cc7-b331-44456694716a", "value": "e41fa95243ed204458e5d6d3c2626c06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9a67e6-1baf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632319975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319975, "uuid": "8a54cce4-b441-4076-8172-68f33f4d96a6", "comment": "Malware payload (Dridex)", "value": "19989ff08d6e0accb9d233f5477bb216", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319975, "uuid": "0bbe0823-da7e-4be6-b19e-b5a027214480", "comment": "Malware payload (Dridex)", "value": "91164696edc4efba635e5246a48693e8fd75db2eef8e06e354848365b9fead55", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319975, "uuid": "c3354fbd-2cf8-448b-8a50-f1af20d71984", "comment": "Malware payload (Dridex)", "value": "a7b9f2c08fceca215ab866f59269d416bc8f8f09", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319975, "uuid": "0d86dd7f-7c52-4617-9ce4-a7db740727a8", "comment": "Malware payload (Dridex)", "value": "dc9b6ceac23746579f976a7dd3387d67e4e806ca9e0782e0eaec8c064e0c8d7b0c3f5782f6703c6617ca282f4f3d27a8", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319975, "uuid": "c758297d-a4ab-4f1a-953d-b6eda7fa97be", "value": "T180A3D00E307652BCCC2434FD9ACA1D7163AE4FA166C6930767A1D358AB7B7EB4706241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319975, "uuid": "d98b9a58-f6c4-45b3-8580-92aa6617c8b3", "value": "3072:oUX0h03aNFiH9wrivvpUaZA1tTcTwvtB6+A+O:o4avi2G5Du1tTcTw1xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632319975, "uuid": "4b0fecf1-269e-4023-aa89-57865fba73b4", "value": 103606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632319975, "uuid": "1150e52f-f2fd-455b-861e-da491d4130f2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319975, "uuid": "9b686e16-23f4-4a73-9911-6e7926f4359d", "value": "Amendment.-0428767170_20210922.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083d8dc4-1bb0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632320340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320340, "uuid": "e197c3c1-4907-463e-a5fd-18c0f25924af", "comment": "Malware payload (AgentTesla)", "value": "58dfe1a93e7abd5f7ea0253c2c88807b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320340, "uuid": "2f95eca2-e65f-43a5-a3ac-8b2724787a19", "comment": "Malware payload (AgentTesla)", "value": "9132d4e6f57fb6c3b51e61282fcb00c876182a1e6e85e9c4ee046c72129962be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320340, "uuid": "0f82dd2e-3666-4453-b37f-d6424c2b7c5d", "comment": "Malware payload (AgentTesla)", "value": "78b81de8fede1c266809db17ce269a533362d685", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320340, "uuid": "51ca85cc-773f-4fc7-a27a-0e1b4e7b1ea9", "comment": "Malware payload (AgentTesla)", "value": "bd969e21cb526f30ac664e6a543a7d272ee77d43611c607202fe34a335443f2bd06943a7eaca1be78d67df5d0b5e7b62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320340, "uuid": "3daedcd1-0dfa-4485-9a24-1597d9ce305e", "value": "T114F48BC89D884613D7A44172DC5C620632292C4A7723878BDBE57D7B3FFE683C22D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320340, "uuid": "45abc18e-72b1-45ea-9853-5d1678a45bc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320340, "uuid": "ed1e9ac3-eb4d-4c17-9416-2ec95aefa923", "value": "12288:oMmtiK5oaoFv4tWUE7RnFneeZ/dRKpf3PNsS7zqAEHXD/1k:Z+FoaM44UE7RFekCpfFsS7zqAcDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632320340, "uuid": "13126fba-c58b-4fe9-839a-6680df12c035", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632320340, "uuid": "75a5863f-72ef-44fd-8aed-c576424dce99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320340, "uuid": "de8c0f99-eb8e-4dcd-b1d6-c7e946c76c34", "value": "ZhC0vTPTLEBCP0Q.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d905450-1ba9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632317423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317423, "uuid": "f201a59e-cf36-452a-b58e-baec236d9978", "comment": "Malware payload (Gafgyt)", "value": "a405d47d4583f664f93a06184948d462", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317423, "uuid": "3fcf42b2-42c0-4ab9-88ea-0e3ab9e25cf7", "comment": "Malware payload (Gafgyt)", "value": "9188ad6a343d1c884e56ea97ac23b70b54e1a43c5fb428fede9a1c8138630dec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317423, "uuid": "8aafd5e0-046d-4755-b526-a50ee14c7e3f", "comment": "Malware payload (Gafgyt)", "value": "caf2a9960323db13bd2f98c409bc74bb4ceffeec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317423, "uuid": "3ff6334d-0a9a-4a2b-bc15-76dae7ecea02", "comment": "Malware payload (Gafgyt)", "value": "dc195e590bdf7267e1a5f07d3a8769f9165523da75f3ae1296c46cbdbe69fd7811650d8b867c198215bf3ab2f56d958b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317423, "uuid": "f5d5244d-4884-4bd1-98e0-06c7a2459be7", "value": "T129833C02E743C6B3CC830BB2029BAA665931BDAA1E26DF49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317423, "uuid": "87f32744-fd58-42c1-b48c-6ab9e2308ca0", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LwWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Yk2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317423, "uuid": "d1991d1e-9454-4971-acee-12c464277bc7", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317423, "uuid": "e1916d99-e2d8-46b6-85f1-5db2d1c55a37", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317423, "uuid": "6905d53a-1cc7-4433-b88b-e123fce1fe8d", "value": "a405d47d4583f664f93a06184948d462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf526e9-1bfc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632353230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632353230, "uuid": "1bb2f4ff-0ca0-426f-9268-678418e45a56", "comment": "Malware payload (Formbook)", "value": "6e86679cd441524ed4bbce078bcb0a7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632353230, "uuid": "56bc9efb-15aa-4ff2-aabe-6d44fd71b2fe", "comment": "Malware payload (Formbook)", "value": "91a28bbaaaed3acd39f0c37cf091e0a4e3a54ac5f00b4c26c5d3af44c9bc3fb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632353230, "uuid": "9072a67d-0185-4391-a70f-cbf225795812", "comment": "Malware payload (Formbook)", "value": "5335349b936c536502b805a796f6f0033588cd1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632353230, "uuid": "c831b797-f854-4a9b-a8ca-17cd64110cfe", "comment": "Malware payload (Formbook)", "value": "a4fa95b6fa992eab9498cb04c6a9286844a268bb2dca31ef80744d84a945365748c48f67e7630a687406ad291355efb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632353230, "uuid": "4561ef7f-6b89-4c1a-8b16-852108533996", "value": "T12FF479C56D888A13D3944532DC5D6205366C2C4A3723838BDBE63DBB3EFE2C7852D59A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632353230, "uuid": "18426550-d2aa-4caa-b01f-d404b80d1de1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632353230, "uuid": "3a96216b-22c8-4062-b046-10b3b7676de3", "value": "12288:YYpxgrOmtiK5oKT+AHxNYMxdlP8fgeqtXoQ6GE0NYXgajVHpclpek:TgrO+FoKKSLYMVkfnIXsC0s0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632353230, "uuid": "9fa77bc7-b4f3-4226-88e1-409d140e9960", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632353230, "uuid": "e670f473-9748-473b-a004-bafff3807cac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632353230, "uuid": "32b7bdbe-12e4-4b85-a451-12d423c5f442", "value": "New Order Specifications.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec41a60c-1b93-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632308267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632308267, "uuid": "2e668742-fe20-49ff-a699-e33abfe89f22", "comment": "Malware payload (AveMariaRAT)", "value": "fe96e4b3a8030c5ea654995172cbcf55", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632308267, "uuid": "4d4bab70-0433-4bfd-93fd-27d2fd082a98", "comment": "Malware payload (AveMariaRAT)", "value": "922789e50f3e63a5c1ff50a1c8a3386d476c7d4cb4967f8d9dd943adcacbe6ba", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632308267, "uuid": "4b23611e-8a23-40ec-a121-5c5362ddc02f", "comment": "Malware payload (AveMariaRAT)", "value": "cc7f1f01f144f5b5a549d3395ac592fcdbe1c0c4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632308267, "uuid": "fdfc935f-29af-47dd-8f50-2debc41256ca", "comment": "Malware payload (AveMariaRAT)", "value": "92bf677fba783f3509cfd7e9c08dd59ddca1d753d455bef22ae47fb0243c28f4d567c3475d5d8d06b95e13fa98f1e3e7", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632308267, "uuid": "c394d297-b154-461b-9044-327d942dd8f3", "value": "T1B8B22F53B688C893F8585A74C877CAF008AB7D51DCB1B64FBA41771F3AB7242156390B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632308267, "uuid": "b44f0fa7-a7f6-47c3-b16b-e2c800674993", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632308267, "uuid": "3918b2ba-fb4d-457a-a38f-d5214cd98537", "value": "384:iRpY2qoKdW0TddPua1oUh/Laaal0CRBXgJlTzJ7KMyc/RRTJZahMYf8eyvaOwYHC:iRvD0T7bdTu3Qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632308267, "uuid": "5e0b5eb6-24ab-4e4c-b741-08b0f0605013", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632308267, "uuid": "ade5aa67-09b5-4ac8-86ee-ba4f56e3d11c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632308267, "uuid": "1ea72881-3886-42f8-b198-494596e84a12", "value": "SecuriteInfo.com.generic.ml.17492.3677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f613073-1bff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632354417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354417, "uuid": "6dd4b394-015c-423e-8be0-197b5bf263b6", "comment": "Malware payload (Mirai)", "value": "b88bed2eab8edbf4cc056ba04f37b3c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354417, "uuid": "4eea7a88-52f2-452c-8c17-7def25a3b7a0", "comment": "Malware payload (Mirai)", "value": "92886ce4445c6facc708ce674b4dbbe7b4a3cff9e66bf22320edd4af37e5d6d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354417, "uuid": "4b0478bc-f266-44af-a313-592032152be4", "comment": "Malware payload (Mirai)", "value": "7771351372ecc36aee97e0dbc18d5b5f76a43349", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354417, "uuid": "46f6c1b4-b43c-41ce-95a7-f5f5c8f8395b", "comment": "Malware payload (Mirai)", "value": "d238c8a89f2edc194f3c897c2dd52ff4ece63bcda8e6c536375f2e19c2e151ddc8aaf0ac6d337c41aed9e9b9d46a5ae6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354417, "uuid": "165b2ca5-336b-444d-850b-ebc08cc0bdd2", "value": "T1C5531A91B8D19A16CAD4137BFA2E418D332563E8D1DF3203AD256F5437CA92F0E77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354417, "uuid": "3600780c-0ccd-4795-83b8-464af01bdca0", "value": "1536:YyW869O3GXz/z8a5O8isq9M53e53Fc0PKwl5lbn+mUz:Yyx6EK3wJsq+5ORFhCwl5FQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632354417, "uuid": "18de44f1-bdf2-48a7-b84e-aa4e0ffe8a41", "value": 62456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632354417, "uuid": "7665f40a-6c26-49af-8812-af00dcd55c0c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354417, "uuid": "3decc8b8-40df-47ee-b4dd-7c99384e81c6", "value": "b88bed2eab8edbf4cc056ba04f37b3c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8fc4d1-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316779, "uuid": "f0e95ac1-1c6b-4792-96e5-1ab6cef5eb49", "comment": "Malware payload (Stop)", "value": "e4baa71a55e269b09ffeed6355e3f25a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316779, "uuid": "7cec99d0-af5c-49c2-b170-bd082ae6fbbc", "comment": "Malware payload (Stop)", "value": "92d6fa17884329b71c2e6e9dc455465b6f0a8f7989592b56739f053f8b4a2a00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316779, "uuid": "47db26f4-15d8-4624-a009-34d77c997e6c", "comment": "Malware payload (Stop)", "value": "1eb895b626bbf77616437f773f2be69cfb01e597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316779, "uuid": "61da7625-4bc9-4faa-a0ad-984855f948dc", "comment": "Malware payload (Stop)", "value": "4763dc7cc978f27b6ca115b8f1af683ded63281d8cbab5623945db409460ee260e95fb08687b76b2d952c50c5bc81bef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316779, "uuid": "56f0e005-fe86-422b-b171-afe57e51c937", "value": "T1E5050220B6B0C035F5F316F8497993B8B92E7EB15B6051CB12D52AEE5B346E8AC31743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316779, "uuid": "80d5cc30-03ff-4993-8f7e-1fde1a6e6ca1", "value": "69566d56ce8187d49438dd02ea591694", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316779, "uuid": "476be383-03b7-4b95-8c81-fb8a9e338b15", "value": "12288:BToO452t6In9SJngR2mC8PdEucewb0yjdkxhIRVDMSp2E27ugEw26azN:NoO/tuC2mCAd7nwgyrDDMSpNg6Th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316779, "uuid": "300a05d7-4eec-4900-abef-f2cf1d272d01", "value": 852032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316779, "uuid": "d2173350-d5b8-47c0-80fb-3dbe106fba5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316779, "uuid": "bd02e8d0-3cf2-4757-bc77-ecff71435e70", "value": "92d6fa17884329b71c2e6e9dc455465b6f0a8f7989592b56739f053f8b4a2a00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffafd64-1b6f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632292543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292543, "uuid": "99680d6a-4122-4948-ae29-acc04179ac54", "comment": "Malware payload (RaccoonStealer)", "value": "c292248a17c6c4ef0965c962aebc424c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292543, "uuid": "bcb935ad-efcb-4146-b598-3f2f65ed4bc7", "comment": "Malware payload (RaccoonStealer)", "value": "940cbb7e02747f1ab72352d67b1f4b02d336e92944e195827ff6731fb89e14cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292543, "uuid": "84f2bf4e-767c-42ea-bb09-cc2bb7388826", "comment": "Malware payload (RaccoonStealer)", "value": "bce3098853a8a30f8c7062d2011a73c45d3b2642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292543, "uuid": "d3314c0b-a6ba-4f2c-9205-c4e71b31d799", "comment": "Malware payload (RaccoonStealer)", "value": "e424f6e7cca26c04f40252bf33adb71bb93faa60757b6cf1dfe3c150748984ebbe93553f3425660680d3f234632ce44d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292543, "uuid": "9fde976c-25bc-4943-b220-4c34109a3bdd", "value": "T1DFC4E020B6E0C034F1F712F889B993A8A93EBEB25B3451CB62D516EE16356E4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292543, "uuid": "20ba0816-a051-48aa-9a2f-54884f6ab2b3", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292543, "uuid": "bf34baac-5e0d-4652-879d-e8a7c7082c19", "value": "12288:90Gp4hIF5CdoZb3nVLLZFthTxmlSFUh7kmwLX:ehIF535LZ1ohYmwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632292543, "uuid": "4472afe9-a702-4c4a-8f10-6f7bbc64cb5f", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632292543, "uuid": "24e32101-722e-4115-8a00-cc3721e2017b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292543, "uuid": "316bf3e5-4b1f-4b3d-a598-9e9cef175bc2", "value": "c292248a17c6c4ef0965c962aebc424c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af14bf5-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1632334330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334330, "uuid": "967063bf-35f1-45a3-b8f7-169c24d8c348", "comment": "Malware payload (TrickBot)", "value": "015ba9cc568b35e6687ec4a8ac61dc15", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334330, "uuid": "9ceca0f6-c8b4-4cc0-9495-b480e26e0dd0", "comment": "Malware payload (TrickBot)", "value": "944c18692e200c4de70817facee4fd8662c99743d64e57e43dd3f212d68e8003", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334330, "uuid": "a01984bf-15ae-4576-9ede-94448c7aa6e9", "comment": "Malware payload (TrickBot)", "value": "3fd792fd8807b9302be94d068304d820c1c671ca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334330, "uuid": "f35a0009-b7d1-4f76-a463-126b85157ba5", "comment": "Malware payload (TrickBot)", "value": "97285181d25ef59731e0237c00cd67b8764aca150ec7deb03bc83bc7757d9864c06c9d809309944b16585627c9eda520", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334330, "uuid": "a4c3eceb-08f6-4831-a173-9da16f6b8875", "value": "T1C3B4CF42B2C0C076E27F537149775B5A26AEFD248BF1A94BB744BE3D0F35291852EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334330, "uuid": "bb61d56e-98bd-4992-85f7-c975e1f4e17d", "value": "5c9a9773c96ef9c47915be337e1489a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334330, "uuid": "922e7744-c306-4044-9219-cfa3f4c7e77b", "value": "6144:tIl3f5on8R0CBtsabvbC0iRugpw8mI3R5y4MAIJ+CczfBsx2X/HSpu9SiWaKMVe1:tk32q0CB5Mwq6cBsxsPUmYa1B3js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334330, "uuid": "0f015d58-e274-46fb-aaa7-462f2ae7b38f", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334330, "uuid": "6e83521f-8169-4811-8b1e-f1f81076efd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334330, "uuid": "25a16f6b-f0ad-491e-950d-ef1d66df0abd", "value": "015ba9cc568b35e6687ec4a8ac61dc15.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f310e657-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632312574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312574, "uuid": "d5344bdb-97c9-4c40-81b9-e8983b47fcaf", "comment": "Malware payload (AgentTesla)", "value": "a6b0ff3aaa1b4989b5814c6c179679dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312574, "uuid": "5251dbff-6562-4849-93ef-84486c821a50", "comment": "Malware payload (AgentTesla)", "value": "94b8559200017766c77f1087d53b3945f219f2ce0c7986efc00cbbad9a40d971", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312574, "uuid": "6696ee9e-97d7-4fc7-a7b1-850ef13083c0", "comment": "Malware payload (AgentTesla)", "value": "09da0b223d7d7fcf879a2b4624ec68816dd265dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312574, "uuid": "2988317d-a60d-4cb5-8e5e-5b3b14a46cbd", "comment": "Malware payload (AgentTesla)", "value": "8a782b68d7a74a8a4ca42b2d412c3d4adc76873be32b576d5958c97c2b2b0a52afa9b72d8a4b74af4e0bb069f5a2ff43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312574, "uuid": "d907db66-c308-4960-a090-4b57f5504dd7", "value": "T14EF48AC45D984603C7A54676DC5D2246326C6C0A3723938BCBE53DB73EFE683C22DA96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312574, "uuid": "3ac17c46-7a98-48f5-8053-e0cdb0a7bcae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312574, "uuid": "a34f4f45-4104-4515-b691-e68e14dc7606", "value": "12288:EbmtiK5oN5ZXQ5TVSN8XbKtC38OzcdPFZTGafqJynlZQW3lk:W+FoNX2TVp2tC3lcdPVfqOlZt3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312574, "uuid": "08441fa7-f432-4b87-be76-9996d007f30b", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312574, "uuid": "11242529-7d5c-4676-8663-f4e9c01cfe40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312574, "uuid": "ec3752fe-00f8-4188-ae23-4d197c7522bf", "value": "a6b0ff3aaa1b4989b5814c6c179679dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d39343-1b64-11ec-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1632287934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287934, "uuid": "c7548a9d-abb7-4c14-8c0a-bd83670e1a6a", "comment": "Malware payload (OskiStealer)", "value": "534525ff9d56007d31918087d022fe9a", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287934, "uuid": "496028f4-413e-4af1-86fb-25c8066b91ce", "comment": "Malware payload (OskiStealer)", "value": "94df79eb60d0d2f82e6acf5190caeca436d0e15085269b43d84855ca8f0fa1a0", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287934, "uuid": "7e87c467-93b7-49e0-b866-fdde94170e0f", "comment": "Malware payload (OskiStealer)", "value": "589f0e8edc88e12c85c40f990e6006e9d2f7f736", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632287934, "uuid": "7d2f200f-4461-44b8-b509-6bd93fbb9efc", "comment": "Malware payload (OskiStealer)", "value": "36b9bd4587713ba5228f51bc93276fc49a20bfa4515bf35dccb5094c6ad6af5baab8cea743cc3e0e08e02a9a51733817", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632287934, "uuid": "3fdf9ae7-79ef-4120-88f8-a64d0757890c", "value": "T186356DE3B394D8F2EC34393EC84A711123156BF27C234E4D9D643E8AAAF5A50B9595C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632287934, "uuid": "d64c6050-76c9-4b3c-a3aa-6a5b6027c0ea", "value": "12288:BSZPsJUL/MN/cen/VwTQBXcameDCnNmpeoAdrL7+o:bOQN/cu/VdBXKyCnEorP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632287934, "uuid": "46d11bc6-2a77-473e-81ad-1c8a5225d6cc", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632287934, "uuid": "28c48f9e-0bf3-4a09-9558-68c894811bf1", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632287934, "uuid": "55e58913-d242-460a-a8be-5fa94bc46127", "value": "RFQ SCAN COPY PROFORMA INOVICE.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86019dc-1b85-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632302248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302248, "uuid": "8f7c3499-581a-438d-bfd4-870838410239", "comment": "Malware payload (Formbook)", "value": "6644478c653327d0f4f7f35e7effd62c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302248, "uuid": "178774a4-1804-472b-af6b-7357856d4199", "comment": "Malware payload (Formbook)", "value": "9545b9927196fd12d327c38b6f99dbfe3be7beeefb9e4c4a9d3b038c5c39c119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302248, "uuid": "dc9df1ae-3e2f-4966-88ee-738307bf8fd9", "comment": "Malware payload (Formbook)", "value": "9160e53758b8d41b96e417eaa412b4a4c895ce46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302248, "uuid": "66ac74a4-756f-4666-a76d-d1e3f6c23893", "comment": "Malware payload (Formbook)", "value": "6151b73790c3d43867a7a3d0e54b5a58f6b640cfece5c57351b089d55658ccdbb9d1777085886c3a9baf97b9961cfd38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302248, "uuid": "56343710-9fea-45d0-9cff-ddc489664ccb", "value": "T184E40268B69071EFC917CA7AD8741C60EB60B4BB6307D207A053209D9A4E7DBCF165F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302248, "uuid": "1ce210de-5ce8-458e-b16c-4ebca488334e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302248, "uuid": "2285db78-c90e-4060-bc41-c83ca9497353", "value": "12288:0hKmtiK5oBTF2TnFLm2rXsSCP7gBZUTu+qynGiNfPHU4nPf/u:0I+FoBoTtr7sCHUTu5eHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632302248, "uuid": "578d1ae7-7297-4596-9a7f-69e1c50c491f", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632302248, "uuid": "3f09028e-48d7-473f-97ab-2410661220db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302248, "uuid": "bfb91581-7e4e-4670-8592-7aa3e109f149", "value": "payment..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fcd287-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316736, "uuid": "ffe6f590-586f-43ee-83a9-6b5d1e798229", "comment": "Malware payload (Dridex)", "value": "dbeb1b11639a39a43ef4cb5641de8a80", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316736, "uuid": "7f14a28f-f5d4-4720-96bc-a0f1cde0e961", "comment": "Malware payload (Dridex)", "value": "9623aebce4b63a5f65889ae5aed4aa49fff128b45ad0210507c4b0dbbf06073e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316736, "uuid": "d08f3ec4-6cc4-4c40-ac64-d4b53c63b80a", "comment": "Malware payload (Dridex)", "value": "71dd46f534d5f820a33188cdc0465a1c4f571673", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316736, "uuid": "39b4a4c5-ad86-4ff8-a430-3f9a291ba40d", "comment": "Malware payload (Dridex)", "value": "ec7fb3bde9a226993d865de52ae6cfcc5ffc7a2af0def99ba902698626a37c5433c7bdbae0717a10ef409e1144609bf3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316736, "uuid": "1c025ac2-5bb3-4c5f-8dca-427c4b5985bb", "value": "T15A45E020EE69E1E6C6B89F3E9408352727F93D75110D608CC396704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316736, "uuid": "34229c09-6347-4b1e-9e74-36f12cbcf209", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316736, "uuid": "96adf37f-303f-400a-9802-f2d7f3daa682", "value": "12288:kVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:BfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316736, "uuid": "55ba9a04-0ff5-4f62-9f0c-742e16d3b647", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316736, "uuid": "10f4cfb5-16d4-48c8-9ae2-86cb9ed08cb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316736, "uuid": "aa2b7878-deb4-4744-a1e3-4dc32eeac0e9", "value": "9623aebce4b63a5f65889ae5aed4aa49fff128b45ad0210507c4b0dbbf06073e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3938a9e5-1bae-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632319563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319563, "uuid": "c493dbb6-7bc4-450a-8c85-c0d6159a3ecd", "comment": "Malware payload (Formbook)", "value": "9e0776cf65d4c8f8f4df423e9996f394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319563, "uuid": "8a08fc9c-18cc-41b5-84b1-ff951b903d45", "comment": "Malware payload (Formbook)", "value": "9723d45f7d2f12bde692d804c9a7bebd2bb1f9142f7f3efadff7c4a87bc33841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319563, "uuid": "6700c4cf-3673-43ae-908c-029060fe0d9c", "comment": "Malware payload (Formbook)", "value": "b4529219b4be129a9c5134c8204d81b7a309d9d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319563, "uuid": "d8aae151-3b82-406c-a3de-4ef2048cda09", "comment": "Malware payload (Formbook)", "value": "ba9af52df486e13392c53d3de9ea6134a48215103b6ddf6cf83927237596ad2cd45b9b9eca19e5f3d5f2268311ea3d24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319563, "uuid": "a2abfb4c-c517-46ff-83b1-627db7a85fc0", "value": "T1B1B4233992748779DB5D4B7F30E1508A07B2924F3693DF2A6E84B0CE7E1A3525122CF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319563, "uuid": "9f5f38a5-65f6-4b78-a6cb-eb662b83f210", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319563, "uuid": "43d3a9a4-abee-492a-b47d-16af71f38dc2", "value": "12288:eRkomtiK5oBCNqnwiGeyJFErWKvpNnkqcvx2d6q:E+FoBCgnwiEmWKBNlckb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632319563, "uuid": "e78bd507-c38d-4b0d-bf9f-80c1bc7f18c6", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632319563, "uuid": "5c9124d8-6db6-45a2-a773-346f0979ff33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319563, "uuid": "d545cf30-d581-45dc-8ded-817b2ac8ddbc", "value": "COURT ORDER # S12GF803 zip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97d7af7-1b6d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632291835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291835, "uuid": "94f5fa89-4336-4eb1-9e21-c85dfe89eda5", "comment": "Malware payload (AgentTesla)", "value": "aa0dd79833f664ad0ec7069e81578c22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291835, "uuid": "b074bfe4-4c39-4bfe-a942-0a0f5fc28655", "comment": "Malware payload (AgentTesla)", "value": "980ef6fef3feefb056d29e93295e9a502f285f2c1ed151eb0e1e3a6c0cf5492e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291835, "uuid": "3a2dbdfa-b9ff-4576-a317-fdb79c59ff88", "comment": "Malware payload (AgentTesla)", "value": "daae0a56fb9869e2977e45afe0d13de07d1f9df1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291835, "uuid": "b3d7973b-7673-466c-bf1a-c09c3ff0720e", "comment": "Malware payload (AgentTesla)", "value": "b77d7926d3e2f2c076555851075a77053df7fc1f13cd15a6e907745c7acbc36040617a28711c9fa12efabd94430d93ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291835, "uuid": "657f8be8-0b4b-456b-a682-86b731b274e1", "value": "T16EC4123587BC47B0CF3B93BD60A0508707B1928E3951F62A2FD9B1896E2F796452C877", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291835, "uuid": "40253d2f-777c-40cb-ace5-9189964366b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291835, "uuid": "9b424096-062a-4452-816a-60d96d1e26e4", "value": "12288:foUPmtiK5oBkTlZM5tyxLZaI2jBqtJ4Cjodi7:z+FoBwlZMOr3VWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291835, "uuid": "9c000f38-28a3-4402-80f8-b1737d2862c4", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291835, "uuid": "0705cc5d-17fb-40ed-8727-3837e8783649", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291835, "uuid": "d58ef399-8db8-48d3-894b-81fc220c1e72", "value": "aa0dd79833f664ad0ec7069e81578c22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478dc49e-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316581, "uuid": "a44f05a0-ae0d-44c3-97a4-f4dad98850f6", "comment": "Malware payload (Dridex)", "value": "89c5370380e817686c21732814b7708f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316581, "uuid": "a0fa1b1b-f9f9-464c-95d6-c63b28df22b7", "comment": "Malware payload (Dridex)", "value": "9814628a7e18ffa160a3d6681a7964da83430372e2c8bb48dc2fa9af2450d9d3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316581, "uuid": "35a685cf-10b2-4243-a7af-8d553de81609", "comment": "Malware payload (Dridex)", "value": "d26605b6f06ea60b9a5dd691303700b818d8079b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316581, "uuid": "c6c29d92-d0df-4b68-adb4-8e8896b2acdf", "comment": "Malware payload (Dridex)", "value": "9e50d50c540b4a4d02cd3799f165d63621b5a063a4223640421025c49bfb367ad18f400af1f60f842c806020d51173c4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316581, "uuid": "7d2f488e-b03e-4807-9b74-14f2d5142db4", "value": "T1D2A5E020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316581, "uuid": "e00ed4cc-0707-4bf8-bfdd-0a5b9473aa40", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316581, "uuid": "12eb951a-d6fe-4868-a244-f0b7f843bcaf", "value": "12288:WVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:LfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316581, "uuid": "fcd1ef85-bd14-4079-b59c-787c9e2b4d8a", "value": 2162688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316581, "uuid": "162efbe9-1995-48ec-a4f5-e8e89b6cb7ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316581, "uuid": "acdf2eb8-4478-46b2-8254-29ff5c23db5d", "value": "9814628a7e18ffa160a3d6681a7964da83430372e2c8bb48dc2fa9af2450d9d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad616aaf-1b3d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632271225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271225, "uuid": "b1f14046-dadc-4b14-bbe3-bce87890dfdd", "comment": "Malware payload", "value": "7b05838c1525762a1bac9d531db38f87", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271225, "uuid": "74a6786e-1c6d-44d5-96de-15eca0fc3a14", "comment": "Malware payload", "value": "9981024aedb29e71ee7e9e1e88ab50a7502d45fa2ec9749564069cd6fcc80598", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271225, "uuid": "9a6441fe-2e19-41ab-81d9-1637e415811c", "comment": "Malware payload", "value": "9b1b418cd7452214f9993c16fb583d5da21680e9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271225, "uuid": "02c9305c-45e8-4d54-81b9-1e7fa97c6f97", "comment": "Malware payload", "value": "196473eea9560a35403c543c1ccfa9d7a258a8c74de1ebefb4a1df11f3e577decc6baf3184603ea86d7d2b75c3a01780", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271225, "uuid": "adb10927-8d67-45fa-ad2f-eeed11b2e9c7", "value": "T14E462356F681D809C1A7DAB24291913364381E8D82C7E12BB90D77F87FF3ED08B85AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271225, "uuid": "18ceeeee-5ed6-4a5b-ad63-c250bb713c36", "value": "98304:UW49BznXhv9iIvAXgPSDiNuTxonrY2htGXabXtwqzRw35+4BWqUzJqu3gkzqizuX:29BzhVpQASDeuTK82htGXab9w3J+/Pzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632271225, "uuid": "14d8e59d-3569-41d0-a3e3-d59d5ca92e51", "value": 5383334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632271225, "uuid": "d0b0809a-c174-4643-b250-2d6caa878034", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271225, "uuid": "a3c8977b-1956-4d38-9053-cda00f5a0f93", "value": "Flash_Player_2021v26400.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fdddba-1bcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632333857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333857, "uuid": "7c91be38-8de6-4f1d-aed3-15859e975c92", "comment": "Malware payload (Formbook)", "value": "f3b613c87041ba6b36702f3e9526094a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333857, "uuid": "0240289c-76a6-4723-8098-4e26c8241a90", "comment": "Malware payload (Formbook)", "value": "99b495e7c6df7f7bf887cd2d7f143e4103dfaf57990a0712bac7d33a2c6d6f0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333857, "uuid": "cf0823e4-6bee-4421-99d1-a3213c5f8863", "comment": "Malware payload (Formbook)", "value": "2aebc68d17044d1c2a80a7294d46824b65566a73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333857, "uuid": "2f36d293-9a7e-404c-8c5d-7d4e5c9c6549", "comment": "Malware payload (Formbook)", "value": "6c8f0e554299bfcccd4c89b0b19f43d7dc83c27a52c3036c71d4b48411bbfd799a5ea2e24b2ab35dbeaf95e1dd1e45f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333857, "uuid": "72b13bec-2f9d-42bd-b20e-7105a287bcc0", "value": "T1E6C4233DC6A9C374C9158BBD215241450FB4E2CEFB23DA7ABFD6708A7D0E7818229935", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333857, "uuid": "bd294dd3-249a-461b-92ea-98f2382cd25f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333857, "uuid": "8f8fc8d4-1a99-4388-9a4a-f0558296b7ee", "value": "12288:QkRDmtiK5oBHPVE11StKK5L4UbWjO5J3uu4uGyWhxkk:Z+FoBHPG1xbYWjEuu4uGyWhOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632333857, "uuid": "3837a249-297e-4c1e-b899-c85cef4213ae", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632333857, "uuid": "7ae0b990-0086-4b37-8238-84adcb525e92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333857, "uuid": "cde38200-b502-4c07-813b-8eb6ccefe82d", "value": "f3b613c87041ba6b36702f3e9526094a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933c5322-1b9c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1632311984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632311984, "uuid": "bcc61944-2f0e-4f6a-a2f3-4b307268694f", "comment": "Malware payload (BitRAT)", "value": "e781667f947abcc03def4fd13f86b8ed", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632311984, "uuid": "112867f7-bbd9-45ea-ba7b-daa48ce4ba45", "comment": "Malware payload (BitRAT)", "value": "99e4750c775bb7e8406a3ee86e62af83c36139a8090bb621b167d2b224a872be", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632311984, "uuid": "b9616de7-a22a-4b20-ba65-8281e6aed4ce", "comment": "Malware payload (BitRAT)", "value": "ceff4ad5b7450bccda14f356f57858e9df6cff43", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632311984, "uuid": "efecb5b1-dc6b-41b4-b41f-732ab5866f7f", "comment": "Malware payload (BitRAT)", "value": "c3eb1edc10bc413019d54267cd6fdf89a3d8d90a2627b24854fc0e7a08a25db00366fcf6b6fe2a2440953e31f216f8b6", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632311984, "uuid": "919d55d6-0fd7-41e7-b8d0-5b451b61c879", "value": "T153B25036BFD80D95CCF7093B1DC1BD74583679CEA6A146BF6488B23E7F001A01A69761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632311984, "uuid": "958c6521-a472-44b3-b55b-b60e5b65a265", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632311984, "uuid": "f832717c-c5b4-4bcf-a1df-459ceb84923b", "value": "384:nZ/CCsTdr6y26TPfc3qA5WuDhO4+99y/CMzqTLwzfWntw+synvdC4:n4PqKrcXf54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632311984, "uuid": "1510ced9-cfa0-4d74-9908-670fd7439956", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632311984, "uuid": "9985ce51-7266-4780-b4e0-44154b84cb22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632311984, "uuid": "8eb2d6a9-ed96-4664-be99-35a87fd58633", "value": "XEROX-SCAN220921.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db1fac6-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632289640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289640, "uuid": "9c085337-1846-4671-a4a7-3d56a9830ffd", "comment": "Malware payload (Loki)", "value": "03489f904684291b7c9c1b97cb9a1c54", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289640, "uuid": "849b54dc-a97d-4ab0-bf17-0758e8869e34", "comment": "Malware payload (Loki)", "value": "99ed4247dd3a3173c5aa97ce5a11a62db0dd7eb55b7e4aa5ed5500004a2a9ce7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289640, "uuid": "71a11155-6b7a-4482-b0ef-e469d0997ff2", "comment": "Malware payload (Loki)", "value": "1ab89df863ed595eaff7efa7b8f915764ac6980f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289640, "uuid": "7b763006-2d37-4760-97cb-786aeffab7f7", "comment": "Malware payload (Loki)", "value": "b1fa19866ebfca8a9bfaca14da6776a8555144f11757079eb7a8142a557ec61da80a5320d06c3315b2b54e8b1f3f9e04", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289640, "uuid": "f93469fc-6b32-403b-aa63-f4a55a39834c", "value": "T106152384BD539FABE8C374BC955B871E2994CD02225CB103DB1AFB8E707AF7490D5228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289640, "uuid": "b3861292-a0f2-4376-a309-ed8649b64d98", "value": "24576:78XQr7IKhVftPmfC2vZzB/cTDmR/xzJM0d+J2pN+MhPag4:786JVft81dBETAtJj+QpV9aX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289640, "uuid": "9a7c1345-8716-49fe-ac26-9f45d2436045", "value": 876328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289640, "uuid": "5cff434b-46d6-470a-8cb5-85cf588d6d34", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289640, "uuid": "f07cbc95-e877-456f-8f71-1e0d3f4ee30b", "value": "PI_YD & VISCOSE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5783d5d5-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316608, "uuid": "88c343d0-3672-493b-b017-9f0b20b73183", "comment": "Malware payload (Dridex)", "value": "520ef84af802e7a80a9fba26b0071752", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316608, "uuid": "407f7c4d-6dcf-4ff7-ad2a-d85569a4373f", "comment": "Malware payload (Dridex)", "value": "9a05c94e55a98b836732ffb0481133e211f0060998cd04c0e8e90c9069f4f6d9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316608, "uuid": "e7098489-4b21-4801-aff9-b50f1a4dae90", "comment": "Malware payload (Dridex)", "value": "af5acd9f15c11cf3aaaed54cd05716b3700563ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316608, "uuid": "28aa989c-e81d-4fee-b2fe-cdd3f5a44601", "comment": "Malware payload (Dridex)", "value": "a80b814f83443b3c873268f86d96d90add963c65d51bd6575b81ce45fcf0396f9e9f45de922ffaa4894ac505060b66cb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316608, "uuid": "7243d606-9777-4cb8-8b33-50269ed9d2fb", "value": "T1E4A5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316608, "uuid": "74c3121f-f2c8-4117-b904-b703ec2ab404", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316608, "uuid": "b5479479-5bb3-4269-b680-2c91fdb04773", "value": "12288:MVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:5fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316608, "uuid": "23c409b6-6523-4aec-83fe-25134fe2670b", "value": 2134016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316608, "uuid": "6ea16c91-6d09-401c-9a11-4da00ffd56af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316608, "uuid": "e684f985-9e22-448e-a334-626a3c9cc1e0", "value": "9a05c94e55a98b836732ffb0481133e211f0060998cd04c0e8e90c9069f4f6d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f76b0ff-1b6b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632290905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290905, "uuid": "e1d92dfe-80ca-4cdd-9b6d-33a8bec27ac6", "comment": "Malware payload (ArkeiStealer)", "value": "d72e387e5c4757a1f5e40645c57eefa9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290905, "uuid": "566ee508-4e48-4288-94a0-eeb4e74c41f8", "comment": "Malware payload (ArkeiStealer)", "value": "9a10fedc08825568afd8a1549c894acc2e0b8a124663b1e13e0903817c996636", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290905, "uuid": "7bcbd52d-fe36-4a6f-8011-d63530124cd3", "comment": "Malware payload (ArkeiStealer)", "value": "4c05d3c34076c84129c91a6a9bf703bc3e16e9e2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290905, "uuid": "fdf08e29-3eb9-4956-a078-82817d89af4b", "comment": "Malware payload (ArkeiStealer)", "value": "2ca3e6b5956ffb69b57fed08b14a6d08d27c5b7ca43995574896a60634f619657129f1a7b633513da275a4a4f9895da5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290905, "uuid": "1c728795-9b74-4022-a9fa-6ce5cc25927f", "value": "T1AAF4F130BAE0C035F6F716F548B997ACA93E79B19B3441CB62D116EA5A346E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290905, "uuid": "4ad5977d-aa3d-413c-be1e-7ace9e1d33ff", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290905, "uuid": "b74104f2-2698-4d6e-a773-005bf0ef448a", "value": "12288:gaGQHeI8X5p0KoZ6ZabTCIzsBHWcUqpZZtoVRSfv4HG6Ac8L:FeIK5Z1UatofSfKP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632290905, "uuid": "dc17e697-9a2e-4bf2-b9bc-acaf996ba747", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632290905, "uuid": "0a5ea97c-a3d3-4651-a142-1256329e1ec1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290905, "uuid": "d8cdc933-661e-4258-8fad-0f5526e4b83a", "value": "d72e387e5c4757a1f5e40645c57eefa9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be240bb4-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316351, "uuid": "afe8b71d-9146-4afc-957b-79aff05e9dc7", "comment": "Malware payload (Dridex)", "value": "dfedac88389b75153c03e2fb78e835bf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316351, "uuid": "c320719b-3d16-4f83-92ce-0ce9eb02ac5b", "comment": "Malware payload (Dridex)", "value": "9a34c406d4cba25090fd0b1ed68d1987235431e18f83d20419e7452edb00fae7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316351, "uuid": "a1c897c8-374b-44b2-b512-0d9b869e8698", "comment": "Malware payload (Dridex)", "value": "cfc2147dabc750eeb83226e1c50faf5a3215c6a9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316351, "uuid": "770263c1-e6f2-45a1-8771-a64b7572c454", "comment": "Malware payload (Dridex)", "value": "e4bf0e8be16c78a4a410774bbcb31111e0c47a53bb7798cd54d430bd3f98c5877f094392de4c8d084715e1617a240acf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316351, "uuid": "77b5260d-4a32-4d3a-8ba0-18e65c7ca2bf", "value": "T113E5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316351, "uuid": "0942a376-323c-4739-9336-e19b10baab89", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316351, "uuid": "5c571235-6375-4c34-8ff2-58498bd047bf", "value": "12288:vVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:GfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316351, "uuid": "ef0a2007-0268-4312-a1aa-84238f35fa4e", "value": 3223552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316351, "uuid": "da10799a-e37f-4d26-b943-31a726672708", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316351, "uuid": "9eb10934-879a-499f-bcc5-c25fc51c1662", "value": "9a34c406d4cba25090fd0b1ed68d1987235431e18f83d20419e7452edb00fae7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2da84f-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Macoute)", "timestamp": 1632316666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316666, "uuid": "4f4c6841-3137-422b-a4d4-4659c515970c", "comment": "Malware payload (Macoute)", "value": "5eba3754acbef73b1f367a468f7e4334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316666, "uuid": "5e4c64ea-eb38-4b86-ac47-e4ab0fade8e1", "comment": "Malware payload (Macoute)", "value": "9aa6c5264b7f33d75a2efeac94e8dab01922b546a9e995dd05132998a44ba735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316666, "uuid": "5b845b66-d022-47ec-aca0-c1bffcbf9b25", "comment": "Malware payload (Macoute)", "value": "307788662fcfae5ca45c5aa14d5b0466b2f9b447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316666, "uuid": "d0651b84-2a24-468e-bc9d-82e64b6bbdec", "comment": "Malware payload (Macoute)", "value": "0a7174bf886940b31221622c1f66d2d7eb33dc74111075d7c3ae1dc20ed23c9db74f2a545438d0e6fd0070ff85f7e0b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316666, "uuid": "ae907307-ca92-4403-a07a-0d084249b111", "value": "T10275BF81FBC303F5D8830B71705AB77F9BB24A2D402DDD9AD3952E06AC3A6139A1E754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316666, "uuid": "7e9631c5-4102-4291-918f-0c695bb9694c", "value": "23b7a2ad6dd5722f5566eaa0d8a348bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316666, "uuid": "815c242b-702a-4c19-b52b-e27e5b179f4e", "value": "6144:eafsiuvAQ+tTm6cyERSiytjEzcWE4jKS6vRBV+UdvrEFp7hKdlk:bCvAQ+q6ctRt6YIWfjOJBjvrEH77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316666, "uuid": "8df41938-f932-4f24-87b0-421420978907", "value": 1600455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316666, "uuid": "2a5a5876-58eb-49e2-b347-86c1d82f991f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316666, "uuid": "888d9dfc-5cff-4465-9c85-0adb27cec68b", "value": "9aa6c5264b7f33d75a2efeac94e8dab01922b546a9e995dd05132998a44ba735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aac34a5-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632316506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316506, "uuid": "d44b0ccb-4a77-4d53-866a-7a9026de0241", "comment": "Malware payload (Mirai)", "value": "3d72dd931b9234893994bcb8b60ff511", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316506, "uuid": "b2620b1a-1c2e-43e9-9d1f-7beeb03d4a12", "comment": "Malware payload (Mirai)", "value": "9c60e388f772b371bfde4945024e28bb3c9aad7cfb1cbdb89423695ddca342e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316506, "uuid": "47425406-e1b7-472c-beb4-c19aafb484be", "comment": "Malware payload (Mirai)", "value": "b9adcd7ac74ffd42dfd2d5dd30587b1c195f1651", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316506, "uuid": "0657ce3c-aed3-49bf-b615-aecf496382d9", "comment": "Malware payload (Mirai)", "value": "08e64807a427fddba1d2b3ecd758def9a7cf9228bf7e993bddda18c0f9f245d39851fad25f94fdcf471b32f50d4c255f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316506, "uuid": "9ca7b49c-a823-48eb-bdcf-07bb588b69aa", "value": "T199B31877A4515FB3C045A5F125BA99320F12AC931B1F1A84763CBAB44B3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316506, "uuid": "a1797563-a89b-4723-9e48-a5a9bd7a0db9", "value": "3072:OwNUWqpCgYXlrSyWUfMN7MmH1cuEgv26uN/:OwNjqpC/G8fMN7MmH1cuEgv26uN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316506, "uuid": "83c9d0e0-1d85-4cc9-ad70-3f9bb023f53b", "value": 112634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316506, "uuid": "78dce08b-c475-4618-9391-aa05c61e0bb3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316506, "uuid": "e3818edc-720e-4697-8e40-8acf58414367", "value": "3d72dd931b9234893994bcb8b60ff511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2c2de4-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632312539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312539, "uuid": "96f3f6c6-c256-4ee1-9449-8194817fa74d", "comment": "Malware payload (AgentTesla)", "value": "5b465e6d6bb532a34569c0e275a63ac1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312539, "uuid": "7a1da8e8-ab86-430d-97b1-d7e55021fa9b", "comment": "Malware payload (AgentTesla)", "value": "9d1257335a482231b0cba62949e5470f23130dd0449453ffcecb0c3879d80b24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312539, "uuid": "ec0beb0d-0b2f-4813-a6dd-4ddb2dfe068e", "comment": "Malware payload (AgentTesla)", "value": "d8f5f9b13b237a00d11de725b1d9ae4258b20bc4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312539, "uuid": "6704337b-e962-4210-866d-ed34faafeef5", "comment": "Malware payload (AgentTesla)", "value": "82da0e1de3e2260d7d2061ec567aa143ea71fccb72f095af770d1f630c3c7a539b61df0b5c84fad9e7967349233402c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312539, "uuid": "a211a14f-f9ac-4b2d-96aa-3a5549e1e247", "value": "T191C41235D338927CCE6DD7BE103218050BB5D1CAA723DBBAAAC2B18E7C1A7956105CB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312539, "uuid": "70c25231-70f3-43b2-9740-23b3893a5886", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312539, "uuid": "0f662747-7cfd-4f15-93b0-d2bef49ce2b7", "value": "12288:doU3mtiK5oBKIe7SieZn9zzOSo4gIV3d:Z+FoBKn7O93o4gA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312539, "uuid": "64a294bc-d314-405b-9eb6-806917016f10", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312539, "uuid": "3de9d0e7-e459-416e-8271-8a2c2c80a7d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312539, "uuid": "63b623bf-96aa-48c3-945a-643ce80caa22", "value": "5b465e6d6bb532a34569c0e275a63ac1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b6401b-1bc5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632329572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329572, "uuid": "9bbed09d-827d-46e1-bf94-920ec80f203b", "comment": "Malware payload (Formbook)", "value": "da42008213c22ec9f15d09aae212331f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329572, "uuid": "559f33fc-86de-4fcb-9812-624c94e4b5ab", "comment": "Malware payload (Formbook)", "value": "9dbcb6d140d0fd1db131b3f086eb8ee6dc9d0dcdd325f36b48aea1495408e2a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329572, "uuid": "c3a4d116-12e9-4b4a-8539-e1d9e097ed95", "comment": "Malware payload (Formbook)", "value": "430eb985436b49288915af1046f71d8fb20a391c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632329572, "uuid": "13b3aca1-c6fc-4a3a-ae5a-bc96d1fd25c3", "comment": "Malware payload (Formbook)", "value": "b8606824c0f34223480f309310d1ae8029309bf43974d830ccc58fe42e5cb27e73d1a62900be26ad140b7f8d7b707cc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329572, "uuid": "f5b0811f-bcbc-4435-9b57-22e36d6619f2", "value": "T132F48AC85D898603C7A44272DC6D6606322D5C4A3723938BCBE53D773EFE683C62D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329572, "uuid": "0381bc22-b34e-48d7-855a-988f464e62ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329572, "uuid": "837c0546-93df-47db-af89-bd3b3182e102", "value": "12288:VomtiK5oq7qAsgAmU4JQCoXEtAEosB3TySavR/TZnLKrk:e+FoqugqCo+B3TjavN0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632329572, "uuid": "d581b392-c88d-4b9d-bd5b-6aa3b765a7d8", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632329572, "uuid": "d3ae87ef-344b-45b7-8830-70a1088a29fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632329572, "uuid": "8994b335-f5c5-45e3-a649-d35aeb2652bc", "value": "New Order Specifications Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a920a44-1b98-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632310144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632310144, "uuid": "cf6408f1-5cd3-4ec8-b815-9cb4fd376ecf", "comment": "Malware payload (Mirai)", "value": "cf313a737f2ead2016bf8e70013ec030", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632310144, "uuid": "9c9778c7-a60f-4b62-b6bc-1f1824149789", "comment": "Malware payload (Mirai)", "value": "9e5d9370420493cc842f2604f36ab36f7c8ab64c72d2761a04567f9fab2fff30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632310144, "uuid": "f1fd6c68-196f-4adb-b1b2-477e532339cd", "comment": "Malware payload (Mirai)", "value": "25abad90b52ae99210ee6cd79ee0796cfeafe925", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632310144, "uuid": "1c81522a-c1e0-4e39-97bd-d5afc707f7cf", "comment": "Malware payload (Mirai)", "value": "6b2e5c2a99999967bac4779afd9aaede719357794f428462852c23f5bc8df66c0cf349dc7f1d5de0f831bed8886cde04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632310144, "uuid": "24fd7803-c65c-4f27-9233-e19177ec4575", "value": "T1DA6412ABD9777D8BEE0B4FF021A70E4A1AFDD6D6D2C658907325048439FD346A2607C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632310144, "uuid": "54d235c9-0a11-475c-8866-59af633e71d1", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co:7O/QJHZweEL/NOjCHm7FZZnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632310144, "uuid": "2e31f2d3-cf97-4fb0-9b19-382754c33d5b", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632310144, "uuid": "05c9b97a-c1f5-4d55-9611-d135bc6417ab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632310144, "uuid": "45470b90-2eeb-462d-900b-3c76136fddb2", "value": "cf313a737f2ead2016bf8e70013ec030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345f243a-1bbd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632325998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632325998, "uuid": "61054b6a-62bf-4102-822b-334cbbf29e82", "comment": "Malware payload (Loki)", "value": "f7896603ae14a91903ac46e5f31b182f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632325998, "uuid": "eb07447c-2425-433e-8f19-10a3860fd3ae", "comment": "Malware payload (Loki)", "value": "9e6517b60e2944a83b71cff5a2115ca5ff5cf44ccddc545fa9c8eee8ca5aa2b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632325998, "uuid": "8b00e007-9b5a-4091-869c-ce7613d8c756", "comment": "Malware payload (Loki)", "value": "3073319d92616985b78019eb94ed5a1f3a1aa716", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632325998, "uuid": "7b2db404-7487-4bdd-92b1-4210f1659bc1", "comment": "Malware payload (Loki)", "value": "89bb0a8a70aa02fc77d50a09f747f3cbddcbbcf519d4cf5634bd21cdd81e4aa6cc1017d1f37a250b58f230d5228a0583", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632325998, "uuid": "33ea0f40-61ac-4133-a35e-728a2177c8b3", "value": "T103449D30BBA1C034E4B716F855BA87B8A5297AB15F3090CF62E17ADE56346E4DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632325998, "uuid": "a93eb50c-d93d-4379-a8fb-533abff4a01c", "value": "bf7145a8be1827f6adef042a2aa5d4db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632325998, "uuid": "9b39dae8-179d-48ae-a10b-586975bfa2e8", "value": "6144:3MW1mxsZjLVTfMiBxMoZ/eyjX24CR46rgFMe1jfC7V:c1+vhfMjorjXiZUFBLC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632325998, "uuid": "4b81824e-e4f7-4f32-8d25-4485da37ddee", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632325998, "uuid": "915e58c2-da4e-463d-b7b5-a23f9439040d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632325998, "uuid": "93cbcaa5-938b-4eb2-893d-1542724ae024", "value": "f7896603ae14a91903ac46e5f31b182f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20ab11d-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632312438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312438, "uuid": "e4ec682f-f79e-4e9a-a739-0c49957efc85", "comment": "Malware payload", "value": "ab9f41c248ac69b2feda51b0bc523745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312438, "uuid": "639ed005-7a48-4bc6-bfe2-5e0567f06afc", "comment": "Malware payload", "value": "9ea8b6d99d00aae72eb7f70e949f431bb204e81e3e361189e6345b025cc0da19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312438, "uuid": "328f1324-a08d-4327-9f25-c826f88eb659", "comment": "Malware payload", "value": "6f1f125dd2a3edcbd18220c63625fdc13ae307db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312438, "uuid": "d92a5b62-bb1d-4fe0-9dfb-886eb5d5d4e5", "comment": "Malware payload", "value": "a873ffec68e9511547c9e18fe12de8e57b6fbae40e6b64f1a6ac2d68d81227716ba285b58d145b5a1e40306cdffa8907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312438, "uuid": "6506418d-45e1-4fee-9d3f-8533f267e298", "value": "T18DF38A3E29FE2327D166C7D68BE08823B68088AF3237F96557D743654316B4634D326E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312438, "uuid": "420d0214-1dc7-4882-99de-461eb2f92c46", "value": "768:mubkUklTnaMdtUQXXXXXXXFcXja4X4D3/b0h5miXdu0JVImOAPFk0/8fDWGVVhXa:muOFEzDUsARxZX7JwTtXxGO9ZGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312438, "uuid": "a513870a-4d8d-4eae-bec7-53660662685d", "value": 160477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312438, "uuid": "a7d167ab-9032-4d68-bdbc-364587858d45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312438, "uuid": "af93e0f9-d832-4d7b-b073-fdceb6a16b0f", "value": "ab9f41c248ac69b2feda51b0bc523745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d57215a-1b75-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632295009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295009, "uuid": "d6b834cf-77d9-4cde-8033-5fd2ecdda53d", "comment": "Malware payload (Loki)", "value": "382fe8a9b6e80d805053b5c0a2d5475c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295009, "uuid": "392bf95c-8a6a-4f34-9ce7-eb36c4c2b475", "comment": "Malware payload (Loki)", "value": "9ee2d9fa81f867c19beae4747b32d276f5b09e325759babb78f39336f5ae23a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295009, "uuid": "efd1455c-2218-4a8e-9668-79f0ece26972", "comment": "Malware payload (Loki)", "value": "b27fb055edf3f98eadce336c2016dfc2538de60d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295009, "uuid": "16809b0b-5a0a-4317-a4e0-5c2688b6d6c4", "comment": "Malware payload (Loki)", "value": "d0014f0dcc52b0fa6e5011c4c61de0f41a01d2ea531b554a0d62cfc39494b9a94eafb49b91444b0d0e8e7455041cade3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295009, "uuid": "376f49f1-cec1-4518-b8a9-af896183344c", "value": "T131A4123EF67D9A70DABD8AFD016191874FB1A28A3507E11B1ED7708E3D06B920035CB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295009, "uuid": "28edbf36-bb9c-46f9-bdb0-b522e9538e44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295009, "uuid": "043e5ac6-eee7-4884-a68e-5c769651abfe", "value": "12288:rt4I3mtiK5oBEtY14olOfGT3QK64p1tYw:1+FoBEi4EwcQKww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632295009, "uuid": "0447fcbc-8b47-4ba0-a39b-12818dadcc45", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632295009, "uuid": "5a3b8686-9797-438f-941b-7188f059ce8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295009, "uuid": "d011d4eb-c000-47c7-aa00-38e313b144b7", "value": "382fe8a9b6e80d805053b5c0a2d5475c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aafdcc5-1bba-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632324666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324666, "uuid": "e4337154-4e3e-408c-914f-7bd6443b8694", "comment": "Malware payload (NanoCore)", "value": "5d83f2a546c2e4071bb3b868b5bc68be", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324666, "uuid": "e022faa1-e246-4d09-9678-578fbb1156d7", "comment": "Malware payload (NanoCore)", "value": "a03cead7ce5c7e78c37ae2c7268d83dedc697cbed9d3ab9b76cc934f23f85591", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324666, "uuid": "f9f15c4d-945f-4742-9433-879a7c1d10cc", "comment": "Malware payload (NanoCore)", "value": "6955f443563e8c0a2f269edbb3d063c9295f952b", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324666, "uuid": "7ca0883c-e708-4e13-9184-e6acd39c9a46", "comment": "Malware payload (NanoCore)", "value": "7274cd7aaa7c011bb395de9dd39a64929dc9bbf4aa3bc4be719f9fe68db987bc4d1050f4eb7d3c073e13f0fb9ef110d7", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324666, "uuid": "0cf0532c-6a7a-47b8-948f-bcd11e486664", "value": "T126F1103CE60376DE741D5E2D09CB77295A10C0B5C953E6F9C740FAAC69EEB40AB51238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324666, "uuid": "1f4a7ca7-d1b2-41c4-b01d-94f50d042296", "value": "96:PPNTJhS9INIKMVGQRX8+HLz9spiINIVIWjnCQRX8Lnaa:PPNT2INIRRX8+Hm4INIVI8xRXAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632324666, "uuid": "bc9ccaea-aca9-4a7c-a62e-9282d91d8158", "value": 7752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632324666, "uuid": "d32b9452-ec77-4de0-b089-dee54df86a0c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324666, "uuid": "1db66ba6-98be-408e-9dba-09736ee32ed7", "value": "Invoices#228.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7518814-1b9c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632312017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312017, "uuid": "9d08aa3b-e7ca-460e-9b53-14f2bd2bcd17", "comment": "Malware payload (AgentTesla)", "value": "c731faf6a696ec3653014f0565077749", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312017, "uuid": "c2fcd17d-7b70-4bb6-9bb2-c2ea82b7b690", "comment": "Malware payload (AgentTesla)", "value": "a06c5c6b014c64b95348f7b7018b339bc1ccc3715428811f2f066e57559ca95a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312017, "uuid": "5d8e80c9-2ddc-4eef-ab6a-2c6679c08598", "comment": "Malware payload (AgentTesla)", "value": "dbe9419dbf7ae2ec2bca99d51ad8dd45f412442d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312017, "uuid": "7e08b6ed-78bf-4688-8721-e8b9701a3476", "comment": "Malware payload (AgentTesla)", "value": "50763a0e3a9219a5d78a4e32025ec43c14c08ac71bde0685585e54333d6c8ad8460f05e57cbe0acf107ebb33aa816732", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312017, "uuid": "2e6ddfc9-3901-42ff-9fae-46151a017392", "value": "T157811AB92A788883CF4BC0F6F576FC460283F283C8C78245775DEAE207977119525585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312017, "uuid": "09448ed0-2fc5-4a40-9a23-4afcd70478c3", "value": "96:Ztlv7TpPPI5nQd/JBZmK9cvwKWN7vbomn0cSOBii7VYcoLz:3l7TpPPIhQLBZmEFZ8aPSMxYc0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312017, "uuid": "f26a121b-f55d-4f46-adc8-26474b39cd4e", "value": 4026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312017, "uuid": "a7fdfa93-37b7-49bc-b24c-1950df7182c4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312017, "uuid": "f94b88c9-6bbc-4954-a5a8-70d6f7d419c9", "value": "PO022090202102.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac51ec5b-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1632316750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316750, "uuid": "6526a62b-ac31-4ac6-8f70-56a546f2774d", "comment": "Malware payload (QuasarRAT)", "value": "d9ae9f8e6be0c1d7c70a1d1b86f44a8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316750, "uuid": "1a1f694b-a809-4806-9727-726a1d495fbe", "comment": "Malware payload (QuasarRAT)", "value": "a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316750, "uuid": "51ee9b21-ce8d-49ff-8b16-db47684e619b", "comment": "Malware payload (QuasarRAT)", "value": "1564057c68ed04ffe76aa192e867ed40cd868840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316750, "uuid": "e99d3cea-dc9a-466f-8a75-3a8fe83c2319", "comment": "Malware payload (QuasarRAT)", "value": "28e89d4f95d21ff08c76c8010df252825f6bac4059214b452424e13f8e8c66325d703f69723cf74720da7b768840e024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316750, "uuid": "c18921c0-ec2e-4f00-a9a6-cb436e12d30a", "value": "T12225F2567CD47FF4C48046329CB6D1183FA6F8EA8A8F8EF1F2593618096C940A793679", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316750, "uuid": "f563abad-24f3-4c74-a733-c7e820cfbbdb", "value": "c6ca8dfbd9b5902924dcd7d200bb3c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316750, "uuid": "c748752d-2b6c-4575-b43c-f6aed13eac3e", "value": "24576:4K+c1vLy0tnxMECV+v5AnbCnoMudDv69QslXZK:t1ly0tcV+vdoMupvgQepK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316750, "uuid": "04e66ae3-a868-4718-b1e7-f7ef94df7063", "value": 1054912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316750, "uuid": "7b7e5e7a-420c-4108-bcff-11aa05f8f202", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316750, "uuid": "7ec8bc89-abd6-42c0-94fc-895d036f6ef8", "value": "a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f4af89-1b6d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632291557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291557, "uuid": "02da064d-b975-422e-809d-b9d514596f43", "comment": "Malware payload (Smoke Loader)", "value": "275eff7cfda418f451e2828bc5c46e0c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291557, "uuid": "540d6d94-e420-404b-a6b6-ae9c81f00556", "comment": "Malware payload (Smoke Loader)", "value": "a24ce8a6eec839eb40cb53a8bc3e43a1409a38246d5ba1c686dcabe3485e83dc", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291557, "uuid": "bb1173f3-7945-48ca-b73c-afd8aeca9eb4", "comment": "Malware payload (Smoke Loader)", "value": "0d9b5464b08366c4e115931daf215902280a4a0d", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291557, "uuid": "947a5750-910a-4c0a-bc8c-212a89f327bc", "comment": "Malware payload (Smoke Loader)", "value": "42edb6de7c92bc25af0a248f8fad65f029bfb78bf5bdbea072fe4c82988966d22691d95382906959b09b743979c08f5d", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291557, "uuid": "e9f8969b-c7cf-423d-927b-afc8c875d080", "value": "T10F448E22A7A1C036E1F712F845BAA3B8A93D7E755B3090CB22D126EF56346E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291557, "uuid": "215ea419-161c-43a8-8794-77d7560c89f5", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291557, "uuid": "e2c793fb-b52b-4b66-978d-006b6385067b", "value": "6144:QlwRmeSvASLqgL6ekgCN6mTEHf0dboi6a4UJhVs:5svASLqgLuvNnEHcEa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291557, "uuid": "5a95e88e-ddda-4c7c-ac26-609803154f7a", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291557, "uuid": "47052a92-982a-4ce5-b7f6-0d99051e5e83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291557, "uuid": "8641999a-632c-42ee-bfc6-4415498dc32b", "value": "275eff7cfda418f451e2828bc5c46e0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb6618d-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632312483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312483, "uuid": "fc46b535-7a8d-49ad-a80e-e85ead2ae46d", "comment": "Malware payload (ArkeiStealer)", "value": "dd19ab007de364fc8d58dbec13fce6cf", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312483, "uuid": "da46504c-2098-43bc-ae8f-2ef57a6db21c", "comment": "Malware payload (ArkeiStealer)", "value": "a274b205c5595953639949e63ae421f2b39424fdcbd2bd41ef0f265fb9e06d4e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312483, "uuid": "b223ea55-0999-4d75-9ef6-d6fe462c9149", "comment": "Malware payload (ArkeiStealer)", "value": "9cd9f07b8094f74547be4d1ddd5a903e95f6833b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312483, "uuid": "e08247af-69cb-4f19-b75d-82a293acbbbb", "comment": "Malware payload (ArkeiStealer)", "value": "64ee7ae3f89af2001a155664291e9b39867b0f607542092fcca44fb9eea7997b558d1646dcf59a52d810eafd558f683d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312483, "uuid": "368db19f-8bb9-44c0-894d-fdfce7a4b891", "value": "T1F2648D20BAE0C035F1F712F989B997A8A93E7AB19B3440CF62D516EA16347E4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312483, "uuid": "13144e04-4884-42f9-acf4-3c2f7239e384", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312483, "uuid": "65fd55b6-5f14-490c-8e00-9e10a7da9e7b", "value": "3072:WeTshfMDs22mApQIDFiGDW5IexAE49F/VYz7hZynkSIKuURu5TJsvzYNN0mTCVX7:WeTUfF2AeIZ65Iai9F/VYQ+FNHTe+tz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312483, "uuid": "34afd135-a079-4704-8027-68157306895d", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312483, "uuid": "10f1b592-9ff1-4729-9f68-c66932b82523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312483, "uuid": "98b220cf-c91f-423b-9036-cf8e78b5859c", "value": "dd19ab007de364fc8d58dbec13fce6cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb03ce3b-1ba5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632315943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315943, "uuid": "4d3e95cc-a273-46a2-aff1-4808da43ae2e", "comment": "Malware payload (RaccoonStealer)", "value": "e64b62be4488dbd87afb60cabd571973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315943, "uuid": "490de493-a4f1-498e-8eeb-4d01c81c818a", "comment": "Malware payload (RaccoonStealer)", "value": "a422ed03a4f32c092a5dc53c3d8fbce7e32243f838a45b27a396175b84cab369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315943, "uuid": "2469419f-ecee-4e65-9c23-b0f5a9e71d21", "comment": "Malware payload (RaccoonStealer)", "value": "297af8fc961d1fe99c070c3da3d148fc33ec2a13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632315943, "uuid": "8a8f6315-a6ca-42b8-8bef-37593a83249c", "comment": "Malware payload (RaccoonStealer)", "value": "6a6c69fd72e2dc318677292d16136aeac7d887ee234efae5291d57fbbcfd74609cc53175e0e7371c38185d668a4cdd84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315943, "uuid": "9a496b18-1ee5-4485-9724-cc569cf9df71", "value": "T1ADA4010179A1D331C36B49F0792BD7A1097A75E2662C428F779B3F7E7E622C05A35382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315943, "uuid": "07f29e0f-31f4-419f-aa89-8f89a91202ca", "value": "b6847043720ac758135cfc4be1dc3a6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315943, "uuid": "1b100ec7-8045-4eb5-93a0-6430c1771bed", "value": "12288:yuEpwtq6ZTOQ/8h10PEnudfSL7LGj++S+lC:yXpuq6oQUDRud63LGj++flC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632315943, "uuid": "b3d30c14-7b1d-47e9-93a9-8ef68b691db3", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632315943, "uuid": "47e43bb3-04cd-4cae-aac2-d825ff399494", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632315943, "uuid": "553d187d-d8c7-4ade-bdd1-4c7a107f31d4", "value": "297af8fc961d1fe99c070c3da3d148fc33ec2a13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a86c7d-1b5b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632284235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632284235, "uuid": "3ce39897-9c0a-4b3c-bd0c-39f6b0d9a92f", "comment": "Malware payload (AgentTesla)", "value": "e922e4f6a86c8b6e3f582c7e2baa4adf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632284235, "uuid": "e6b502d5-7fd3-486d-aedc-d6c029cf1432", "comment": "Malware payload (AgentTesla)", "value": "a63cb2af73de3cb6d68e082ef228e4a3cb41d57082f568c3f0ba098f08c9643f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632284235, "uuid": "b3b2b125-419f-4452-8b38-d152bf1e7895", "comment": "Malware payload (AgentTesla)", "value": "9b5d99ae37bc6745899e80e619fd0dc8394f4fe9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632284235, "uuid": "917f6ed3-1073-4c91-832d-3aeee8c71960", "comment": "Malware payload (AgentTesla)", "value": "6be257dc7382281c2c0a78f937aabbfa5741e5cc0f76dba3e6c241bd1c32f60803cd655434c2b023628d36bc077754e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632284235, "uuid": "89825385-ed8a-4443-8e7d-e1db7c20d235", "value": "T1FAF436F61635EE29FD54ABFCC1C990110B231E34D9924549B731BB8E2DA7FD2708EA18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632284235, "uuid": "e2d8b661-309c-415d-8cd1-268e15ff28e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632284235, "uuid": "e07b4c9d-2f79-4da2-965b-f86a03a27830", "value": "12288:9zIM9mtiK5ovRMuD8N/Yde4YjQcidIjlPe5E+tWh3guYv/NMtntGGzGtGGGlGtGk:h+FovRMumgdqiaZPJvYv/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632284235, "uuid": "c0e1baee-5f8f-4645-bbed-31accaff789e", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632284235, "uuid": "a61d4f06-cab1-4c77-95e7-cd2300328a78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632284235, "uuid": "e8c468d7-df08-47ae-83cf-122cef280533", "value": "PO_1973 from foxconn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59d8545-1bd1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632334805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334805, "uuid": "8135ce49-6285-4a63-82f5-6cb4cc346e6e", "comment": "Malware payload (Dridex)", "value": "0a0db2bba0688506e8f1197fb8a86820", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334805, "uuid": "73475af1-01a6-4eb6-91be-36114667c811", "comment": "Malware payload (Dridex)", "value": "a6aaa4ffb112d78aa20345821920ce6554d96303f7fb3facb5143de348cf2aae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334805, "uuid": "0cb40118-0077-4819-9f17-dfe555ef66d7", "comment": "Malware payload (Dridex)", "value": "aeb848348d88a4985dcacca9f5884dfa84b2eee1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334805, "uuid": "d5a5dcb7-8961-4349-ae06-d569c5a7ce6e", "comment": "Malware payload (Dridex)", "value": "e98380a293239fd747dc693fd3b0bec016144c13a88b41e9759eaa80c497391ad79b1b867135a6656fd22d8267e3ddf2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334805, "uuid": "d7d17c79-0989-421d-80e3-b67ef5e1522f", "value": "T1B414DF13A6B931D3E19B383F92A1E7B16E386F43C338C45BD6D4F56899312A354A5332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334805, "uuid": "b1867986-6942-40e2-9f05-3c7b27c8da59", "value": "bc9115da123ae49443de76ad96ad8e1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334805, "uuid": "bf08e891-b437-4161-bad8-9edb6ff30c18", "value": "3072:zwd4sevPYabz9RLhPO8f3zRCyvD6meTuxn2ZjflxomQYIE5abiK/n1:IsvQabz9C21Pmb82xnwia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334805, "uuid": "c73c36ba-00b7-42b3-8800-2556bebc1ee9", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334805, "uuid": "645e996e-8bec-49e0-bd99-0dc06104592e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334805, "uuid": "6d05e075-3546-45f5-81a1-ec16bb05fddb", "value": "0a0db2bba0688506e8f1197fb8a86820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14bd6c87-1bd1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632334535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334535, "uuid": "c20d7d2c-1006-4136-9951-6c063434f6d3", "comment": "Malware payload (Dridex)", "value": "acdb2b053a59d94cfb40bfa50a834108", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334535, "uuid": "a58090eb-649d-4589-aa76-37ecba6af911", "comment": "Malware payload (Dridex)", "value": "a6d5469211239598d8cb1b2728aac17038aaadff212ef1616e432984e9357426", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334535, "uuid": "6076c0e0-c382-4663-b756-ddc0adcd9766", "comment": "Malware payload (Dridex)", "value": "4d2aabd47cd706883844b3428a9776fca627075d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334535, "uuid": "e820bef2-6247-41e6-a2a3-f25721dd1c94", "comment": "Malware payload (Dridex)", "value": "748c89c48749b08f7e46e38041797a5f860daf7d047ddd98eee3320c3c385614d78d2c49ba23e71dbc7bddf3c5d3cc9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334535, "uuid": "3a094e08-6b78-4133-b0fb-cea430c076d4", "value": "T1F114DF13A6B931D3E19B383F92A1E7B16E386F43C338C45BD6D4F46899312A354A5332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334535, "uuid": "af4753e8-850a-4290-9347-fa60064ab6e0", "value": "bc9115da123ae49443de76ad96ad8e1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334535, "uuid": "bf8c9d5f-a4d5-41e8-8fad-4582408ff7d8", "value": "3072:Xwd4sevPYabz9RLhPO8f3zRCyvD6meTuxn2ZjflxomQYIE5WbiK/n1:0svQabz9C21Pmb82xnwiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334535, "uuid": "09026065-fd56-4f3e-aab6-7dcf2b7cea84", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334535, "uuid": "38ad63bf-58b0-48da-91eb-44104a3e3f74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334535, "uuid": "e08a971c-7b37-4d50-92a3-c25a45a05ac2", "value": "acdb2b053a59d94cfb40bfa50a834108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6dde1f8-1b69-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632290112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290112, "uuid": "31a0c2d9-d67a-4a29-88b8-ff69db3b10e5", "comment": "Malware payload (RemcosRAT)", "value": "4e527c6f012db544082861b341a7bd6d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290112, "uuid": "f00727b7-5714-46d3-a9ee-589b4118e93c", "comment": "Malware payload (RemcosRAT)", "value": "a8b283876cfe18a0878401c02c83f73f13afda1bdd12f95549dfcedd2f805e5f", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290112, "uuid": "07dd7d34-b03e-4d19-ae9b-08823c937f75", "comment": "Malware payload (RemcosRAT)", "value": "50f9331261fc201d7df8321657582f2021bd70b5", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290112, "uuid": "00351335-c9a0-4e4a-97ba-b4ab395e25e8", "comment": "Malware payload (RemcosRAT)", "value": "e35eb78c1a4868f8d8fedc10cc6706c856da404e471df60029d9c5ba08a5022faa5a6022cf822083fd11a627c84ed92a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290112, "uuid": "440d0425-6b68-48a6-9c65-d7eb00443d06", "value": "T194356BC26782DCE1EC253A3ED44A72416315BFF538438C8C9DB43FCB56A8A51F84A59B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290112, "uuid": "f06a049b-cc21-4d14-9a5d-384dfc5a91e3", "value": "bc8cc1eea5c25ce2056d7da92bd98134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290112, "uuid": "5b59b2ac-bd27-4792-8b5d-ab6dbcf97203", "value": "12288:BSZPsJUL/MN/cen/VwTQBXcameDCnNm7eoAdrL7+o:bOQN/cu/VdBXKyCnEirP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632290112, "uuid": "30508354-57f4-4af5-bc71-71c5ed365dc8", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632290112, "uuid": "1a433fa0-0654-4322-ac7a-4cec57433b82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290112, "uuid": "69fefc67-5e4c-46b7-8eb6-6dc8242daa61", "value": "INV.DHL202038658530 ,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86e6f5b-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316878, "uuid": "96f65df5-031a-48bb-b107-ae1c4b659beb", "comment": "Malware payload (Stop)", "value": "654fe2134b6d6aa55fd661e8596b73e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316878, "uuid": "f1447e1f-2c86-4407-ba6f-e610deb9bb6e", "comment": "Malware payload (Stop)", "value": "a900139492d599c18bc8c54abac1b846aba0d0aa11ec9e1fb70b322089996921", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316878, "uuid": "4d059375-ae3b-4d74-877e-adae71211f3f", "comment": "Malware payload (Stop)", "value": "583511d1d3430643093c7630162d85ee359c8ea6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316878, "uuid": "929873e6-e282-4969-9ab9-0d672ab8f2f7", "comment": "Malware payload (Stop)", "value": "5d8a0317f378abe7fd9e43d7efca7417d938cd7d1adfdfc726cb8e41a3483b38abcf9667e858616e362f8d4491249e9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316878, "uuid": "44d27cdc-37c9-4c04-aa95-e307edb4522f", "value": "T13CF412017792C1B2D4D21D32583AEBB45A7A7AB21B75948B7B4407FEEF303F09916B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316878, "uuid": "0b9221c6-afc4-4360-b2a8-67a26135eefc", "value": "65186050f9601ee4db4aa7e9ce7b7062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316878, "uuid": "a2bf99f4-1ece-4999-b4f3-d34fd2a7ec73", "value": "12288:mNx4K9CHVfpC67AhI1Oz1L1WrsZHe77kOd38tS2hkeOud1sxVei+Wyfrj:mNx4KcvC67AhZznWoZH4kRs2hkeOkaxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316878, "uuid": "952c7b71-db38-4e58-a28f-31d454f9dd8e", "value": 747584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316878, "uuid": "21b96250-fb47-4dd9-8357-050d439664b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316878, "uuid": "112deef9-7943-4966-a1e0-77d460ded4f5", "value": "a900139492d599c18bc8c54abac1b846aba0d0aa11ec9e1fb70b322089996921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d59b052-1bec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632346172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632346172, "uuid": "9c80ee74-9d1f-4440-a4d2-67566d26fd65", "comment": "Malware payload (RaccoonStealer)", "value": "e238a7a3fa37f2eda6d9e8cd2c51db60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632346172, "uuid": "b2ff493e-525d-4041-94c1-c26fe972d598", "comment": "Malware payload (RaccoonStealer)", "value": "a98b37b337927ef6cea8a053a4ea676646de4dfbf6ce9619593246a1ecc362b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632346172, "uuid": "6746ddf4-c00d-4f9d-9fc8-06241025d3c0", "comment": "Malware payload (RaccoonStealer)", "value": "1f479e724f51798143e77502695d07269221176f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632346172, "uuid": "e08ad959-cd87-4a10-bf84-be4926a319b2", "comment": "Malware payload (RaccoonStealer)", "value": "fd922df30cba990a1d3dd61e546854dcac72eae395c2ce9e6c3e32ac66ce0a1527383e347b24161ec1a13212c6333b0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632346172, "uuid": "168f687e-2194-4b48-ae86-07fdacd3f7b4", "value": "T132547C10B6F0C034F6F312BA59B993B8A93A7DB16B3885CB62D41AEA56747D0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632346172, "uuid": "47b61c54-f2e8-49f0-8274-382061313adb", "value": "f74a0f3da1e112835a6ac32552c0a4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632346172, "uuid": "a46d1e9d-9947-42ef-b96e-26f77695055c", "value": "3072:EfzgnWitMeo1JjUjahKbVD1HhX7iu09ZOycbxAN+NfUooeXbcELNTP0KHxa8Loj1:Ebg5XoMjLbVZBLiPv+loubcEFMKHk8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632346172, "uuid": "a2817f7e-28d4-4709-baeb-322910e20d47", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632346172, "uuid": "727919c0-d39a-4537-8f83-0042c99783e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632346172, "uuid": "45153828-c4ec-404f-97fe-186a4004df88", "value": "e238a7a3fa37f2eda6d9e8cd2c51db60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcf5f5c-1bae-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632319736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319736, "uuid": "a985edb7-24fe-4bd7-9df8-7d888c986586", "comment": "Malware payload (SnakeKeylogger)", "value": "930200802688e2a69764f7ef6ed34975", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319736, "uuid": "e2b3819a-d4c0-4585-be86-9738efb6edfa", "comment": "Malware payload (SnakeKeylogger)", "value": "a9c0a0e296cab2dd6ee4d165e9992cf27b2919caef0fd4f0f04bf9df084f2048", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319736, "uuid": "44ad5718-5a96-442f-a942-39b4e93d66fc", "comment": "Malware payload (SnakeKeylogger)", "value": "e18a34c6ad9d7bf5aac62007e6af2085de9a04e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319736, "uuid": "42a11279-6427-413a-a427-0059bc054de7", "comment": "Malware payload (SnakeKeylogger)", "value": "1a104c0578832d5748a2ede65286ce4128a6a742c7a1ccddbd059f128e38eea78ab52e9998e0c872eeaba3cca931bc8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319736, "uuid": "8d519a30-41bb-47bf-9155-f5ac946a0277", "value": "T163E479C49D894613D7A44272DC1C664632291C0A3B23938BDBE57DB73EFE6C3C22D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319736, "uuid": "2e27a121-dac9-49b5-b464-7d15ee43aeeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319736, "uuid": "b3bfed4c-b18c-48db-b7ae-2d210ae30ecc", "value": "12288:EamtiK5oNq9kpWYsn5VSTbEmbtiFvXCLT6nFbBncY7k:f+FoNQ7YYVSvtsFKLTGBnD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632319736, "uuid": "1d0181a7-5406-4f48-b872-81a89e7fd729", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632319736, "uuid": "e33e9051-6904-47b4-8b53-7a4bd900389f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319736, "uuid": "605f75b2-61a0-471a-a635-c20b031e7d85", "value": "PO No. SMC -458964-005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a760f2-1b9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632312786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312786, "uuid": "a9113815-b18c-4e5b-b457-69713718132a", "comment": "Malware payload (GuLoader)", "value": "91b0aa1191b9f0c27da8ffcb774afcff", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312786, "uuid": "6c6d6494-51bd-42cb-8843-21a34becbce4", "comment": "Malware payload (GuLoader)", "value": "ab563a1e215c2ee59dd5302bfbb81398300642dac6cd86e8faad1f28c02edb9c", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312786, "uuid": "10e4a843-244c-4eb0-8b83-886b0f2a986b", "comment": "Malware payload (GuLoader)", "value": "dbec8a8e4a52d9cdc04b4aee48a4f249254ab7af", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312786, "uuid": "79b33528-cddc-4e17-9757-a6541dbdee96", "comment": "Malware payload (GuLoader)", "value": "ccd529496fb774c07bc0a0cee746d3bfd2126e76d505a6ab51f10d8d607755cb001869908dd2b3171821e1e7ca9c3272", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312786, "uuid": "bf685b8d-e8bb-4d0b-9e54-abd7aafc1152", "value": "T127934A316E9FEEB3E0D9A174D4AAB2F47408EC24F40B4F476D81BECA3875D5025A2129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312786, "uuid": "2506ba8c-e35f-4891-9e3f-4ba52092a186", "value": "4b82967fdfc14d4519122dc367d279d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312786, "uuid": "9706dba8-b84a-43c7-a0a9-a8532e4b0ee3", "value": "768:gIcNIwSeTY8jM4JJ+aom7zfyqS2rAynKoXBADGvaiPimWv9SmGjbA+AweLUSh0uw:1cUsjMm7za7ITKISE8W7ArZq0LqZBV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312786, "uuid": "93e3b022-333e-4053-a395-b7a28847eb64", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312786, "uuid": "0652b43b-9fa9-44b9-bf3e-8cbb32188d9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312786, "uuid": "63345a2b-9455-4f52-a47f-384fb2358e76", "value": "Notificaci\u00f3n de liquidaci\u00f3n de anticipo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4345500d-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632317003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317003, "uuid": "03dcc50f-6ed5-4824-a1df-ff8a71c30ede", "comment": "Malware payload (njrat)", "value": "7d800ad9f415b03e6bb9a029fa57a3ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317003, "uuid": "76ecb370-cbcf-4d8d-b48d-6ce2dd5e861b", "comment": "Malware payload (njrat)", "value": "ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317003, "uuid": "8157ab2b-484a-46c3-b2ea-9f01f98c25a4", "comment": "Malware payload (njrat)", "value": "73d737b77a8fea41dad18dc6cdde0892b0dc9796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317003, "uuid": "18a3e20a-bd55-4fd7-aa6b-9113dccb4058", "comment": "Malware payload (njrat)", "value": "fbe7d52d592164273192d8a36c355cff9302378c0b2cc23c7ad45f12de24ec69ee821e3204a5062c9cafb8b5824003f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317003, "uuid": "88352451-29c4-4567-bc8a-d75c26446284", "value": "T14A644A0EFEBA6C25C6AC4B7BC253645C41D7DEAEA211E2675DE439A01F312DDC88EC50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317003, "uuid": "dcdf06b8-f88b-4c3c-8992-fb80a6c85076", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317003, "uuid": "973d4b2e-1cc3-44fa-8fd8-5c42080472ef", "value": "6144:ajVd/ltsjnVfdLaDdndIXhsdaYLdRQcCLq57E1+:QPlez59aBdIRsvLdq9Lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317003, "uuid": "f2e52515-0aa5-46ee-8634-4c8d97f32672", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317003, "uuid": "d651a55d-f288-447f-add7-b540105b5b8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317003, "uuid": "02ceff96-d8a5-4c92-8720-b43ab665b5e5", "value": "ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3d993e-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316674, "uuid": "fb944d30-316f-4c1b-a4b3-257803e7c084", "comment": "Malware payload (Dridex)", "value": "cfb41988b7d2cddc6469e06197ad6cb5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316674, "uuid": "d606b55f-8ad2-47f6-aaa5-ef1f5a945100", "comment": "Malware payload (Dridex)", "value": "ab72d2d8a531eb15d21fa1b37305fdc8d1ce5c11dfee852f5a67c8528039c200", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316674, "uuid": "c02e3677-eb80-430b-b461-71d4d660c253", "comment": "Malware payload (Dridex)", "value": "a4fdf615618e1603e62c761016880d9e8acbe7b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316674, "uuid": "2454c3f3-afcb-4f03-8041-5f30e105908a", "comment": "Malware payload (Dridex)", "value": "41c838e3d0fab922e369a34b235de54354e7be2045256b508fcf8157890a5e297cdefa1f68c94f7fe52194f679335eff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316674, "uuid": "362d9e0a-dcc4-4a56-9746-92b9faacd94f", "value": "T19675D020EE69E1E6C6B89F3ED408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316674, "uuid": "122e4a68-b405-4885-81c5-0e001bebda06", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316674, "uuid": "7af8f9b3-fa30-4918-bc03-3fe2f1ea9d16", "value": "12288:rVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:qfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316674, "uuid": "9092040d-298c-4568-9827-661a1b9f1776", "value": 1568768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316674, "uuid": "80ca94a5-5eac-426e-a145-f86fb794aeb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316674, "uuid": "57041034-7bb8-4133-9b65-80cdcbfc02ad", "value": "ab72d2d8a531eb15d21fa1b37305fdc8d1ce5c11dfee852f5a67c8528039c200", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8bf17f-1baf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632320027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320027, "uuid": "cd83710b-f3e0-4387-ac23-2590bcd68c89", "comment": "Malware payload (Dridex)", "value": "2b75f697eca01f9e7e8395b5b941e0ea", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320027, "uuid": "23cf87b7-dfb9-45f1-bec2-da20e15d65ff", "comment": "Malware payload (Dridex)", "value": "acbcd5ce1579a43148eee9b867f035cd0bc16f237a4790322467a0dac23ce7c6", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320027, "uuid": "ce8456b9-2ea7-4581-af43-eb92d7ff1284", "comment": "Malware payload (Dridex)", "value": "945da91d7bece7f0d5ba990ba2674b258d7980c8", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320027, "uuid": "0e538e8f-582b-4923-930c-1580d6f67804", "comment": "Malware payload (Dridex)", "value": "d0ff911023544ede64821ff6f9b32ec9abb568ba470449d2e8aef32b9701893ce3e7a47cf02bb3379e54a7befc9b00d9", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320027, "uuid": "7e90d155-260d-44d6-b4e9-5548df360f5e", "value": "T16A14D013A6B931D3E19B383F92A1E7B16E386F43C338C45BD6D4F46899312A355A5332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320027, "uuid": "e70ec927-2c5f-4b46-8add-35f1d26e1543", "value": "bc9115da123ae49443de76ad96ad8e1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320027, "uuid": "123b9263-c9dd-4068-981c-8677ec730b10", "value": "3072:Awd4sevPYabz9RLhPO8f3zRCyvD6meTuxn2ZjflxomQYIE5BbiK/n1:NsvQabz9C21Pmb82xnwiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632320027, "uuid": "e4fa5224-5d17-412a-bdf3-7ead74cb194c", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632320027, "uuid": "66590c7c-eb89-4784-b036-2808f95e5cea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320027, "uuid": "462de7c4-c0c1-408f-b654-8a92797beabc", "value": "5_samsrv.dll.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25b1518-1bf6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632350744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632350744, "uuid": "0504eb59-930d-4758-bee0-29a50e435546", "comment": "Malware payload (ArkeiStealer)", "value": "3eb267b07adb68aa233e33f4e70beff9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632350744, "uuid": "2a2172be-a9e4-486c-bead-53b362c8dbf6", "comment": "Malware payload (ArkeiStealer)", "value": "acee4513b8bf1f640277c408964419edb362ea216e2401a21761f1b7a572a18b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632350744, "uuid": "046c9ad3-8a38-4f6f-a695-5fcbcf229681", "comment": "Malware payload (ArkeiStealer)", "value": "7de8606223a87cc8cb85852ac4c5193bfe504550", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632350744, "uuid": "613418f5-511d-4e89-8f2e-10df667f86ed", "comment": "Malware payload (ArkeiStealer)", "value": "86c4c933b44eb80227b037a53ebc3b8ccf9d453f59834aa31e5c9ad34d977b40ecc0bc9dd4c42fec1663b5b84baa06a5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632350744, "uuid": "3412aa9f-0217-44aa-9a07-8e61feb73d5d", "value": "T1BFF4F11077B0C034F6B356BA49B993A8A92E7EB1AB38D5CB63C426DB46747D08C31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632350744, "uuid": "ad7cda66-7c77-47df-8d66-4dd10e9f8628", "value": "f74a0f3da1e112835a6ac32552c0a4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632350744, "uuid": "13a1807c-7ad4-4b78-91f0-610cefbb08a4", "value": "12288:HncDao/iPnbseF7iEv4J2HmCuZX60gs8NJIlqzmy4jB5+ir:Jo/YbF4J2HWQ0baQEmy4N5+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632350744, "uuid": "a06e5d7a-7216-4e6e-b5a3-c392ea4181f3", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632350744, "uuid": "251a6145-4733-4778-86e8-be92b5d9fe9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632350744, "uuid": "61ede8c8-842c-4f08-97a1-d656e185fa49", "value": "3eb267b07adb68aa233e33f4e70beff9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ddefe2-1b6d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632291802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291802, "uuid": "c6c9c77a-4c6d-4213-98fd-97f48bf057a9", "comment": "Malware payload (RedLineStealer)", "value": "2e8ac744a4f9dba83346370ce7c3aa05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291802, "uuid": "80e5a1ff-b328-4136-81b5-b757ac20059a", "comment": "Malware payload (RedLineStealer)", "value": "ad291dd59e6dce5245e1a3c7a81514353a0d6a107f86c8e37fc4e9171f4ff1c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291802, "uuid": "44616957-7eb2-4ca6-be97-b48757308f88", "comment": "Malware payload (RedLineStealer)", "value": "be5e0c31ab7c0848597f5feea77fe5d05c806c7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291802, "uuid": "f48cad6f-f51c-4036-9908-a834bef3ff67", "comment": "Malware payload (RedLineStealer)", "value": "854828b7bd3260dbba08d5327fdb4b59dc31812bd7daee181e5191093b8955e1df2164a8e1070e2776feeaa4bac83877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291802, "uuid": "b88b42ad-7ad8-42db-bdb7-7dbc3b1f72f5", "value": "T119E5D8A53D6F66FBFA9D04FCE5838503672817F1D0104B0A95AD607CAF53C2D22CBA69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291802, "uuid": "00e014d0-8b20-4e70-af7e-402167223596", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291802, "uuid": "85775e49-ac67-4552-98c8-662c61f032f8", "value": "24576:a0l9FjBRhJQ06bwIsNdvh+RB8dBxw9QVxiFaDxuLrPQY+/voV+VjHd976Dr7RMyc:a8zYUJmWdM5SgQmfRDkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291802, "uuid": "f072991f-9fd3-47a2-8ba7-ea95823e6836", "value": 3243272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291802, "uuid": "c6fe2d91-66b3-4172-a29e-c4d7ed1f2c7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291802, "uuid": "5fd7c0c4-96da-41fa-97df-81eec0e4af73", "value": "2e8ac744a4f9dba83346370ce7c3aa05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fa951f-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316823, "uuid": "f1796101-e460-416e-a0c9-98ed83e6512c", "comment": "Malware payload (Stop)", "value": "15531203e9d3380996a43dc99217a6bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316823, "uuid": "2795e05a-ab35-4a0a-a0a7-3fb2a2a299bd", "comment": "Malware payload (Stop)", "value": "aed0d2debb077e84fb10fce79e0bdd1aa2b1d85163f0bfeb4c7c345a649e61c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316823, "uuid": "a16ea04d-2acf-412b-a743-7540e6620c73", "comment": "Malware payload (Stop)", "value": "1c8c1fbecf0f8ab8b7ca0ef4a6064547b9f5a3c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316823, "uuid": "d715109e-a6b7-417a-a59d-12ea43de1f2d", "comment": "Malware payload (Stop)", "value": "5c6d9cb1a91fd314a2f0098ea2cb83cd31b052e7ba5b08a0d7d2e690558c047a859fbe07021cb879f6745a8a54c7f77d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316823, "uuid": "142e09f5-1b21-4dd4-b74e-4585cb18ea9a", "value": "T101F4022067A0D039F5F312F459B593A8A83EBAB16B2891CB53D505FF62346E8CC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316823, "uuid": "cdf194a7-7793-473d-8ab2-2b6784fd0658", "value": "2d3e8f1de619588f819136537821e72a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316823, "uuid": "005e5525-e4b0-4f13-afa4-ba48c287bca4", "value": "12288:kZCh7vGxJEzGjrGkrVTWgK0tdsakzqmj0dqONu/cHseKl5fhVVB+uLqh0wTSeYyd:kEh7vGZGIVTlEzhyqOs/9jLVB+uLqKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316823, "uuid": "831a7bab-fec3-48ae-a887-2395f05b4f48", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316823, "uuid": "e796c205-2b67-4713-8bba-809ad39125b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316823, "uuid": "c2526ca1-b866-43b1-bd24-5834d450ea28", "value": "aed0d2debb077e84fb10fce79e0bdd1aa2b1d85163f0bfeb4c7c345a649e61c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd898438-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316376, "uuid": "365cde99-efed-440e-8357-bd7004ea9959", "comment": "Malware payload (Dridex)", "value": "f2fc7948903664349bc6af251bdc7415", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316376, "uuid": "cb2a667d-86de-4c4e-9a1b-78e39142f57b", "comment": "Malware payload (Dridex)", "value": "af7340f3e7a1e041e4988e415a7063f3a41d94b43bf483e432bc01f259ac5cb4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316376, "uuid": "cab057bc-aaaa-495e-b838-e3b85168ee3b", "comment": "Malware payload (Dridex)", "value": "65e67fdd8e1535788683c7b7d6cf5dec84a02ffa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316376, "uuid": "5fe8b6fc-0b59-414c-a43b-99e160968940", "comment": "Malware payload (Dridex)", "value": "e62f876de1289651146613b49facf6dfda80ddce48e92546c59f2a22bf884842523c3bdf9f7bf4123a9eedcca36d6854", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316376, "uuid": "fd79749d-ffa7-4503-8b8a-24831c290610", "value": "T1C4D5E020EF69E1E6C6B89F3E9448352327B93D75110D618CC392604F5EF82546E3F9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316376, "uuid": "8dc41276-3229-472b-bb59-4f36fb824792", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316376, "uuid": "d63b06cc-3117-4cea-bfeb-fbac1e64331b", "value": "12288:5VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:4fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316376, "uuid": "b4fe9868-cf12-4f2d-b0cd-c557faba2dcf", "value": 2854912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316376, "uuid": "96cf6345-4e23-4f40-81c4-132971639259", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316376, "uuid": "e9b7dd03-ea26-4b16-8549-9ce6081bce7e", "value": "af7340f3e7a1e041e4988e415a7063f3a41d94b43bf483e432bc01f259ac5cb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1634458d-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632316498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316498, "uuid": "afa78568-8ad6-48ed-bbce-5229eb709bb9", "comment": "Malware payload (Mirai)", "value": "f81e27eec4710ef2a120c0ef0e7d4ebb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316498, "uuid": "ff49757f-ad62-4974-b695-3f99ef25c163", "comment": "Malware payload (Mirai)", "value": "af96c5c34c5c475e0803d48a18417a5eea57ced799ec5de9d1cbc4da9e326c41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316498, "uuid": "8581c896-19a8-44a0-bdd6-b69890e082d8", "comment": "Malware payload (Mirai)", "value": "390121eeb84c1a8257da0e85078ad1408f4c1856", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316498, "uuid": "3adf2819-04a5-4342-bf4a-0057c472e749", "comment": "Malware payload (Mirai)", "value": "38737ae7142fff47e9562541bf84bb2c5c20a36e5e1ecf945abd8b63d0fbb742649f0d1b1039ca362313ca4427ed81df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316498, "uuid": "8d13004c-1c45-4318-a17d-24e3d8f85d11", "value": "T1CAE31930D4504B17C2D213FAA69E825E3F221FA793D733115B38BAB41FE279E1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316498, "uuid": "562ba42c-70b3-4c68-9e57-45bd1c4edc82", "value": "3072:Z41HOuaGVV3NfHUOjqylmqCw3jkmhxQwoVZUNu:Ze3aGVVdqylmq1jkmhxQwoVZUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316498, "uuid": "0f8ce45f-e9af-4de6-8034-5cc39bfb39b5", "value": 143044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316498, "uuid": "85d40310-8805-4e87-8850-d932237d49f1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316498, "uuid": "542ee34b-50f7-4063-bea7-2ee84b945f03", "value": "f81e27eec4710ef2a120c0ef0e7d4ebb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9933f7-1be9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632345124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345124, "uuid": "e9bca794-f359-4a4b-89bd-733cc7c187c4", "comment": "Malware payload", "value": "7bce08f896cada78f14d1887e2939eff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345124, "uuid": "135a43d2-2387-4cc4-a595-aa21459ae6ea", "comment": "Malware payload", "value": "b0b5eb6cf25295661e6b494a76122006ba767e76989e92037f21664ef75b7fe7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345124, "uuid": "f6f65dc9-e64f-4cf2-ae7a-5b6bc3dd438c", "comment": "Malware payload", "value": "07b739f0080ed1affdaa742559061c8f7fcd5e82", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345124, "uuid": "4851b332-74b4-444a-8cc5-1bbff4253e05", "comment": "Malware payload", "value": "5a0cf19094fd4a3d70ec5a21af91f3be7730e30b4d8c87fc7ce0f7300667420835b24381167a7a177290728444684315", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632345124, "uuid": "c6d743e7-1cd6-43c7-bbc1-d760fd3587f1", "value": "T10255332DF4B16A38F4675EEAC05AF486B58C91041A5FF671B3E0141AE33B774B801E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632345124, "uuid": "0b462217-2f06-4772-831b-289d205cbac6", "value": "24576:3H/B7VEvmOWWSe0SbH5yrpdSo+QZ9OVrYCBpEBmgnpmlbf2R//uOOYM0+YAD5o:3H/B7ImOWWSe4CoTZAVrpMabuRn/5MlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632345124, "uuid": "544506f2-dff8-489a-82fc-cb615e2ccc5b", "value": 1341294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632345124, "uuid": "94fbc98a-b1b7-4c52-b3f2-b6ebf5e3d1fb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632345124, "uuid": "226f6539-57ed-4787-bb38-ebdf4762281b", "value": "\u300a\u798f\u5229\u3001\u798f\u5229\u300b\u5bb6\u4e2d\u6444\u50cf\u5934\u5077\u62cd\uff0c\u5168\u662f\u7cbe\u534e\uff08\u767e\u5206\u767e\u771f\u5b9e\uff09.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df66685-1ba1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632313934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313934, "uuid": "3ba2e9d7-a351-4937-b9b2-98dedb8765c9", "comment": "Malware payload (NanoCore)", "value": "957f11a259a6d53e90c0824d8004adb2", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313934, "uuid": "ca4cf4c2-2f99-468b-ba19-dd472f324251", "comment": "Malware payload (NanoCore)", "value": "b1399190b64b6b6b474fa4870714d8e20ac2366cafcfb76cf1d3c186aaecc444", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313934, "uuid": "a60e197c-8106-4663-b2b2-295d1b01779e", "comment": "Malware payload (NanoCore)", "value": "b4b36232d53729e34aea7afea8705cb3edaa09d2", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632313934, "uuid": "1a8d4f53-0893-443f-9d6a-34b483a5e014", "comment": "Malware payload (NanoCore)", "value": "2a16dbc2f9c16ede7039e70870100499363880847684f6b9ee57b7404df9789689386780328d346ffab4613d02c0f07a", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313934, "uuid": "8df2eec3-89e2-49b8-9b25-34243849a469", "value": "T128F1003CE60376DD741D5E2D09CB77295A10C0B5C953E6F9C740FAAC69EEB40AB51238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313934, "uuid": "f79e8ab1-9dda-4844-9329-d8b9d6003cb2", "value": "96:PtLNTJhS9INIKMVGQRX8+HLz9spiINIVIWjnCQRX8Lnaa:PtLNT2INIRRX8+Hm4INIVI8xRXAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632313934, "uuid": "60ebd535-d225-4f26-abeb-24c21f35016d", "value": 7752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632313934, "uuid": "2cb793fa-6bc0-480d-ad6e-8922237c7f25", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632313934, "uuid": "59001874-eaf9-42aa-9138-598df61b2d80", "value": "34-Items-Receipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099b0f00-1b50-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632279111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632279111, "uuid": "3248d5dc-46d7-484b-ae8f-78faa9857758", "comment": "Malware payload (AgentTesla)", "value": "b3fb5954b11ce022692f3800c5729a19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632279111, "uuid": "210c3417-5959-4ad2-8a28-c96a0cd77dcc", "comment": "Malware payload (AgentTesla)", "value": "b14ef445aecdf2b82c360d663dd134dd9998a4f939bdfbf316e5f1d42aa12d0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632279111, "uuid": "c377c004-5330-4733-8fce-31162f0ff3a6", "comment": "Malware payload (AgentTesla)", "value": "13dc61e06b4a6b7c34626df48a82543ce30de16f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632279111, "uuid": "0815503c-2a5e-4726-9a8d-7febce25c69d", "comment": "Malware payload (AgentTesla)", "value": "370de2c9c29c010caff13aa3e35f64792d0270a09c1c121a1835312c1c8a53f4b608233eb01e5df052fa25eb35b02b8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632279111, "uuid": "1e0ad807-5a7a-4f6d-8e93-7fcd30454ad8", "value": "T1DC949E325603BDE3DA2A0C7BD70329CC0C5D5D6B525043B8B688358A91B74D4EDFABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632279111, "uuid": "1bd71474-108f-4d91-a453-6edd494ef37d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632279111, "uuid": "d7d3305a-f7de-4d63-9bd4-8f58bd81c06c", "value": "12288:HYNmm6ReaAI7X++D+QEbREo//X12fI0T4ee:M7yEbREo//SI0T3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632279111, "uuid": "6104a4d4-a66b-47c5-8ef5-ce4cdc5caccf", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632279111, "uuid": "cb59c082-07f2-402f-bccf-3f0fd4752740", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632279111, "uuid": "e1cf8d89-77a4-4792-83f4-ecf93da78ee2", "value": "DHL STATEMENT OF ACCOUNT - 3300315209_PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dac021f-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632316511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316511, "uuid": "75fe619d-d085-40d1-81db-79885aa1d705", "comment": "Malware payload (Mirai)", "value": "8e5e03da721f4ddba42d49d158bee31b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316511, "uuid": "334a7fbd-cad3-4ac0-bf43-50a8fbedb629", "comment": "Malware payload (Mirai)", "value": "b3481713f556b3d068ac26bcd8369f92382003007ab51acb364c08e71db59cdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316511, "uuid": "0310611f-b855-45b3-bc06-7cb071614c13", "comment": "Malware payload (Mirai)", "value": "b0cbfa81b1a263fecb1615f2696cffffd4994e01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316511, "uuid": "fd0cf125-8921-4084-aad2-e16d1dd24826", "comment": "Malware payload (Mirai)", "value": "2e56715d539a108bb6dfa7a220fe0f0699f11dc0c44c342f6ede0219138d3b9abb25d83879c7d5a7edf7c5169d71a864", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316511, "uuid": "05e82be9-c3d2-4c40-af64-b960a3031b7d", "value": "T1C0B32B37A61C0B43C49B55F02CB77BF24F69AEA312A611C4A309FED04B73AB12551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316511, "uuid": "4a050ffb-35e8-43f8-9cd8-00881d3612be", "value": "3072:Uvc29uyIcxE/sZxw+OqaKZmm/QcuLmH26PNb:Uvl9jIg4sZxjOj4mm/QcuLmH26PNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316511, "uuid": "b9cd4b4c-7314-408e-b74e-bbbc0e84f205", "value": 117027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316511, "uuid": "b2d4cc1a-99f1-4365-8eaf-08a075995ff2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316511, "uuid": "3940a2f8-6e46-4127-8399-48609dc67f3b", "value": "8e5e03da721f4ddba42d49d158bee31b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb0c48c-1b82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632300942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300942, "uuid": "ef36706d-347d-400e-94f4-ca4544882d3e", "comment": "Malware payload (AgentTesla)", "value": "b031bd1863655406704dea3e1079565c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300942, "uuid": "d138620f-05db-4ee8-935d-061f93e715d7", "comment": "Malware payload (AgentTesla)", "value": "b35f60ee6c89a330e2c78c5bc2180449bc82e5833351bae6279589425e7b613f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300942, "uuid": "06a3f6c4-036e-4701-a8df-a4a3c57e18de", "comment": "Malware payload (AgentTesla)", "value": "86cf691c8c9551c4f05edda9e58a52060e7d1767", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300942, "uuid": "7aa6d620-6915-40df-a4d3-7b85d5c93bac", "comment": "Malware payload (AgentTesla)", "value": "af686db6d06e33b39af51644003491b2b1e039fe3d9d2b4c9728b9a6dc5b5fb0944aeeaafa2c0f8d55d9054652387752", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300942, "uuid": "230bdd13-c0c3-4a37-99da-753ef2c5498b", "value": "T1290527394D2682F747EEC66CD48C1BCEDEA6A4837B919F1AC496D7C2025B70FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300942, "uuid": "84f726f0-aa5b-4397-b633-5073ed927b96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300942, "uuid": "c6e36a23-b017-434d-8d1b-8aab7f26d8a8", "value": "6144:i7a9TMdworE8eBQzGvN+NQpbfK3Nc6T6ma4WVFtcrxHZVu:i7eMEnBUN6pK3N4ma4WBSxru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632300942, "uuid": "3e5966a9-d301-4f98-a232-f2b37bfde58f", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632300942, "uuid": "38f5b5f1-3b60-487e-9ddb-d3a9c626bf3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300942, "uuid": "201c0dc2-b6d4-45af-92cb-20b6516801c4", "value": "\u0441\u043a\u0435\u043d\u0438\u0440\u0430\u043d\u0443 \u043a\u043e\u043f\u0438\u0458\u0443_000022993722055_22_09_2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d03caa-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Troldesh)", "timestamp": 1632316741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316741, "uuid": "c4c0c556-33da-4196-86de-dbf3f2abafb2", "comment": "Malware payload (Troldesh)", "value": "26779fa8cd4f12d20016c6d4ad98d9d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316741, "uuid": "8659cb82-4be5-43f4-b8ba-3ec8512c9ea7", "comment": "Malware payload (Troldesh)", "value": "b370a4f93fb6e655f131329f027615c6828cdfc7002d7b0692f5d28e952c2194", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316741, "uuid": "8eebd04d-7295-42f6-b530-b4ff129f9eb4", "comment": "Malware payload (Troldesh)", "value": "e41e5770389271ce47abed638217822ffb796b6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316741, "uuid": "37ef4cf1-13de-4888-96b5-fe0074801b9e", "comment": "Malware payload (Troldesh)", "value": "e154e60b7d2653cee5783034e2f0090f5a88036e762f0cc0b140c5f8eb35f408507f3894cad1a0e1fe5efaaa6ab8fdb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316741, "uuid": "58d03ad9-ca32-4518-8991-52dded96a26b", "value": "T11045334A3D27A21FF49BCC70D663A92BDBF1BE22972829183DC0FB59C5637C08855497", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316741, "uuid": "e3310cbd-9915-4aa5-8f9e-c0bca6e4a8ff", "value": "fa2d21c960425e9ec6378d6769bb3c1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316741, "uuid": "7041d0a3-9635-4ffe-9177-36f7909a8660", "value": "24576:0HtrdKYVVSrqGDohJ3STZG8vIn/sCBGnWsY03+M:0HtV7GwBSTc8An/4YJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316741, "uuid": "d5e803d6-7bd0-4300-b580-15ddc9ad7134", "value": 1186061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316741, "uuid": "4d74b34c-7340-412a-9ba0-1db32b918f6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316741, "uuid": "8d3ce4e5-958a-44e7-accf-fb77b23ae059", "value": "b370a4f93fb6e655f131329f027615c6828cdfc7002d7b0692f5d28e952c2194", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff28489b-1bb3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632322043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322043, "uuid": "f856c6a0-26ef-4a70-bd47-1fa58f5bb92c", "comment": "Malware payload (AveMariaRAT)", "value": "0775f63b4f86792829cc25569c911e00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322043, "uuid": "5962c9fb-5753-4759-a6c2-516fd48197a9", "comment": "Malware payload (AveMariaRAT)", "value": "b3ee51fa4b40aa36a221f4bdd554dd3b0557185a6f9e8a4d45823431d734c839", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322043, "uuid": "04fc9f81-4d95-47cd-8499-9f4bd0b9c0f8", "comment": "Malware payload (AveMariaRAT)", "value": "011bf502a6111e0ab99cc96aebac65463aee92ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322043, "uuid": "27991764-71cb-4aba-a8b6-9ccf61ff6e61", "comment": "Malware payload (AveMariaRAT)", "value": "198893a7ed064f9435e2f2b970aceed892a196c59320f0df6a8c85af66c54373be2a86fbda795f231d244796337d89f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322043, "uuid": "ad565e44-1982-4828-b7b0-54414ac53f35", "value": "T1D7A41238C3599375CA6EC7BF202710460BB2A2DAB613EA5FAF46B0CD7E4E3540424D36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322043, "uuid": "3870cda3-a46c-483b-bebf-e975fb968ec8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322043, "uuid": "cc35532d-5aa4-43df-b9a8-f211baa19989", "value": "12288:A5GJemtiK5oBuV/Pmd//rWRFszGuSjHz3XHhCxHi:4+FoBuV/PG//rIKrSjHzHHcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632322043, "uuid": "2c2caf0a-f83c-495b-91b2-c1454e3b90b6", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632322043, "uuid": "7ec13439-a9c1-4ca2-a352-136c4e690eb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322043, "uuid": "575e8665-719f-4efb-9eec-0ba40912a23c", "value": "0775f63b4f86792829cc25569c911e00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6320c1e-1b6c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632291507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291507, "uuid": "8c6b3004-f20e-4171-81cc-0de7c850c83b", "comment": "Malware payload (Formbook)", "value": "98ae4a3128ce5c191dfd2eb895b25dcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291507, "uuid": "c78da682-3235-4d9f-b32d-39ee4e5adbee", "comment": "Malware payload (Formbook)", "value": "b438197380888791997705ce5dfb8eadc354f559f9ec8f00629c9ef56b7589d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291507, "uuid": "7c1a4fe0-ae3b-48bf-b20a-87f3a0ac94e0", "comment": "Malware payload (Formbook)", "value": "598bc90f91954545d1e9d1ad93e85ae070eb9daa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291507, "uuid": "1176eb6e-1d20-4260-8fcb-ee31a61179e0", "comment": "Malware payload (Formbook)", "value": "d219657c559b57c23da9359ea0f826149b421a78e383b6d04357960bb8766888a94f19d46b6441f6f95ca262a0d41338", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291507, "uuid": "5c77895b-3d7e-4c9a-92ee-eaaf81b5cc3e", "value": "T113B4223DC77CA735C969D7BF1021860A0BB192C97B13FB6D6F57B0C87906B8051298EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291507, "uuid": "93e7f87c-87f4-4ba3-a04a-1ba7982ac560", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291507, "uuid": "c944c08b-2c7e-4cc8-b695-e5e23818c69c", "value": "12288:/lQWmtiK5oBNQ5bxPmHufp8Mec6tzPnxBdw7e:3+FoBobme8Mec6V5oK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291507, "uuid": "f01541aa-a110-4a84-ba81-af44e797b496", "value": 519680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291507, "uuid": "196d00bb-a6a2-4324-bda2-b8069c83aa3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291507, "uuid": "efc90619-c36e-41d8-b7c2-7d51cf8a6ab6", "value": "98ae4a3128ce5c191dfd2eb895b25dcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3023ebfe-1bb7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632323414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323414, "uuid": "341daf8b-fffb-4e60-86d0-fd2673926887", "comment": "Malware payload", "value": "79dbf0cb4518f97174ee4535672a0a60", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323414, "uuid": "56ef51ec-ef92-4d85-8ab6-b3f55bfd4082", "comment": "Malware payload", "value": "b61d1249505ff6814c04662bba102938cda38a0062bd78e11839d24cead1f577", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323414, "uuid": "02aa8c74-3306-429f-a382-ef0019e7c80a", "comment": "Malware payload", "value": "5dd9de078a0945c39431df3bcb44151637331353", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323414, "uuid": "1bd19d13-e121-4186-b9ce-f908d912b474", "comment": "Malware payload", "value": "84d8f7031162cb40a38d44f3f1ae400780acfd9ab34270469eb8fbfdb0aaef65463da5076e1d38830127cd823b57de16", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632323414, "uuid": "b2c2ece3-3c73-4d16-9809-2946e930ab43", "value": "T146541240737BE3DBD41348B25DB0B93B8674EF608A2D8248F470799AC4FEADB5195A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632323414, "uuid": "3f10ab1e-b097-4ffe-bd77-768b4201aaf0", "value": "6144:gOaTsrU5e9P9029wgPg2UnRDTtflxv46HmZ0Q/VaPUp2yhbA6Y18:gOysrp93NY2YL7v46GLKUp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632323414, "uuid": "e8b795d1-b1e6-4ef4-adfd-15101a3253eb", "value": 297912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632323414, "uuid": "4b2d09f9-8736-45ea-876b-54300751f70f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632323414, "uuid": "ae2a2c0f-a2bf-46b9-a65e-4f9d2c870b81", "value": "Purchase Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285019fb-1b96-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632309227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632309227, "uuid": "b828f662-c98a-4c02-8f5a-49c2e2e3857c", "comment": "Malware payload", "value": "fc43992af346b87d1729132e5e7a30d5", "object_relation": "md5", "Tag": [ { "name": "invert", "colour": "#828C18", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632309227, "uuid": "5042ace4-d5cd-4719-85b5-2042233b3041", "comment": "Malware payload", "value": "b6a1c0b37874321ac0928e3dd5f4a2a1cc1d2233ecf226c9d6e5991e8f49c828", "object_relation": "sha256", "Tag": [ { "name": "invert", "colour": "#828C18", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632309227, "uuid": "4dea7a14-6ef3-4340-9ba2-c2d719391ef9", "comment": "Malware payload", "value": "74de5c38c088f888314d6c0d66540884406d3a7f", "object_relation": "sha1", "Tag": [ { "name": "invert", "colour": "#828C18", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632309227, "uuid": "a6a43f99-9d9d-443a-911e-2586fc6b758a", "comment": "Malware payload", "value": "564a18d4f385eadac49de8273be1688255062ab2683a08b9c012e7e1bc97b90d2575a6322fce87cf4c5bcd65b7b13bd5", "object_relation": "sha3-384", "Tag": [ { "name": "invert", "colour": "#828C18", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632309227, "uuid": "ce44318c-442e-4ec2-ac5e-dbfba03e0015", "value": "T13562D0014B2C49A18FD3CD6E4FBBC06959E014E27B6EC7C78E9E2A7B6C6499813471A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632309227, "uuid": "2929aed7-2ae6-4dc7-bb88-d870e747415a", "value": "384:csRrAxrkVpgrpq4FaL1Hh3RIj4yiwcloq1X0r+KFHYhm6:cO0xrkV+I3L3qj4rP1kr+KFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632309227, "uuid": "058c161a-2bb5-421d-88ba-86c34a2d1541", "value": 15483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632309227, "uuid": "b2302b5c-b5cf-4221-bad1-845b6f9c3589", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632309227, "uuid": "e168ec6c-b765-436b-bead-6e273c6660f9", "value": "inverted.bin.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195aa33c-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316504, "uuid": "95adcdac-09b9-4b2e-8e70-7aefcc1277b1", "comment": "Malware payload (Dridex)", "value": "abc231dd40c40fc22ddc7a14c8080c02", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316504, "uuid": "be396a16-6bc5-4c09-b883-91e08296e1b1", "comment": "Malware payload (Dridex)", "value": "b7e01c050e0ae409438d0dbc011b6c4be01df64f09940e0796b60844f165ed21", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316504, "uuid": "032c0090-71ad-4d43-99c0-d3eab789b076", "comment": "Malware payload (Dridex)", "value": "8832825c05727ba4468bd5f3745fd0c6693f6a10", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316504, "uuid": "db7c27c0-a408-4325-81cf-b6287714753b", "comment": "Malware payload (Dridex)", "value": "8d8be65a8c0fdba0899b9fbcc05444575937afd3e690bfc14a54e85948c960f8c3a0fddc81d901bed8c55e0efcc1c315", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316504, "uuid": "c67df802-e723-48c0-b607-e9083da80219", "value": "T1D9B5D020EF69E1E6C6B89F3ED408352727B93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316504, "uuid": "d6227dd8-a505-4e82-967d-bcc09771fa27", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316504, "uuid": "26f173a7-c697-461e-a593-2cdf5848bf42", "value": "12288:7VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1O:afP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316504, "uuid": "d45c6644-0704-408e-aca2-be9924ce5b1b", "value": 2293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316504, "uuid": "70db6ad6-35ed-4da2-a5ed-6397b9459c07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316504, "uuid": "0765ab67-51ad-45e1-a11a-1d01b088ef7a", "value": "b7e01c050e0ae409438d0dbc011b6c4be01df64f09940e0796b60844f165ed21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4543ec-1bb9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632324486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324486, "uuid": "cddaf69b-eb63-45b4-8846-c8da9fc6b378", "comment": "Malware payload (GuLoader)", "value": "21cb48c40e1e6cbadebc561789780361", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324486, "uuid": "62b430a9-ee8f-4441-8ecc-3b6e236da00c", "comment": "Malware payload (GuLoader)", "value": "b87dc35e508dea53111dc95aa27d424c50dfe5ab3061792cd0a621ce1d72ddb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324486, "uuid": "b38c45b7-85a5-427c-b366-26a99d2d1572", "comment": "Malware payload (GuLoader)", "value": "9f210b02f6eb12df55d5ca690af3c89393b9d7e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324486, "uuid": "7a171d9f-2d4a-4d05-87fa-d8929150dd65", "comment": "Malware payload (GuLoader)", "value": "d8f6a5f7007765783e0a07cec748c1504c30d820d211a66835d4de708409b05a8e1fa56c342014b94e09300ea90bf88e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324486, "uuid": "28c7734a-c7ac-4a39-b74c-36110d6380dc", "value": "T154A39C317F8FED67D4C86AB1C85EA7F03664EC19F9070A532E1ABEE73970D144992224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324486, "uuid": "106892dc-fe8e-4ebd-9ac5-c23e25e62430", "value": "4b82967fdfc14d4519122dc367d279d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324486, "uuid": "b89fb022-3a9b-4585-a481-d7581ef37116", "value": "768:whN9uTgBRa8Xa0o5mbjr0r5LCBIMyNFlBd8RlEPbkQPLHglkJz+NSU9qaio0sC8h:qfM8gmL0d7MyNFlBd8RlEJ4ZA1ZuzH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632324486, "uuid": "7001af23-d429-41a2-8d78-377b7691621e", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632324486, "uuid": "c3c7d1a1-4d6c-4cf7-9883-2a300cd071d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324486, "uuid": "6e940383-ef78-4475-b786-1ebb8f7b1729", "value": "ARCH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90bf021f-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632317133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317133, "uuid": "8e0cda90-ded4-4eef-8556-51f30d858b87", "comment": "Malware payload (Gafgyt)", "value": "b8c5b6967f1e7124cb32868031ac9151", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317133, "uuid": "f89c93a9-b6a7-4355-a4e6-b1ba188b2ff1", "comment": "Malware payload (Gafgyt)", "value": "b8af1b7a27b44a8056987f38b82b38764cad2554dc84975295cdeb1cd76640f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317133, "uuid": "e332f91d-5ddc-468d-baff-a589de9f31d3", "comment": "Malware payload (Gafgyt)", "value": "d93e797a8b990e54481f5c1e2e0cf453c6423f06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317133, "uuid": "4ccd5533-b154-4dae-b728-1a5a8ce355d7", "comment": "Malware payload (Gafgyt)", "value": "76a80d77f39ff1237200ba81a3515c335df13cf9b3d344221a701d95d7fadf43ca208d94f4a3d563b05bad49b51b9e79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317133, "uuid": "110a0bcd-06c3-4f6d-bc6f-cc2c207c0ecc", "value": "T1B1B3C517AB618FB7C85FCE3306AA450120CEE15A12E96B6FB274D96CE74B94F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317133, "uuid": "3ce2f7a4-e426-4eb4-bb96-dd0ca3d66577", "value": "1536:yLeTsNZMo1HPM6vXfZscjIYzIIY4gyOF9f0XIIFUmkiSFxfC7xbXe:yTPxvXfJtY406XIIFUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317133, "uuid": "e7039ff4-85d8-4b84-aed9-38fd52534e44", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317133, "uuid": "5b19b5d4-cb16-42c6-ae39-09388d25cd3a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317133, "uuid": "8a9e7a4f-1921-458c-ad45-9537154bca7f", "value": "b8c5b6967f1e7124cb32868031ac9151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bda300f-1b69-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632290094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290094, "uuid": "944293ba-396f-4f90-8129-5140f8ea33f6", "comment": "Malware payload (Formbook)", "value": "6f74e34ecd92395aefc707edf4119d71", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290094, "uuid": "02444ba4-d46e-4cea-a9e8-ff5142d96ff5", "comment": "Malware payload (Formbook)", "value": "b8b54b232ca4f2ee4362d0d66218e77fbd950922221ab00676d43877904e249b", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290094, "uuid": "b29f7e2d-e76c-4d19-92b8-1105a118a007", "comment": "Malware payload (Formbook)", "value": "1d549f12ccf0fa9a429592795ee2c0e103534b91", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290094, "uuid": "cadaec28-b317-4703-b1f4-f4b41de3fb90", "comment": "Malware payload (Formbook)", "value": "4b875b9f136615b734fe45c9beea42a06320ca5f5ddd212f647981bd39b1c3a649bb8d28a5b485c74fc7f5662adedfe2", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290094, "uuid": "98c894c6-ebc7-4669-b46f-27d63a06c78e", "value": "T1E3355BE7B794CCE1EC30397DCC02B6942615BBFA34034D08ED647E8A97A9A41B97D44B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290094, "uuid": "659d805e-30f4-4229-b736-6e915905a0bc", "value": "bc8cc1eea5c25ce2056d7da92bd98134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290094, "uuid": "08c14b3b-ab9c-404f-a979-8bc4ff7c1311", "value": "12288:lIspEfnP8N/seflQTshT8aqeTW39KqieoAdrL7SUbDz5Zp:320N/seflZhTmiW3AmrPzz5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632290094, "uuid": "f0a84ce4-8a98-4241-8a4d-029132740dab", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632290094, "uuid": "1714275e-8981-46da-9741-2c5d76a2a00d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290094, "uuid": "d2899b6a-eb6b-4c59-8d22-cb7e094d8996", "value": "enumerar muestras de productos pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f45b15-1b8a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632304011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304011, "uuid": "3d84afca-d226-4dd9-a00d-49953f95c94e", "comment": "Malware payload (AgentTesla)", "value": "b497845beb135740e6caed03a2020036", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304011, "uuid": "ad3c4f09-9aa3-46f1-bcf4-5cf6a2d91d05", "comment": "Malware payload (AgentTesla)", "value": "b8cedd1bd5a691fdc182d4a4b4d7bbf1147b1f9d2badf87d13c51428ffd5a279", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304011, "uuid": "bd89eaa6-3d37-450f-aa35-09222a28690c", "comment": "Malware payload (AgentTesla)", "value": "434e99f70ed525db5cf76f6be5bbe28aaa2a62e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304011, "uuid": "90ccf1c0-6119-4291-9785-8ccc8b6c87b6", "comment": "Malware payload (AgentTesla)", "value": "761f6ef454344dc631184aef2c2401e83f1546044b3ae9c0b71915b9ceb9d4c221f3160db75ac665973e11a6aebde019", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632304011, "uuid": "0b048216-7d1a-48e5-af06-2b7212bd33a4", "value": "T14BC41235A77CE7B8CB9CCFFF2161110A0FF1E1863A53D61A5F82B08B6D497815829876", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632304011, "uuid": "0e919862-bf93-4a95-810f-ede8aa25c459", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632304011, "uuid": "492c69b6-f49d-4a3e-a24e-3c89af57688d", "value": "12288:AUhNmtiK5oBisEfAMSwb2nxDGVA/TRjYb4HkmXOMSPQORNf03:r+FoB4fAMh2nxigJetSOMSPQOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632304011, "uuid": "b564224e-7f7e-45a9-9b1f-ce9609eac833", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632304011, "uuid": "d9979bf6-15a8-4042-891b-3868fdb1d00d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632304011, "uuid": "66de6fb0-733e-4eb7-8711-a5517e835030", "value": "b497845beb135740e6caed03a2020036", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1521c5-1b85-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632302172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302172, "uuid": "8daa5123-4a41-4473-8c47-d72d6335fb32", "comment": "Malware payload (Loki)", "value": "375f462db74f1d6d629c5db6d9c11354", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302172, "uuid": "82eec3cf-cea7-462e-ad8e-218cfff363c2", "comment": "Malware payload (Loki)", "value": "b8e60e3d3fa7e783c5a27af1f65a9b2aac7cb72774eba7026f9107ec2cafa7aa", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302172, "uuid": "7e1508e5-a449-4097-b419-2cb9a47cc661", "comment": "Malware payload (Loki)", "value": "8557ec2038509938966594dfbeb71c77799531db", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302172, "uuid": "507c0e3e-10ab-4a82-87c6-814eb14984e8", "comment": "Malware payload (Loki)", "value": "72dcc8a47eb699f1a13e82321b718fffe97bc73d16a0b700b22808201850f956ee7415d76cba9c7442bd5690f0984836", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302172, "uuid": "2fff2c6c-4584-415b-9909-5620df090b5c", "value": "T1EEA423F748B62FB35819AFA8DB90CD6FB5E21738B7ED44C84291D92C52C0F761894893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302172, "uuid": "fb414065-8268-4188-8ae1-d73955c9cb06", "value": "12288:Ni0mYuhpChCFdFzx5PqqBPY69RUlKRS7esYNn3:N/mbpCha1x5CIPY69RUy3s+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632302172, "uuid": "07f0008b-aa0d-4470-a2a7-0f486829c287", "value": 471929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632302172, "uuid": "8ff6d271-46e3-4534-8b71-9753a6835830", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302172, "uuid": "189ceead-e9f7-4367-a5ba-58d34b1190ae", "value": "375f462db74f1d6d629c5db6d9c11354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4f43a9-1bcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632333873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333873, "uuid": "87e025cb-63c5-4c81-bbe1-c6ec145be9de", "comment": "Malware payload (AgentTesla)", "value": "4efef80a9df1e5a4d99f7439000b0c7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333873, "uuid": "56864736-47be-4ad5-8d63-48698a6c92ca", "comment": "Malware payload (AgentTesla)", "value": "b8e8f5c8629513ef5ec5162ca8e5e8a7758917c4a457270e1d438c23ba3a3fa0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333873, "uuid": "fb98ce2f-5330-4975-bbe3-e2e2f12987c9", "comment": "Malware payload (AgentTesla)", "value": "fa33e053d2c645a3c88a3d5c9f38ad12459e1c15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333873, "uuid": "d25d79b9-8d2c-4ed8-aad2-a074adad3529", "comment": "Malware payload (AgentTesla)", "value": "fb8ec1539e262107041802735071b7af3d2ec51c942ddeea7cbeabc95e0286a9938e098f0d7e1b362c1e71ace40745ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333873, "uuid": "3de83bec-722c-4000-aa05-8d9b86cff492", "value": "T1D6D4902D7A051E72FF1F893449510B64BBA2BF137280A987A3CB75CB876F1672D05C98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333873, "uuid": "5f186e0d-9d85-464b-9f8d-b51e2f10969b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333873, "uuid": "7da5257d-136f-4573-bca2-e93bf5c08e8d", "value": "12288:5iKnVbpe8bfkdLtqDIZQBpCCE/npuCxpbBK3:5LfkbqXBpCCSnpFK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632333873, "uuid": "0dcd1ef1-18d0-4c3e-a5e7-fad368d2add7", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632333873, "uuid": "034486c4-6aff-45a6-abc3-a247a87355cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333873, "uuid": "93567804-ce0f-4b66-b9d8-987ab5ed7d17", "value": "4efef80a9df1e5a4d99f7439000b0c7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07891731-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632316903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316903, "uuid": "3f6c38f0-0cf2-4fcf-b63e-37216d4dc04e", "comment": "Malware payload", "value": "13cdc8b284b555db6b05fab98a36af0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316903, "uuid": "ea8d9d8b-4358-4256-a2fa-ae54b1811b7b", "comment": "Malware payload", "value": "b98ae614ab79fa8b38eb3b3ec3753cf90e05117a02938b5f085f74a8f41c1e03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316903, "uuid": "58213201-dd82-489d-9443-c20cf1f8fd3f", "comment": "Malware payload", "value": "623ded7362acb205227168c3361af28eb5d1640b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316903, "uuid": "50894bf3-375f-44cd-b6f9-7584d1fbd51f", "comment": "Malware payload", "value": "8b03d564f24baa0c81533c9c6ab320dae6bdf56463fb51dfe0af003413ec77a826d6ac72f9596b7c3a3af02df32c4257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316903, "uuid": "e6ef6819-dfbc-4e61-89d0-72795308464a", "value": "T1EAE4AE1285FA73C7F12270B1515BB8F744D1B8F249D7A861712A3F0DEDB9902AF8B216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316903, "uuid": "8fea058b-f7cb-4f79-9cf5-ff7ed9c40e7f", "value": "514c554c4eccf8b5d18d8453867113c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316903, "uuid": "6c47d087-64fa-451e-ad3b-d2047f47a6f6", "value": "6144:PFKiOzC8VEXAouuoSMSeXVgKEaRIVgraV8wYyjPC2TOjITsE9htl7mc4onhaw/BF:PHkVE/oSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316903, "uuid": "4aab0b70-4175-4f95-b0a5-7e67a1ce50bb", "value": 674448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316903, "uuid": "4d68cb97-07ef-4fcc-85c7-b3d2b29801dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316903, "uuid": "3f57174d-8ddc-464d-ad8d-a1c905edfa5c", "value": "b98ae614ab79fa8b38eb3b3ec3753cf90e05117a02938b5f085f74a8f41c1e03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794ff798-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632316235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316235, "uuid": "a7789627-029e-4510-8176-821b52308d6c", "comment": "Malware payload (Gafgyt)", "value": "6f17be812fd8e2278852939b2c219af5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316235, "uuid": "f500d257-741e-46b6-a09d-b59462437989", "comment": "Malware payload (Gafgyt)", "value": "ba41bab98aa415a2e9591ee430356b39c6a4bb974651a53ec44d4bf5be07851f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316235, "uuid": "90000fbe-d7d4-4814-8e3f-41bcd75b442f", "comment": "Malware payload (Gafgyt)", "value": "c1d33aefb00714ee5c8061b928ee36c7696332a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316235, "uuid": "dba7334c-1da0-43f2-8151-134e218d6ce5", "comment": "Malware payload (Gafgyt)", "value": "5dba07d8ed2b3bdc351ed94a6cdaac4a1e66788da300898db32936ec3f68d0deb169339f35637f52dc1f16c6337bb873", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316235, "uuid": "dae119af-3d43-41fa-8c6b-fcf1db3f0d6a", "value": "T1A1B31845F8408727C3D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316235, "uuid": "d064a015-f99d-46b0-add8-a078e1b15221", "value": "3072:MSY+46m1qOzsseFPPKNy+AmkZrQAhPDCXFke:06mgOzJeFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316235, "uuid": "db2c65ea-a986-4eba-9fea-16eab2d213fb", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316235, "uuid": "3e7868e2-de12-474f-8344-7b2ba6081297", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316235, "uuid": "ae6e7a87-834b-4af7-8b32-3b1852c4366e", "value": "6f17be812fd8e2278852939b2c219af5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c17170-1b99-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632310728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632310728, "uuid": "f1fdf261-fba8-474f-83bf-c99527629ee9", "comment": "Malware payload", "value": "7f7091b565e46dcee2a5f40c26b13b0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632310728, "uuid": "0e7bd638-a8c8-460c-b478-9b3d9c74fac5", "comment": "Malware payload", "value": "ba89594387dfeb48860b9680849784d36276953f694c3acb0d6bf449e9a0f370", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632310728, "uuid": "768510eb-d09b-4085-97f5-14f9c8f02b83", "comment": "Malware payload", "value": "ee5f6ae6f6cca78669b53ac7a225df39156f4919", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632310728, "uuid": "db72d187-0f0f-4224-ad76-3024628d18f0", "comment": "Malware payload", "value": "ac597d47411d89b33ac579044557e8cd0d552097a3c09a7370f33f1a1c3a3996b89c3b6cdc47084a31a0912968976fd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632310728, "uuid": "14344592-3288-43f3-aa11-dd38078a687a", "value": "T12373C5B7016150A6C5492730F8B50F4B3A7CD6341A80B698F04FE6AEDC1D69E9EF83B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632310728, "uuid": "53529f47-1079-4436-a267-4b1af282f052", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632310728, "uuid": "c9397d19-f898-4cfc-b17e-b52588988c2f", "value": "1536:cm8y+T/f3HoXTuU0TbWs0imlE5ckqwO81B85erd8:4rHQTcsa5AwO8n85erd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632310728, "uuid": "07ad7d2f-f2d9-449c-bc74-8e69351131f3", "value": 79864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632310728, "uuid": "14b05183-5db2-4ff0-845b-7df33d71269b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632310728, "uuid": "c42d7a51-0e54-4657-9e39-99df36d697b6", "value": "7f7091b565e46dcee2a5f40c26b13b0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c281983-1bff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632354411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354411, "uuid": "db5205c5-d761-4cf6-ab63-1c612025ef74", "comment": "Malware payload (Mirai)", "value": "cfa213af9ebbb76d5d1da4fc55a987fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354411, "uuid": "58b65b2f-905d-44f7-91e1-66d20c477119", "comment": "Malware payload (Mirai)", "value": "bad5ecfa4c44b3647b96b55754e49302a32017dd9f7b4ccf525febe8c2ef2812", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354411, "uuid": "a16af76b-2be5-4c08-93e7-e9623d9f16e4", "comment": "Malware payload (Mirai)", "value": "2ce7804ec69cdcdeeed843247251b8fe55970501", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354411, "uuid": "eda9ea42-c8c8-4ee0-91fc-42b9aad176b3", "comment": "Malware payload (Mirai)", "value": "8172dd414f88d3b0b7c48d6f86155e05f5b6876cf86110c21aad6bedefc155d50684f17f6446c97e54a70b9f9398ffb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354411, "uuid": "8cad4cbb-cf96-4f5d-aa40-12ac1d47da29", "value": "T167333BC1A743DEF1ED1247B53077EB338B76E47A205AEAC7E3D5A527A841A01920329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354411, "uuid": "dc1ff1e3-7b4e-4e76-bbcc-1b53e4e3d506", "value": "1536:u8OP6OftfvJfrJf0hJeVVMZvZn78MOXmyMVNwYcPnYTbGGgvyU:/OfVxfrJfAJ2VkB4MOXmyMVNwRnYTSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632354411, "uuid": "779551fe-386f-4a3f-a375-0fb688b25a5c", "value": 54032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632354411, "uuid": "637b5006-b543-4fef-b4a6-09377ef5d58c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354411, "uuid": "ff584852-b860-4cc2-8924-5f17b0188035", "value": "cfa213af9ebbb76d5d1da4fc55a987fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9890a715-1b6d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (XpertRAT)", "timestamp": 1632291806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291806, "uuid": "7ea508e2-0c2c-4185-bddf-0029b225ee57", "comment": "Malware payload (XpertRAT)", "value": "49af0abba03a7d559171f378728e9bc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291806, "uuid": "22c9af23-ccc2-4ceb-93d8-9fc198ded902", "comment": "Malware payload (XpertRAT)", "value": "bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291806, "uuid": "aa110fee-1f0b-4c8b-a6e3-7e9ac684a8ce", "comment": "Malware payload (XpertRAT)", "value": "7e6e1ccf693bb62f2a36119996583228a9e5c665", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291806, "uuid": "2a6241bb-b655-487b-b273-089608ce53ea", "comment": "Malware payload (XpertRAT)", "value": "18a1998181bd47ba2f8688a5e7c3bf1d19a8af1c0ab9226e3cb73a7257e81622b00ba26e2226945742e1eec43ed1dd1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291806, "uuid": "3da4c11d-3063-4629-8e1f-cfb8eb89ee21", "value": "T124E23A2A3394E598E4D84A728DD7E9A00AF0BD27A442F76B33C43B1D6F33B86D545385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291806, "uuid": "c02ec403-0929-4cbc-b79f-e95b5afee415", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291806, "uuid": "01c92706-2165-4103-95bb-60a5a0f325db", "value": "384:mpQEJ1SD81FF+rO5+UZjOHbE2qJnPCvCz4bbrZTLA+RofUFKDQckRKDVbJapdKDz:ySgF+rO5BYbEjxP0GOFRfM90PGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291806, "uuid": "a5e8c316-e743-47f3-95be-9feea2dcfc57", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291806, "uuid": "2a92cf64-9883-411f-ab58-6bbd2e06542a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291806, "uuid": "f7785a59-17a3-41f7-a66b-65b960764621", "value": "49af0abba03a7d559171f378728e9bc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba5e6d9-1b69-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632290174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290174, "uuid": "146c2c31-7df6-4c50-839c-092219d7d215", "comment": "Malware payload (AgentTesla)", "value": "2cd003991d71a5cf5bde8b34236d480f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290174, "uuid": "441ccb29-7189-422b-94e9-7878469e5294", "comment": "Malware payload (AgentTesla)", "value": "bd69bb641d8604151fab602e5b38d0b30d2031eece077d7c1fcd30aadbc7f059", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290174, "uuid": "c8d25c46-d1c3-4f85-b13c-7f0fd1db2e27", "comment": "Malware payload (AgentTesla)", "value": "039a3f2365496d9724086cf90429b12e4bdd4e16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290174, "uuid": "33101c43-dbfb-47fa-b881-804ab19b6bde", "comment": "Malware payload (AgentTesla)", "value": "de555f3c999e44d8f3828977ba4a97645c77d5e5610afec24522e390af8ed05881ca95067a62ed09dded9d7def3c0c97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290174, "uuid": "bfb8c168-89a2-497d-8406-af6b6af02be4", "value": "T1209423DAD49D9404223B371FD40B2A580A22444FD570E3A5085EEF6B389F77B4E2BB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290174, "uuid": "968a9db5-7e7c-413c-9fd4-927366e17dc5", "value": "12288:ja0iZmFA4f8m8sZUnfRgJw6njfigrLwoxU1:O/Zmu45dZYfRYw6n7Xxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632290174, "uuid": "ced5e126-3204-4cf7-86e2-b0cd097e91f1", "value": 440471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632290174, "uuid": "25334454-692e-4181-a8b1-50467a15ccec", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290174, "uuid": "9a1f99e1-a01a-4df2-bfc3-4697b8ff200c", "value": "00987654345678.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2261dbf-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1632334342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334342, "uuid": "264e75bc-1a83-419d-bd1c-f85ff19dfe24", "comment": "Malware payload (TrickBot)", "value": "ed30160772181f91ee15126bfb0756ab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334342, "uuid": "36ee9534-9b77-4e47-b6e5-cc85fac503cd", "comment": "Malware payload (TrickBot)", "value": "bdce492e4d57278c61292d96fc20f8de5d9649cc2acc243b89243204d183be1f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334342, "uuid": "e67ed9bb-d10a-4e7c-9c5d-6e904ec8241c", "comment": "Malware payload (TrickBot)", "value": "8cd435cf4c5b446e5ff5e72a56e0569da3a0d4ef", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334342, "uuid": "68cd019b-54fc-4c1f-bb15-6edf86adde31", "comment": "Malware payload (TrickBot)", "value": "5be25ebab0c2a300402c38cce44cf383738fcfd137a7134ea9b8279d1bcb8678f29d50faab7be9a7eda7df002b109909", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334342, "uuid": "0fe190ed-e837-403f-a050-278d5dabbca0", "value": "T18AB4CF42B2C0C076E27F537149775B5A26AEFD248BF1A94BB744BE3D0F35291852EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334342, "uuid": "d3f8e67f-ae02-4423-8adc-264d3c3ffc94", "value": "5c9a9773c96ef9c47915be337e1489a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334342, "uuid": "a3a6c921-597b-40cb-85de-e57bcd295b37", "value": "6144:tIl3f5on8R0CBtsabvbA0iRugpw8mI3R5y4MAIJ+CczfBsx2X/HSpu9SiWaKMVe1:tk32q0CB5qwq6cBsxsPUmYa1B3js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334342, "uuid": "56a0ab98-eec6-4f07-bf8e-0ed7efcc008e", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334342, "uuid": "4ba1e0a6-e110-4ae5-8b0f-cd97736469ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334342, "uuid": "3de8c018-e339-46c1-a970-9fb9e38d2831", "value": "ed30160772181f91ee15126bfb0756ab.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980cce43-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632312421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312421, "uuid": "d32574d8-d9f8-4bf0-a7e8-9a7c4243d664", "comment": "Malware payload (Formbook)", "value": "638a39fe9369993ba6c3f89173c9cc91", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312421, "uuid": "d23fa0b1-d0b1-4397-9e61-6d1fb41241d9", "comment": "Malware payload (Formbook)", "value": "bde0c0b595c74cfc7aede33f4acbe9c6dff337acad2aee51e9c7a76f81a951fa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312421, "uuid": "cf47a73c-df1e-4a7c-9a03-5a2700d220e0", "comment": "Malware payload (Formbook)", "value": "d4bb019344d7c9fbcc183ba8b611386c689ffc71", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312421, "uuid": "f28d9b5a-1c7f-4822-b2ef-f7e4736983cc", "comment": "Malware payload (Formbook)", "value": "13e469d95e665510706f0368202a4919c2fa8d9ff02e43ed9006442bb325606b50e782a896d1a21797f97f7b1066fea6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312421, "uuid": "4cdfbe81-bfca-49d0-9d65-7e294405ca07", "value": "T17FD423965C84242BA2E41E45DDDAF70DB9E533FD656217ABE42B28102C87DFBD007AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312421, "uuid": "abbd03a2-1036-47b7-be61-061c8fbbce37", "value": "12288:rjRobpcUwgVGzWFynq8JoL+Exz4B5fbE7WaZ7xoKPW4TP20G7t4phSb8F8Oa:H6pcUVV8u8Jy4nEK6P87tu0SO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312421, "uuid": "e914d825-d7bb-4c03-8523-5063de281555", "value": 598888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312421, "uuid": "b8532850-088b-4112-96b1-e9e715e5542e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312421, "uuid": "1ab2f46a-9b0f-435c-b5c0-aa33a5bcae15", "value": "payment.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d50c3b-1bae-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632319714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319714, "uuid": "6e2a3e44-9550-4061-9033-b86dd8ac800e", "comment": "Malware payload (SnakeKeylogger)", "value": "1924442f3033e5cd26373c664cd28b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319714, "uuid": "7df8e92e-b97e-491a-896f-e95d1428862a", "comment": "Malware payload (SnakeKeylogger)", "value": "be05b0a48cebe8cecc162d34f7385e18d83fea1fa356e2121194e39e78a9bf97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319714, "uuid": "dcd47ea9-c8a6-4b45-95c4-008b1c74de42", "comment": "Malware payload (SnakeKeylogger)", "value": "b978260a356d3fdedcd0ce580e751563c637786e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319714, "uuid": "f06e2948-e9f2-4b6f-8741-e2e4e767c4db", "comment": "Malware payload (SnakeKeylogger)", "value": "f85af8edbad382d2ff2b8e8d977e80f6f3e0b9a5093fa80b003273070c1d4cafb03b375a7663e0f6b4a230fe877edf10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319714, "uuid": "bc30290e-c43a-4f20-977c-de6a97c6c674", "value": "T17FE479C85D894603D7A44672DC5D620632292C4A3723939BCBE13DB73FFE283D22D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319714, "uuid": "0d9c53fd-2b6f-43dd-8e7b-ab82a2dfa8b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319714, "uuid": "7dc5215b-bbdf-4151-8a35-78680b3f1117", "value": "12288:3YmtiK5osh+hRdyTFDgvZVnitTMzgwq7a/SWmk:o+Fosc2TaZILTbWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632319714, "uuid": "90d8c910-c67a-4368-a736-9142ff1ad29c", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632319714, "uuid": "59e70d6f-0691-47af-873c-48100532e6d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319714, "uuid": "9acd9804-7424-4a4c-8b46-12f7ad0b8f12", "value": "IMPORTS INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062e8066-1b70-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632292849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292849, "uuid": "fa9e28f8-b15e-42ff-95f3-86aad65c0b65", "comment": "Malware payload (RaccoonStealer)", "value": "4c9e6b5b369745f83ff3774a1b31088d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292849, "uuid": "fe4f8159-529a-4d4f-b533-58fd1425cfd3", "comment": "Malware payload (RaccoonStealer)", "value": "bee02f44f1f8d00f48b101f47689889162257c27d2e25c6014532ea867fd3465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292849, "uuid": "0b7f0fb0-3f73-4604-88b9-93f795c17b2d", "comment": "Malware payload (RaccoonStealer)", "value": "e8495879eb4f2f75c652976c1654f71913e3b2ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292849, "uuid": "639679d0-8221-494e-8f47-15cf06370bac", "comment": "Malware payload (RaccoonStealer)", "value": "46f894771b1821fc794884373311a7f55547be354061e0197c2ecf7ef19c54cadd7da491a2ec3828535a91b015bbfb1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292849, "uuid": "16331bec-3d69-4b9b-8067-5da0de056f05", "value": "T1C9648D20B6E0C035F5F752F889B9A3A8A93D7EB19B3491CB62D116EA16347E4DC30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292849, "uuid": "dc3e4156-7ea9-4b81-b42a-2c135106d674", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292849, "uuid": "506a9b32-e25b-4f50-a199-3e81718304f0", "value": "6144:73HYitv8I0X5eamNFvlK5bRKjrd46bctDgUXT31:rYitv8IK5INy5bcF46bcDpb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632292849, "uuid": "364001ec-0ecb-4904-b538-86302769f01b", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632292849, "uuid": "76f86229-f398-4f45-89d3-206da88deeae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292849, "uuid": "69b77e8f-c663-4f6d-b2e0-d7890fc9ba4f", "value": "4c9e6b5b369745f83ff3774a1b31088d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd998f4-1bba-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632324970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324970, "uuid": "2df02171-395c-48e1-8ae9-8e8cc1e5d147", "comment": "Malware payload (NanoCore)", "value": "c91355d03f807047498dd7ff18824f41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324970, "uuid": "43637b1a-4254-438c-a56c-2633642760f7", "comment": "Malware payload (NanoCore)", "value": "bf0eff54295f8465b89d1269a891545618ebd4031d198d335994083fe34e2f0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324970, "uuid": "a00ae2bd-ca64-43da-a928-7d92e554557f", "comment": "Malware payload (NanoCore)", "value": "1c48ac9fbedf139dde5593abdbf891f12faf6240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324970, "uuid": "0db135a5-82ed-4bc0-a67e-9028ec2525eb", "comment": "Malware payload (NanoCore)", "value": "0cc41bd723771cd22cd36d99abfc3e7d2f523a53bff9e771ebd180152c185fb3e7a40d5f1ccadfc88c1cf930c0ec832f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324970, "uuid": "b4184c94-f959-4a45-bce9-46cbb73a232e", "value": "T160441236A9C1AEFBC54290B74521DEBAF7B38315473303178BE41E326C667CB1264796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324970, "uuid": "039cb9a2-7910-4fc1-bccb-43e16f9ad671", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324970, "uuid": "48480d7a-7501-40f3-b68a-49d11dc49577", "value": "6144:F8LxBsfc/KITQfIkB4Ltg9Kqr/qNUYttXwUtKBPq:/fcbBc4TZNkmiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632324970, "uuid": "dc97ec26-df31-4c44-8245-175d0e036652", "value": 260122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632324970, "uuid": "8d89555d-10f3-4df6-81ac-12171c9b0fba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324970, "uuid": "b2940dd1-25e6-47e0-9dbc-9f21030bbce8", "value": "c91355d03f807047498dd7ff18824f41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f8d6b9-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632317117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317117, "uuid": "ac170687-9818-4f68-8cd9-5faa53359877", "comment": "Malware payload (Mirai)", "value": "0b012b57a049f686cabdb662108ae2c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317117, "uuid": "805e65df-ea65-4dd5-9125-cf6ee18c91c3", "comment": "Malware payload (Mirai)", "value": "bf13f5d68566ed9ff425ebe320243859418c6fe1e6b618d176f42cf82e7cb802", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317117, "uuid": "0ddb51a4-7e44-447e-8daa-709e3595f1cb", "comment": "Malware payload (Mirai)", "value": "5e5536c89bff2df50b03ec21fe85854ce5e511e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317117, "uuid": "05b5a522-6b57-4a07-a43b-27c5911ed91d", "comment": "Malware payload (Mirai)", "value": "6dc27fae9010cbf24d2c728b65d32677916c4d5f2e7b7c1cf494dcf851b172af5aee2cb3caa6cdbd52209704e707a03a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317117, "uuid": "0a5d0128-67ee-4ec6-a84c-6d16bce350ac", "value": "T191A30731A641C973D14305F211A7DB620D32FEBB1A6AAA96E36D3CB0DE360C1B561E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317117, "uuid": "8a54ace4-5e2d-4ad4-a4da-399fff9fa834", "value": "3072:gjtwgA6UlYzZveohR9kIEofdGZmmFVcqq0G27ZT:gjhzt3mIEofAmmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317117, "uuid": "2349cc3c-c3c3-4c2c-9b52-a86653369b1e", "value": 100267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317117, "uuid": "2ba5291f-5752-4a04-8a12-757e9621fac0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317117, "uuid": "4b66f56f-6b2d-43b6-8100-761b8e3cdc41", "value": "0b012b57a049f686cabdb662108ae2c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587c6645-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SakulaRAT)", "timestamp": 1632317039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317039, "uuid": "e13ea935-6d54-4709-b97d-f25da3a34e75", "comment": "Malware payload (SakulaRAT)", "value": "9640c0c25e279327d12a52a5e596724d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317039, "uuid": "e72d1ead-e856-4714-80f4-baa0674ccd4a", "comment": "Malware payload (SakulaRAT)", "value": "bf3b720b594dffc9beaf98e51f00f7c05fdde0a4ef554eb54611d8497b185348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317039, "uuid": "5a7e06a3-6b9f-4dfb-9ab2-d8e5a2ca08f8", "comment": "Malware payload (SakulaRAT)", "value": "81efd5b75ec8e7e4fc5a063a2ab26bb1e21f8b4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317039, "uuid": "6076323f-101f-4eb0-83c8-e94baf104aa3", "comment": "Malware payload (SakulaRAT)", "value": "d8e39ff0599feda750ae3a5968e8e45f999451d232d0d760eac1fc2b74429068c5fd324a4089589fead42b9c942f8240", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317039, "uuid": "1006e574-70e2-4865-b443-403fc82f7d69", "value": "T1B1E3AF11B9C1C072E00610386929D7B38E7F75324BB9D997BB941B7DBE613C0953ABC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317039, "uuid": "9b9c9c21-9230-4ce8-983c-0f06792e80f6", "value": "4511896d043677e4ab4578dc5bcab5a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317039, "uuid": "9d594496-309a-4ee7-a0fc-9a342067dcad", "value": "3072:H29DkEGRQixVSjLLJ30BWPOt5dQw+hyuGDInwS:H29qRfVSnt30Bbt+IhDFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317039, "uuid": "63d80184-26b6-446b-a78b-ea01d9ebe80a", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317039, "uuid": "c29ed48e-1af8-4a45-b080-9137b22b18d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317039, "uuid": "0f87abbf-419f-4b05-8d57-c0cf05b890e3", "value": "bf3b720b594dffc9beaf98e51f00f7c05fdde0a4ef554eb54611d8497b185348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b741f6a9-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CyberGate)", "timestamp": 1632316339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316339, "uuid": "eb014492-7aef-460c-81b4-dbb49c8ab205", "comment": "Malware payload (CyberGate)", "value": "bd80bab40e031fffef040d30290cedc0", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316339, "uuid": "82194685-e303-4599-b9eb-dd9a75538e7e", "comment": "Malware payload (CyberGate)", "value": "bf4d738ca10ac89eedef58ef072961bca7b7a6c3b680a1c2f365f35fac57644f", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316339, "uuid": "7d7fa1ba-239e-47c1-8ba1-1e3eb6787ea0", "comment": "Malware payload (CyberGate)", "value": "1069b2a511c7bade2e9176bdb97d71931fdd38f0", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316339, "uuid": "c621c6f2-482e-4a05-998a-f5a80f75eddd", "comment": "Malware payload (CyberGate)", "value": "31c7a8e578f77c81e0d608ea9733032f60256330c992bd68a01c4c477ca5893c6823cc4ea644b22a399ce6e9d5fb7a72", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316339, "uuid": "c9a54b53-10ff-46b6-b87b-f8fb7ada31b5", "value": "T1ADE5F1D5D821C664FE0490FE0C1AEBAC22B6CDD8DFF582436A6BB5825B7B78F1432544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316339, "uuid": "3f6bbfca-92a7-4575-b8ca-888d9240f9b7", "value": "e7f5df0b4a791b7e27630ca008501b01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316339, "uuid": "6483193f-c824-468a-9f97-a7913f635847", "value": "98304:HXCM/kcIjAIAx6nHFXVDNBA2uimEs4AqsuUTvfZuvSnMhUlV46dRQRvKRgLPtFvD:DF+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316339, "uuid": "1422e12d-03a7-4280-bfb8-b103f5ef85c6", "value": 3234304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316339, "uuid": "c0b8bc27-150a-4f79-ba46-1e894b8caf08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316339, "uuid": "1b631c80-fb51-4b80-9a76-423868ce36c5", "value": "bf4d738ca10ac89eedef58ef072961bca7b7a6c3b680a1c2f365f35fac57644f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ac41e1-1b7c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632298086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298086, "uuid": "4d61ca57-b707-4f75-a2a1-d34694d440f0", "comment": "Malware payload (Loki)", "value": "f865e60134bf6774d24e03d2907c9791", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298086, "uuid": "3a1b7b73-c144-4434-99e3-ca7a19951d2e", "comment": "Malware payload (Loki)", "value": "bff66b0d35ac7703c7d92c4cc0423c5e65ba2ef6040cd576864f76ad701cf7e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298086, "uuid": "ccb7c376-b457-439b-9d0a-655b0270d095", "comment": "Malware payload (Loki)", "value": "7571eebdd301e8780f92ed8b7648f0a89ac1d268", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298086, "uuid": "846c9d3e-36e9-40dc-a086-4d5a0c34e4c8", "comment": "Malware payload (Loki)", "value": "06838f345e5ec6d53ccd7527230db1d3fc1190679aa905b3e487b0de4f941547c05d026b99179217dec61be3a05d0675", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298086, "uuid": "83aa2e80-ff42-49cc-9aa4-6b2a353a88f6", "value": "T1E9A4123CD299196FCBDA11FAA12161425FF8E06775C2FBD3EDE0A00A958B3D1485F0DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298086, "uuid": "e2b80ad5-33d1-481e-80e8-071759adf816", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298086, "uuid": "063f9f76-4380-46cf-8c3b-b0c2f972b446", "value": "6144:FK9NmtiS3/NpZZaBAuCs1lt9C0Vp5mSUCeUA8y9YW7A26qbzWQtcPXiHFGjAYcSZ:FKLmtiK5oBLCbWHmSRX2Yqb9mPSlEDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632298086, "uuid": "4734dcb6-b4d6-4668-8ed1-2bc95d553012", "value": 453120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632298086, "uuid": "7753388f-a724-4f74-b92f-9ee27e7fcac1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298086, "uuid": "58226115-1b97-47bf-b155-65febc46d183", "value": "f865e60134bf6774d24e03d2907c9791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa43523-1b3f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1632272142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632272142, "uuid": "f73aabdd-236e-4e30-ad9d-daf808d673fb", "comment": "Malware payload (NetWire)", "value": "7ff698ca826e0f2ebf03a8d81c0d31a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632272142, "uuid": "79f2f2a9-2a37-4eca-a06e-5d5545122fe8", "comment": "Malware payload (NetWire)", "value": "c31467e8064155268806cbf3361acfa3667eb9bee6dabca19f7ed58c373c586a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632272142, "uuid": "cb4426b7-b8aa-46a0-be7c-783fc72ccbde", "comment": "Malware payload (NetWire)", "value": "a2f5d438cda387db0f54b6d59614994802673666", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632272142, "uuid": "a8ab309f-0f8d-4b63-8d91-f6de37555d7d", "comment": "Malware payload (NetWire)", "value": "139d47193664415979e022a769836739978c598668e4d4c49ef0224b62be108016c349f0b40b55d1b7d93ce56fdce59a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632272142, "uuid": "1ecc769a-0c6b-4850-a42a-ab6bba82d2fa", "value": "T178354CE2B385ECF0EC203A3EDC8A7191262C7BF538035D4D8DE87A4E5964592F56D48B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632272142, "uuid": "87a77c25-7e95-49db-bc27-cae67e3f8191", "value": "bc8cc1eea5c25ce2056d7da92bd98134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632272142, "uuid": "9bec4bbf-9b58-4840-b43e-ef80681f10be", "value": "12288:lIspEfnP8N/seflQTshT8aqeTW39KqGeoAdrL7SUbDz5Zp:320N/seflZhTmiW3AerPzz5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632272142, "uuid": "5e9d2215-584b-40cd-8af2-eee36bca364c", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632272142, "uuid": "404972b9-b4e1-4691-baad-7c61c2de912d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632272142, "uuid": "e026af7e-3f85-4211-9b11-68f14515de5f", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52bf6eda-1bd2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632335068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632335068, "uuid": "d7ff023e-1870-43f1-89a3-45e8e2fdd4aa", "comment": "Malware payload (Dridex)", "value": "2af35d9c2f077a4eba92e8dbe771f40c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632335068, "uuid": "9bd9f9bd-ef76-4d26-b7e7-da705d6172ee", "comment": "Malware payload (Dridex)", "value": "c37c6468848c7690cde796f614fd2993507101825badfa72f2b28be9f58fc71d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632335068, "uuid": "86deee8c-964e-4333-856a-f2df1040473e", "comment": "Malware payload (Dridex)", "value": "2e39c408c1f89beae20de08012e97bd6143b08d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632335068, "uuid": "1b9918c9-8b5a-4336-9b03-5bab9ad38697", "comment": "Malware payload (Dridex)", "value": "67d2776a68a3e66c8a770a9a4cef3b18edae7f8798b501f1196dcc23e2c52e1389897f7d93f5f7b091cfa7ffbda75a58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632335068, "uuid": "0af3549c-5b95-4125-9254-f843538d8b27", "value": "T11214D0D3DFBE82B5F1A67A790830BE39242D6741CB84E567F2D9CA908171521F02EE35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632335068, "uuid": "d3a21fb6-7934-409c-b07b-a40f94136783", "value": "7ccd6f40a9c36cae6c541b1ce3dcb8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632335068, "uuid": "d91370ec-a607-443f-b3c2-445497d70917", "value": "3072:NglCoxtHaw2NiohdCKwP/LXHiIDLSKsytAKPypyCRbXy1Vee1/TpzXAOjIK:NglCyt6Jrdf6XH9dJtByI6Ve1LpEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632335068, "uuid": "ad7b5276-2fbd-447e-b26e-1ae6a1cd9b5c", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632335068, "uuid": "e659d595-7b8d-4f38-a4a4-3f70f1b5a42d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632335068, "uuid": "f6c362b8-5bfc-4b03-9f27-280b5eee0c74", "value": "2af35d9c2f077a4eba92e8dbe771f40c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264ec73c-1b86-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632302352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302352, "uuid": "72aedaa0-60ef-48fb-8f90-b6b41158dac2", "comment": "Malware payload (CoinMiner)", "value": "a53a2df2ce1651d4be209efb7cb57b63", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302352, "uuid": "178a87cb-14d6-4252-bef7-2b573445478e", "comment": "Malware payload (CoinMiner)", "value": "c3a306352c2ddc1b184dbb5ea2362acd53ac28bcb6868813c6ed0a7083e9af8c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302352, "uuid": "d0e6becc-769c-4906-8636-8cc701ede8eb", "comment": "Malware payload (CoinMiner)", "value": "57a9af938bc99e79967d6d26bc18ea5643185d4c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632302352, "uuid": "2c664337-23f1-4664-9a45-d03f77410fc2", "comment": "Malware payload (CoinMiner)", "value": "9db9ffad438355fc06c426d44339e3bcd9cc5462dc6ee667efb12eac54d6a23a9acd6f8db1035f9186a449bdf0687213", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302352, "uuid": "1657d62c-4739-44f1-8a99-f25290dbdcb5", "value": "T169E68D15F64350F8CE6B85B0825BE77BA630B8058030EDBBEB58EB38A933F51651D725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302352, "uuid": "39e603a5-cc67-49a9-8c29-5b11444dc18c", "value": "29f15fabe5549262125724e50de00caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302352, "uuid": "fe88770c-b472-4f23-ae25-f5a42a0a1989", "value": "196608:+A/G1zsNLT9EJXniPFahsYJ+AJGh7QaQsnpQRn1XpXmT/6OhIFCfUa9Y/SwaZtWR:66EJiPFaf+kJCFXUpKwaSV7zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632302352, "uuid": "b6d41a8c-53d0-4409-bbb7-5a1d8e8489dd", "value": 14274560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632302352, "uuid": "22687ded-4341-492a-be94-114d244076d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632302352, "uuid": "d4891038-08a2-4709-9880-aa00f0a4b55b", "value": "wk.exe_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb02284f-1b9b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632311701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632311701, "uuid": "d0095c33-29a2-4ee4-9930-449f6125c1f9", "comment": "Malware payload (AgentTesla)", "value": "4af3499e6de85be580c07a63e0bd1ecc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632311701, "uuid": "59247caa-38d4-4136-8ef2-62a0f03d77b2", "comment": "Malware payload (AgentTesla)", "value": "c3c71e328575ee408f70f8c88f00df195e7f7e40839b2736ee6baf1858eb9262", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632311701, "uuid": "3d7484c4-e524-454a-85d8-0c5e518f7784", "comment": "Malware payload (AgentTesla)", "value": "b663f8cd71373007c49e121e549547625c26e52a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632311701, "uuid": "c1efe86c-171d-4245-bb84-14281fcbadc0", "comment": "Malware payload (AgentTesla)", "value": "44dc53d38fb7c1dd266f40485efec404916144c0a0473ef49465c6b0f78e24c762944890a456af48cfb0eb81d35d29d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632311701, "uuid": "b6ab56e8-ff54-4c12-bffb-a55fb42d6cc3", "value": "T1FA9423E58620007455E38A378ADC453EC43F2719EDEB986CBB71B04F6DA1C63B695B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632311701, "uuid": "de518efc-e702-43ca-866a-3b5df57613d5", "value": "12288:UcImyK0cISgASN3bs/JxOvsCSthg249y+Udg:2myK0cgibOvsB2NwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632311701, "uuid": "1dc22cf4-54b1-41e6-b76e-c8bc130161f5", "value": 430302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632311701, "uuid": "0fbd12f3-d131-4cdf-aa64-7a0d2b29ecc1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632311701, "uuid": "94239bb5-d34a-4d44-8e9d-027eeb791d2f", "value": "pqf0009876545678.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf647539-1b9c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1632312058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312058, "uuid": "c3fb3083-38b1-4fbc-8588-f7c99db1152e", "comment": "Malware payload (AZORult)", "value": "ef09d2442abf0102ea4e9833f034dae5", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312058, "uuid": "e9da96d5-2a33-4ffb-885d-4c78dc4a4872", "comment": "Malware payload (AZORult)", "value": "c41a35d1a3de4fd8f2a3138c90ca1453e8935e22ba6ccb1224fe370e0d0848ea", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312058, "uuid": "1d9b1016-4df7-45b6-a6fa-922ba8e57d16", "comment": "Malware payload (AZORult)", "value": "a86b3235f7284c8a61f327e1f6bf172dd7d9650b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312058, "uuid": "2e8ee55a-3013-4ac9-9578-63a90fa6c5c7", "comment": "Malware payload (AZORult)", "value": "01b3da46e6e0e4e7e1105fc14d844879883cc5a4d21369b34cc265c0ca58e7dcc849c703e3677fbdbe48dc37994d3888", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312058, "uuid": "b50311e6-3b2f-411b-9d28-32871dc341cd", "value": "T120F417394D2682F747EEC66CD48C1BCEDEA6A4837B919F1AC496D7C2025B70FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312058, "uuid": "436305eb-d2bb-4d9a-9477-e8b668d67c85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312058, "uuid": "b961734f-46e7-49cc-8da0-8b9d69ffc10b", "value": "6144:XMRZqoMG4wiLGzeDvbuumGXNDGCv68TFNAdwDsZ8jU2I+cOhxPS/TCmJP1XP:XkUvrAVeieDw8jU2T6j1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312058, "uuid": "d53c755a-e73a-4260-bcba-5f7cb099603e", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312058, "uuid": "3e8fe092-99af-4b5c-b2e9-734759e8abed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312058, "uuid": "28a05bcc-929e-4d8b-9b55-7d5786f20cb3", "value": "9fYI48zaTwSnHR1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44f375e-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316817, "uuid": "5ea4615c-6731-4edc-929c-13bf1c8be7c1", "comment": "Malware payload (Stop)", "value": "4a956a207df6053ade4b07c2857fd4b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316817, "uuid": "c1487b58-addd-4166-98b0-5c34cf9d1363", "comment": "Malware payload (Stop)", "value": "c42b2661b7d4ed6404d97b10eb82fba1ec39096e8fb0b28a94b7277d938f9b4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316817, "uuid": "1881e896-dbd2-4ea0-a841-3a4faf09c20e", "comment": "Malware payload (Stop)", "value": "51f0c8f30d33cbceb3f49529f97bb3674b05051c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316817, "uuid": "f63e18cc-bf54-4c96-9c6e-80dc909ed3ce", "comment": "Malware payload (Stop)", "value": "0c8e1493745436c6d1e97cae4b7df10fbb5dd5d87bc4457f2c21fdba4a0433cbb935fa8f2aab9404034af7b8f0b058a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316817, "uuid": "9db60bb0-f487-4bdb-a857-ef3361c69375", "value": "T12FF41261F5DCD923C4CBC27004A2CEA0663DBE62BD58594BF6A427AB0E70FD24611B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316817, "uuid": "40def8e7-785a-4b22-ba75-9571acd472dd", "value": "b12e7978872b30dc79fb1024bc4610fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316817, "uuid": "496a2971-8777-4569-99e0-38270a91c799", "value": "12288:oMye2OuroX483fgiBgAZ5vb3wamnjKL45eeJCbt2ppfnj8qtJgh7eYLWlB5B9/oE:79usXlvAAs+ed/b8qtq1XLWR/rJS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316817, "uuid": "30b4affb-468a-41a7-a978-90c8b696e2c2", "value": 785472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316817, "uuid": "9a5fd413-a1ca-47f4-94d1-d4c5db7b6c8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316817, "uuid": "57eda722-bed4-4e37-9296-983f8356540a", "value": "c42b2661b7d4ed6404d97b10eb82fba1ec39096e8fb0b28a94b7277d938f9b4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d667fd-1ba9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632317548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317548, "uuid": "d23d3aaf-616e-4f64-97a7-8f795e1230f9", "comment": "Malware payload (Loki)", "value": "45623f13deef211f34d76e798f1d8e07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317548, "uuid": "3b530512-bc1c-46e3-89c7-a517c4f625d6", "comment": "Malware payload (Loki)", "value": "c469e1d887ed4264016fba3205f29e98f39a1d7ea7441765aea39d1cf3f5d82f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317548, "uuid": "a78632dd-acb5-4c6d-a9fa-86ea66673cc8", "comment": "Malware payload (Loki)", "value": "60d4d1c42bfc557b791cbad5a526c72f17bdbba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317548, "uuid": "bf31b1de-4116-4ed2-b13a-5ee1dd3726cc", "comment": "Malware payload (Loki)", "value": "4e648401cd95ec2f5b28650fb66ca4e8a002c536487c4977b648f399c14ca9c51e4b18ed8c21d827bb14af31d5ae17cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317548, "uuid": "15468649-46be-4138-984f-81e70ca8a99a", "value": "T1BF448D20AEA0C035E5F702F649BA93A8A53E7F75DB3091CB12D1E6EE56342E49C31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317548, "uuid": "6f99a609-6e1a-4617-a641-148b1fb50e05", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317548, "uuid": "edcc2363-392c-4aa4-b744-9a12cf7234fa", "value": "6144:UoopuemvciZkLoeggCOPiC/tL4NG4sUa0z57:QIvciZkLAvOqQq/sdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317548, "uuid": "8665de30-cc32-4eb9-baf3-b96023f74d68", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317548, "uuid": "8fc9d2f7-a179-4cd0-a9dd-cffa18faca73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317548, "uuid": "7c106bbe-fcad-42df-935b-5cdd8505a5da", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83aaeb5-1bb0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hancitor)", "timestamp": 1632320662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320662, "uuid": "6a19186c-4993-4a5c-8a14-837926f953f9", "comment": "Malware payload (Hancitor)", "value": "3fc95b63187c36ed8c04dea4676fcd72", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320662, "uuid": "e76332fc-78ee-4795-b06a-87c7fbbd3332", "comment": "Malware payload (Hancitor)", "value": "c587e9dda0d82bd514f33dd13cf9c176f3d1605777c78dd82a292be7631c63a7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320662, "uuid": "bac992e6-f5b0-4561-b200-0e9cf6ab82bd", "comment": "Malware payload (Hancitor)", "value": "ae129d9e5bbd96ab220238081be1f82e59708223", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320662, "uuid": "1c9ee2ca-5cbe-4865-8339-b3a0d490c723", "comment": "Malware payload (Hancitor)", "value": "7612905b39aa11d6dc08a14a074a20eb93cab257f032efb843dde820d8b55a30e5ef0eef77dc1a1a606c04fba8ee175a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320662, "uuid": "217dea92-9138-47ce-9fc7-1034f2e65a45", "value": "T1C904AE1ABAC3C070D83D083A4561CAF19739B858DBA09F5376A93F3F5E721C24D2656E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320662, "uuid": "174db02b-79c2-4dfd-86e6-bb429acba4c5", "value": "f373e4b5461d6db1f436ceb951385011", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320662, "uuid": "6df59fa9-6a72-459f-bfc3-ad230b6bd1ca", "value": "3072:9N6O7YL94OBsJYLZVN0biWkA5WYu7BqB8lDQJkggbVkmTULYBx2Qvpn1/V5:9NfAT31VubFkeu7BGqrjULYbHpn1V5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632320662, "uuid": "9417a112-1330-4e8c-8dea-fbe875286b8c", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632320662, "uuid": "0baba861-a074-429b-983b-8c3de615ff1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320662, "uuid": "a9364601-b9f2-461f-82dc-51d4647a7f9f", "value": "flex.xz.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1de91bd-1be8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344650, "uuid": "975376ef-bb6f-4bb6-b1fd-feabe12b81dc", "comment": "Malware payload", "value": "77fbe38d6d7c0dd4d495eaa6388dbfa1", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344650, "uuid": "e944963f-0da8-46f1-a359-feef12ac791a", "comment": "Malware payload", "value": "c5be63a910ffedfd6461f84f099686565206c4b3f545ea70c529d497bb8e82ac", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344650, "uuid": "cb87ed78-b78b-444d-96ff-e9d838ab0852", "comment": "Malware payload", "value": "6a1609307e0403494cb39d7110393c8b2743a48c", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344650, "uuid": "f6bb233a-b61f-45e7-882c-5d11258da63d", "comment": "Malware payload", "value": "76e5c99885dc8082034057d673c0a42e4e9215054528e8689731277aff51ed8678c53d464ea3c29f69767ca6e57b4402", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344650, "uuid": "9813532b-2494-4a05-8d23-84683069a2f0", "value": "T1DEC423D45F987014868467262D464187465294C0E3F7FA804FEE3C58A369EF6FBACF1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344650, "uuid": "38d9e50a-fb8d-487e-a69a-2f24c5d80ab4", "value": "12288:GHO85Ra0deG7/STAmgsUSueeddruVB3AKbm/sT06F9zabJN7LdXlq+sa2OsG3:GHr75J7Pm7E50AKbm/sTHzA7LhlQdG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344650, "uuid": "375f06d9-bbe8-4a5d-bb5d-0b0f0db05cb2", "value": 585843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344650, "uuid": "e6f42171-7584-4c5a-b41e-038c54d1dac1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344650, "uuid": "7bc82406-9d01-4c8f-8ce6-2a095988a1ab", "value": "\u8fd930\u540d\u5e38\u5fb7\u4eba9\u670830\u65e5\u524d\u901f\u56de\u56fd.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12441dfc-1bb3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SilentBuilder)", "timestamp": 1632321646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632321646, "uuid": "d717f4b1-c900-4f57-85e1-bad471c24a33", "comment": "Malware payload (SilentBuilder)", "value": "858a85ffe744c4275f3c3ec823b26746", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632321646, "uuid": "1d3974b4-79e5-453d-919b-9c47bc4291b2", "comment": "Malware payload (SilentBuilder)", "value": "c5c20a5408d2bd1c3eb191e2740a4f003cca2b2ac16e01689af6a284e86b3bc1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632321646, "uuid": "f8a65b0c-7012-423e-a91e-c00ea31f6038", "comment": "Malware payload (SilentBuilder)", "value": "5bb9301e5303233fac71742714e89db85d1e0aeb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632321646, "uuid": "4b5bfbbd-85b2-4346-900b-a61b1eb5286e", "comment": "Malware payload (SilentBuilder)", "value": "e626e49419462e66c081f8da64913ab9a801f4d3477e7071de7383a84acdf71954717806528f4a218fecd407d056b27f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632321646, "uuid": "5963249f-e460-410e-b629-5f7a0cfee262", "value": "T13244E1257AA2941DDC2D2B76AC7B83D46333FC204FE74B877A5672323F759A08D26409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632321646, "uuid": "96bb0edc-8191-49a1-9295-00efc9353ef1", "value": "6144:wKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg9nfb7I6+tqDWcwnoRZzlj+oSGpGvhmmmm/:Hj7CqScwoRZ9bSXkh/nLIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632321646, "uuid": "15d56328-c6b6-4519-8258-49d683a83159", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632321646, "uuid": "31b20aa0-b00c-4ab9-bfe0-642e80fc90af", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632321646, "uuid": "9e27463b-14c7-4a6f-932e-c177420ed0db", "value": "specification-342891047.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba57eee9-1b8a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SilentBuilder)", "timestamp": 1632304318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304318, "uuid": "31f4b5ac-268e-408a-9cf7-6c5f90e5f675", "comment": "Malware payload (SilentBuilder)", "value": "c63b437e29a5b4521c75daeea4ab83af", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304318, "uuid": "76cee871-5aa6-4b50-8973-5291de3816e9", "comment": "Malware payload (SilentBuilder)", "value": "c5cca5c9445e76e49f6df0b1eb626e66710f7a13804ab319afd53ca7adddd4ef", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304318, "uuid": "43bcde06-2818-4a1a-abe0-344bb630c29b", "comment": "Malware payload (SilentBuilder)", "value": "bf2bd99bb2b71adea0815ce37484a1353da533a7", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304318, "uuid": "9ca5fd99-ec71-4135-aa1c-85072e498e39", "comment": "Malware payload (SilentBuilder)", "value": "d60464bd008192d252cff9ce5664886fb906add5cd8385ffa36c103d9d7bf094b7f34f7c743d564e9a0e6bb99ba83003", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632304318, "uuid": "66df2f26-6d75-49af-b883-22b7b989e317", "value": "T1AB44E1257AA2941DDC2D2B76AC7B83D46333FC204FE74B877A5672323F759A08D26409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632304318, "uuid": "ee292f33-c6c7-48d6-8448-89a2d477ad31", "value": "6144:wKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg9nfb7I6+tqDWcwnoRZzlj+oSGpGvhmmmm7:Hj7CqScwoRZ9bSXkh/nLUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632304318, "uuid": "c207e4b5-6458-4f81-887b-902bdba5f257", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632304318, "uuid": "9a498da2-7aca-4e66-be5f-2990cbb6ae36", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632304318, "uuid": "65a94f37-a4c3-4507-8956-54d340d4095b", "value": "specification-1149726978.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f19fb1e-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Troldesh)", "timestamp": 1632316728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316728, "uuid": "10f9087b-0f47-4ba4-8bba-b733c2dc1e27", "comment": "Malware payload (Troldesh)", "value": "27c1b79ac47adbd44122f1c2e4dc15bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316728, "uuid": "f83959e6-aa17-49c4-a0b2-62b32c944998", "comment": "Malware payload (Troldesh)", "value": "c659b1a6e09e7d7b98b368984d8d8e70ceee5666e3a7f54cf5a0fd90cc9f0eea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316728, "uuid": "8e0b7e8c-f5f2-4131-8b71-dcaa04ca8c95", "comment": "Malware payload (Troldesh)", "value": "aa6b43497115a17765452dbebc4ffc95ecbcc774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316728, "uuid": "b4340a2c-bd8e-4471-9d5c-f0d61d580513", "comment": "Malware payload (Troldesh)", "value": "456673d6a5384b3d6cecd0ea701f708742e12fbfcf82f0baacd04eb05b1419f009422fa98e49efcd1d5c1ab93043aad7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316728, "uuid": "8a69385d-8e6e-4612-a21b-063c877c853c", "value": "T1DF451212B3CB5132F9F6267845BA8C101E6F796C1AE151292C30F62E1C759C69CB6F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316728, "uuid": "27a94cb7-0b65-4d34-9d8e-8e881ace7e95", "value": "52b706f9e593f5965899a4a9ea6b3440", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316728, "uuid": "c60ccff0-a893-4319-9bac-6ffb39808cad", "value": "12288:XpflAzWulcKX7yKCHqknCLv/gEOF0ZV/cgtx61slrEiv/Kc9Rf8/3cwd8888888K:BlAzCEMKaMpjt02yiv/7Rf8/MwoTxBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316728, "uuid": "585c5078-dbcf-43f3-bfe3-e464dcf4d1ee", "value": 1232141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316728, "uuid": "0cf350ea-84ad-4579-874a-7814b66eece6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316728, "uuid": "306965f1-ff6c-47ac-a348-6323a2e4454f", "value": "c659b1a6e09e7d7b98b368984d8d8e70ceee5666e3a7f54cf5a0fd90cc9f0eea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f293bf-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DarkComet)", "timestamp": 1632316959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316959, "uuid": "0dc398f1-8861-407a-97e4-79bd991aed9b", "comment": "Malware payload (DarkComet)", "value": "8cacb0a780eab8956b0d068f51f720d2", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316959, "uuid": "3d88fd7b-d9a3-4d9d-ab91-bdff13aabcd8", "comment": "Malware payload (DarkComet)", "value": "c68d0ea47c9991b37b938c0d2635f2755668e185abcf937dc46b42758b600ded", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316959, "uuid": "9227bc99-c502-466b-b326-c60dae281ac3", "comment": "Malware payload (DarkComet)", "value": "f24f2b98db4bee8b0e5da51cb3d33ed6fd5c64c6", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316959, "uuid": "e7d0f7b4-a6e6-4503-9cd6-42369382634d", "comment": "Malware payload (DarkComet)", "value": "e8e90a0a197e916f47fad1ba78b036d5af8b9b64ebd33e5045a6b2fcbc81915425f135e20be527abe9afd3d823b71eb9", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316959, "uuid": "9a0ce3a6-47d5-45ab-8d80-7ce7e814ac75", "value": "T16CB4D0B1F144FC62E8D60DB1E11F36B117466F66C898392F7584BD1E7CB3B45C0A291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316959, "uuid": "06529cb7-aa70-41a3-9574-8def10537a8e", "value": "f2d24d034ad8ae86f9dd9c6c9707e46f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316959, "uuid": "f8305be3-8999-4bb2-bfdf-897ac109ea0c", "value": "6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbn:f9fC3hh29Ya77A90aFtDfT5IMbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316959, "uuid": "3467728d-6bfc-4af4-bddc-edc14dbcc0a7", "value": 532750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316959, "uuid": "eb541049-b24b-4515-a096-19699038fa56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316959, "uuid": "7340750b-8eec-4951-8dbc-e30c769b2ecb", "value": "c68d0ea47c9991b37b938c0d2635f2755668e185abcf937dc46b42758b600ded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45bad8d-1bb9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632324468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324468, "uuid": "3b89f8aa-3a84-4dc9-9d75-3c96416f2350", "comment": "Malware payload (Dridex)", "value": "8d8bc7ee53b051e94f55217009edf458", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324468, "uuid": "61706860-e536-4827-bb68-97c382768cb3", "comment": "Malware payload (Dridex)", "value": "c8341fecb34445b0fb0aea7a560da67979d75d5d4fa85794c00b93d363efd336", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324468, "uuid": "3284ba48-6614-49b5-8c23-5599cc06aa90", "comment": "Malware payload (Dridex)", "value": "2efd5748ba9ee0eaa4ff326bc78273816deb4e43", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632324468, "uuid": "23c1954c-b3d6-4284-9a83-477198ec4010", "comment": "Malware payload (Dridex)", "value": "8d4acd495b6f5638d82678070117900dccad28f0c77935717532a3a0ff4d9c3e1e4d791f5d62f41ee34ee11cd448ba1f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324468, "uuid": "991ec90e-16c7-43a0-b068-9fa1cd7a7171", "value": "T15014DF13A6B931D3E19B383F92A1E7B16E386F43C338C45BD6D4F46899312A354A5332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324468, "uuid": "230947f5-f334-465f-a2aa-c815111e85d3", "value": "bc9115da123ae49443de76ad96ad8e1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324468, "uuid": "601d358f-bd41-41ce-899b-a537fb3509b2", "value": "3072:Owd4sevPYabz9RLhPO8f3zRCyvD6meTuxn2ZjflxomQYIE5HbiK/n1:HsvQabz9C21Pmb82xnwiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632324468, "uuid": "8a73090d-9f65-4643-b80e-a1fe044f77f4", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632324468, "uuid": "4d1bcf1c-5661-47d6-b7d3-2827ff3128da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632324468, "uuid": "98802eba-e53b-4c02-b510-6341caa06314", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b964c4-1be9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344843, "uuid": "8500f937-dc01-478b-8082-27c2be3ff7bf", "comment": "Malware payload", "value": "aa492aa1316e3a931eedd6ab05ac9832", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344843, "uuid": "aa161596-0d11-4052-b318-7189f01c29cb", "comment": "Malware payload", "value": "c8da832f6f840ab6e1e6036e38196d19ac6ca8102d3437d2041fb7d5d634993a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344843, "uuid": "ffd571e3-1630-4c19-9945-d366762eef7d", "comment": "Malware payload", "value": "2adece9c0e127f068f5f8d41b5696e89ccfcea17", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344843, "uuid": "dcb97c86-b950-4f75-9279-0a55d5e40a98", "comment": "Malware payload", "value": "dc6090a58376d48dcfb4e1dd8171ae6e411ac6eb0d96e010b5bf5f64b055a0e475aaf46af74676532430194e0e641441", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344843, "uuid": "0f0fc666-91d0-4aca-8831-0db04f5ad0ca", "value": "T11F8423C8EB623F0BF94E6474957207F14033060ADC07B66DC1289DEEAD8F656626FD62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344843, "uuid": "4dc4b26d-4e6e-41fc-8f9b-e7286bd6b81a", "value": "6144:mFIu69UjgvoJtAhdgBBLBGJytHaA9DqDOr2ruGpvVyquuiouwmHf28bkCUQADY0:mFIugUMoJtUdOTUyROPtyqjiHHRbED7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344843, "uuid": "c9a21f90-3328-4b24-ba32-9f270ffb9b35", "value": 377979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344843, "uuid": "65b0bb55-7592-4913-aeed-0cc783c3ce38", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344843, "uuid": "94704715-2251-4bd6-9389-d771c024b791", "value": "\u83f2\u5f8b\u5bbe\u5973\u83dc\u519c\u60e8\u906d\u7535\u51fb\uff0c\u66b4\u6253\u201c\u89c6\u9891\u201d.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8bc0744-1bf1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632348527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632348527, "uuid": "55e3551e-4c71-43d5-8215-2e03c3b6de8b", "comment": "Malware payload (AgentTesla)", "value": "47cadae62620fdc161bcbf7a6a8fbad2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632348527, "uuid": "f184ce9a-7d70-4801-b6cc-7e5a81980597", "comment": "Malware payload (AgentTesla)", "value": "c90d89e0d1fa89c9c07c96915b66c26ef4052c0f23e1809036a515b68474c29f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632348527, "uuid": "9adc7f5a-6b76-43cd-b3c6-b7963d312c9f", "comment": "Malware payload (AgentTesla)", "value": "4b0a6028ae904de47c025bcb74ceff602620c077", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632348527, "uuid": "bf5b7a25-72a3-4cf7-8b20-c8577ee8dbd7", "comment": "Malware payload (AgentTesla)", "value": "2138b4a670596976fc1cec64908ec64831d247a5b87907a5bcc4da0d579f815667c2f644e3c8823f8cd08421b0da2015", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632348527, "uuid": "8c52e126-538a-49da-9437-003810e514c8", "value": "T1F9F4E09D3650B1DFC457CD76DAA42C18EA21B47BA30BD307A05366EC9A4D99BCF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632348527, "uuid": "1832268e-ff8c-4269-9e3f-c07a0c14b168", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632348527, "uuid": "30088829-ad56-4f98-bb0a-d4a2d51ebb8d", "value": "12288:sJok1wIXEHRATiY4rD8xFOvHeqjkQ76iInVKyza4PitiEhxR3P7+cVPPcR:RIysJ4Fveqjh6ijyG4oxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632348527, "uuid": "f33ffa2b-bf84-4d8d-8e75-262f79ea88a4", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632348527, "uuid": "351b4271-5176-4664-a8f2-c263b628eaea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632348527, "uuid": "345f9bc2-9c52-4128-b23f-ebd1443110d9", "value": "SecuriteInfo.com.Variant.MSILHeracles.26929.3516.22553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af3fc65-1b3d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1632271141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271141, "uuid": "4ee40d8d-c076-49c5-bea8-02e381a12ff3", "comment": "Malware payload (Cerberus)", "value": "0208b57fdfd90447e5581e3e6403d544", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271141, "uuid": "a27110f3-4ae7-41c7-9a4c-f38bdebbd0a5", "comment": "Malware payload (Cerberus)", "value": "cc65a1cc281b3d09046a39c38fc25e235c66a2319065ae0f5c446664fcb6469d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271141, "uuid": "88e5a4bf-4fb2-4ab5-85fd-2b0bfc9d6e51", "comment": "Malware payload (Cerberus)", "value": "ed5aa1a15edef5fe6cfb313f692f3de435e6ac39", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271141, "uuid": "c3257581-39dc-4fb0-b957-40f8f241e8eb", "comment": "Malware payload (Cerberus)", "value": "a072033206bbd2b815f27c4683944140afd4fe9d264c5bb2fe3fb550a753361daed8e6ec4a547d97cf97c4324d0f8cae", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271141, "uuid": "35649707-23a2-4fbb-bd44-0ad843380cf5", "value": "T1E9E5335E9A51880CD153833182537622FB792B45E6D6E16F7C3E00434FF7A948F36EAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271141, "uuid": "eea94602-c268-4e7c-ae1d-9286132b32c5", "value": "49152:lMiiexXqC8i5WUbn8p9PHRAoy/b2yAcr6i+EhNiU/HtnXZhp9nKF1WT3r:ZiexXqCXSD6pnr6gh8UPtnW1WT3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632271141, "uuid": "bbce3a92-c329-4839-b26d-691d033b9563", "value": 3282751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632271141, "uuid": "8f88f4b5-cb3a-43a3-a7ea-cc13bdce57d3", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271141, "uuid": "0ecdc023-e27c-4a2c-8121-025c27380fb9", "value": "Turkcell_Kampanya.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223a3fb2-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1632316518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316518, "uuid": "337886d1-d0c2-4597-bde9-94f09e4aeb90", "comment": "Malware payload (BitRAT)", "value": "55ed8ae951a7c1b7f3a91c788514ca09", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316518, "uuid": "af07e461-57f3-4347-99eb-b46020ca1eef", "comment": "Malware payload (BitRAT)", "value": "ccbdc1f21153a4572dc96b83b14691a763168a266b8a6c4b4294476e944383b9", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316518, "uuid": "3f5d4ea5-c9a8-4185-9c21-4f3a3e768332", "comment": "Malware payload (BitRAT)", "value": "60c5b640068177e7238f58ade6e9f15b6db88b2c", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316518, "uuid": "ce7e0a88-0b3d-464d-ac10-e1c68ae975ea", "comment": "Malware payload (BitRAT)", "value": "736030452738e8d7f0e84d37ff0efa778a670b1a58ee30d5652f45be2966a3ca2e7b8455f0a3be5ba2a322372e535755", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316518, "uuid": "ef41bfda-a981-4d3e-9536-958b023efa4c", "value": "T1C1A5F1C17983C99BF4DF5AB7989FC0201164AD8D9261C73D26C67E2B65F3302306BA5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316518, "uuid": "dd34dc8f-2b2f-4dc8-8ebb-de1e0d2c8903", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316518, "uuid": "1c256a2c-cbf8-40a0-9e96-9664a81f477c", "value": "49152:v6orziFQR6LGcYvk1s4ZhV1arJ1iF3BdUfTLDfqK:DrvRB5cnZk1iFxETfyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316518, "uuid": "b612a36e-28b4-41d3-b5bf-16a63176c700", "value": 2235904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316518, "uuid": "672f6f6c-9fe0-4496-9bcb-8583829ec617", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316518, "uuid": "ec45f394-0a4c-43b9-8538-eca7456dc6cd", "value": "ccbdc1f21153a4572dc96b83b14691a763168a266b8a6c4b4294476e944383b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49916f9-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632316871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316871, "uuid": "c88cd427-5929-48e4-828f-ef221e9ba183", "comment": "Malware payload (RemcosRAT)", "value": "fb3c2bbbdeef13b6dc08dad254eaca12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316871, "uuid": "165bddf2-054a-46ea-8d66-a3c08de198b3", "comment": "Malware payload (RemcosRAT)", "value": "cce08ab70891902c44d877589d5a50194299f5b1977245a410a2ee6f046b5c01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316871, "uuid": "a8298068-f2f0-4aa7-a7b4-e9e8d189d3f1", "comment": "Malware payload (RemcosRAT)", "value": "c7f04ba8678c55f529c44e040011ad3610924959", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316871, "uuid": "4ff5efe1-bf67-48cf-9a23-036b596d30a0", "comment": "Malware payload (RemcosRAT)", "value": "8166f047b6db0f10e0ef03086e420830fb7f61828f60736d378e53e1607be5cb5c514ae8b33af58e4744878da4d086c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316871, "uuid": "6ea3809c-b822-4175-91a0-09bcb29042c3", "value": "T14FF4B0202264C66AE1FBF73CC4629471CB7EEA87A036D95A5DC3D8DA0D21341C51BF6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316871, "uuid": "4361d87b-4fa5-4705-a14e-e9fae9617376", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316871, "uuid": "63ad0828-f9f0-4db1-ba97-1e60d301c202", "value": "12288:6BGiY6HRFurtmtiK5otgsAsOyqOe07aH/J9650Y8X51ymC9KXy97itI:6A6xFux+FotcsOdUOH/7650hXfI9KXyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316871, "uuid": "1eab8464-fe71-4caa-8dd7-cffe10989ca0", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316871, "uuid": "352c740f-6729-4551-abb0-f8ceae131d4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316871, "uuid": "603ad404-6eee-4f83-a3d9-1056b05ec00c", "value": "cce08ab70891902c44d877589d5a50194299f5b1977245a410a2ee6f046b5c01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7e3655-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632316266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316266, "uuid": "5e7a0bca-a09f-4f40-8f6a-bc68d777c38a", "comment": "Malware payload (NanoCore)", "value": "9f5bacae5551490b9ceb0a53da96dbcf", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316266, "uuid": "d5c69202-e763-412c-8b29-11b559200e44", "comment": "Malware payload (NanoCore)", "value": "cda1c5a357bccc4afe8513daab31c649b3087d230835a497c375d194a5300b21", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316266, "uuid": "ef551c0e-5592-420e-b14c-e515305e9992", "comment": "Malware payload (NanoCore)", "value": "dfdfb5c06008d5ca14a70fb1120325863eb357ef", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316266, "uuid": "9743c57a-6836-43e0-97d0-e90b0d8d8682", "comment": "Malware payload (NanoCore)", "value": "95ffbf4837f4e734f5a2134c77d70e344e71cde1ace79643ffde1dd37a4e23cc8b3e58001127e79cff2923ba0d13bc94", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316266, "uuid": "46a4754f-3023-430c-b689-22dde4ab009b", "value": "T105F1103CE60376DD741D5E2D09CB77295A10C0B5C953E6F9C740FAAC69EEB40AB51238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316266, "uuid": "9b7db751-8f75-411e-8e9d-bcbf22d500c2", "value": "96:PtA0NTJhS9INIKMVGQRX8+HLz9spiINIVIWjnCQRX8Lnaa:PtFNT2INIRRX8+Hm4INIVI8xRXAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316266, "uuid": "45e8eb48-9321-4453-aed3-fb2fd7ce4196", "value": 7754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316266, "uuid": "754ef38f-79ea-4f8e-bc61-6670a6966d9b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316266, "uuid": "1294e5dd-ec5a-48b0-86ec-77c48ce9414e", "value": "15ItemsReceipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938809cb-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632317138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317138, "uuid": "a2ca6754-07f7-4072-a3d2-df658ddf0441", "comment": "Malware payload (Mirai)", "value": "d4c7de517afc9caaf12aeeda45700282", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317138, "uuid": "b8392197-c90d-4f89-9b99-ac052866aa5a", "comment": "Malware payload (Mirai)", "value": "cda4afe05be1725f59a9a20cd9e46828ceadadb77ef55fdae3c0c4e40eaf59df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317138, "uuid": "5aabfc2e-ae7f-4e5b-92b1-418538521def", "comment": "Malware payload (Mirai)", "value": "5b820b5861cbcff8c019b57071b56daaba44c775", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317138, "uuid": "0001460d-eaf1-40be-bf7a-5a1c97ee2f00", "comment": "Malware payload (Mirai)", "value": "7e541640824189ef719eb241564479fb1645b10898936333be8ef9861b86f9ed73d038d38baa17e14f5f0bf3771afcf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317138, "uuid": "1d905df4-0370-45ad-895b-98e1ddae1251", "value": "T194A3F972E642CA72C44306F102A79A6B0D21BE7B0A3A5E86F31C3DB49F334C97555F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317138, "uuid": "65d9c293-49b3-4df8-a5d5-b95011c050fd", "value": "3072:SOGAEtZoGZKWl6u4YTnbHnbimmFVcqq0G27ZT:SqEtZ755nbHnbimmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317138, "uuid": "36d48715-158d-4ba5-b496-ec3a8d676515", "value": 104139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317138, "uuid": "aaea84b4-eb3c-4b06-850b-03dc99ddd7c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317138, "uuid": "e2a8ba18-bd54-4ece-8cda-72f243da0397", "value": "d4c7de517afc9caaf12aeeda45700282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58eec7a0-1b61-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632286545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632286545, "uuid": "be36a998-e9e3-4cd8-8e2f-c71d68826636", "comment": "Malware payload (RaccoonStealer)", "value": "4bcdb602df7e961a916092ecc2fb974e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632286545, "uuid": "2130896d-57ff-4a02-a4ea-7e795d0a32bb", "comment": "Malware payload (RaccoonStealer)", "value": "ce026dbd067345f31a83fbef3c221af1f05d031a33727766ae3756955821ec6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632286545, "uuid": "f3c421f7-eaa5-4aa3-9c51-2d1bafb90e47", "comment": "Malware payload (RaccoonStealer)", "value": "05317231f521365bfa54910d23ffa3bebd1f4a2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632286545, "uuid": "e332b4fa-3b00-4afa-add9-6a752f1eb364", "comment": "Malware payload (RaccoonStealer)", "value": "1028d9cf7b81f557d33dbc8c04daa7728f85260449591eb511da1a70638f8cb0445f1866353814d133daef74c200929d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632286545, "uuid": "7ae9eb49-fdc0-4d80-872f-8a4e31f40e5a", "value": "T1ADD4CF2066E0C035F5B736B8497993BDA9397E72DB2451CB32D236EE26382E49C31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632286545, "uuid": "e015a22d-2067-46e0-81fe-83997438214c", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632286545, "uuid": "ee927e60-b9fd-446e-b6fd-767a3839a6e4", "value": "12288:faIdKK5Fhg+hLCKoLvmHH+JQN1KOYSDmu47yajGRgdDBbza:jKK5RGmHH+JQNvlmgSdDBfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632286545, "uuid": "a5bf410c-bc7b-4625-aca3-9e31d5657b28", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632286545, "uuid": "d5584202-93cf-4530-a497-013b4f43fa6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632286545, "uuid": "6b0bd1e2-67a3-4be5-9412-1e74cb8646ab", "value": "ce026dbd067345f31a83fbef3c221af1f05d031a33727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b1a202-1b3f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (YoungLotus)", "timestamp": 1632271821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271821, "uuid": "ac968036-c44c-42cd-844d-58757e9bd678", "comment": "Malware payload (YoungLotus)", "value": "57523bab2ccf571fcecc172ea5f44959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271821, "uuid": "2338cf88-e2d8-44d0-ae6d-66938c30eb7a", "comment": "Malware payload (YoungLotus)", "value": "ce2b941076f27243a2ef984e5d6b045c505a98bc73a5a3b1152112228079e68b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271821, "uuid": "fa9bd31d-8096-4954-a835-d17eae6d90d3", "comment": "Malware payload (YoungLotus)", "value": "b214a6cc13e5022779b6ecaf0364a0464defa4ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271821, "uuid": "375d786d-3296-4ab4-a0c0-db031e91a784", "comment": "Malware payload (YoungLotus)", "value": "200ffefea0ed0ce8c8b903d665708002a4600864cf3e28a27410740c1a0df8a354f6e1b8ac753e2e6a392948035c5e6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271821, "uuid": "af564972-79f5-4c7b-9236-40723f02c826", "value": "T17B459E12FAC48074E1BB31B32675A2355269B5306B22C1CFBB547B6E1CB0BC16E36767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271821, "uuid": "b746de3e-c31c-4d19-9a47-df539c6a08f0", "value": "05170c3952c47a73573887e0f56a9cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271821, "uuid": "99b1a2cd-afd7-487b-88e8-b39e5c03ac7c", "value": "24576:0g4TKIg8Xjiz0f3YQEBDrX5jnc3Patig:0g0KIVjix55rc3iUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632271821, "uuid": "8bcc30a2-3666-41a1-9780-ea1d49e4bbb7", "value": 1261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632271821, "uuid": "0e10bff7-b3c9-432d-9713-1cb7b3a3804b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271821, "uuid": "d11a38b1-33de-460f-820e-15480eb62d2e", "value": "\u201c00\u201d\u540e\u5927\u5b66\u751f\u804c\u573a\u906d\u9047\u53d8\u6001\u4e0a\u53f8\u5f3a\u5978\u89c6\u9891.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0281f6a0-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DarkComet)", "timestamp": 1632316895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316895, "uuid": "dac046b6-f44f-4954-b564-48e651079bdb", "comment": "Malware payload (DarkComet)", "value": "723baed58f250509d277de75a3178be8", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316895, "uuid": "3d0ff388-7b0f-46e5-a4b3-cf9d1f27c36e", "comment": "Malware payload (DarkComet)", "value": "cee4e670f5caa5f4da865a0d00549f261382aa383c0debc1f7a4d0cd183ddd9e", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316895, "uuid": "b8bde27b-5fa2-4045-adfe-d0486edcf604", "comment": "Malware payload (DarkComet)", "value": "d5c190e5acb7f4e8d9f6286e4f48fa9bfcd1325c", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316895, "uuid": "7ece71e1-f93a-44d6-aca2-a7d23b6c746a", "comment": "Malware payload (DarkComet)", "value": "7b6fa32328fc04236f3895548f99e109f19ea1b2097926796924c3777981124a5fdb63e7ac716e3962dc4f0ad0cd03bb", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316895, "uuid": "980806ae-1ca9-4449-91bf-487308f3904c", "value": "T18BE47D31F5808837D97229B89C5B92E5942A7E202E38754B36F63F4C5E391C37D262DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316895, "uuid": "a5664ac8-f95e-4d0d-bc77-19f3612cabab", "value": "8033c11f8a2fdfc317e8655120579933", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316895, "uuid": "d2f0ad13-6e01-443d-9df6-ab59655a8558", "value": "12288:m9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFC9:CiBIGkbxqEcjsWiDxguehC2St", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316895, "uuid": "96e5d5a1-6ac7-4b33-a807-a16ec645905f", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316895, "uuid": "786959a3-8df9-4d98-835f-ef8467b8796d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316895, "uuid": "d448d67b-4d6d-4211-b8b2-5f16ddd9d990", "value": "cee4e670f5caa5f4da865a0d00549f261382aa383c0debc1f7a4d0cd183ddd9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9efb82a-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632316370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316370, "uuid": "db48dd54-6c52-4519-8f69-f61b617349c6", "comment": "Malware payload (njrat)", "value": "7de4382e6f4093373bf61e99e714c286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316370, "uuid": "5a52ee48-ca8a-4ff5-90e6-5fc0e58ebca4", "comment": "Malware payload (njrat)", "value": "cf98b99bfc23dd600c5a269257b96e19b8ef228631a8a1dd39bfe14ed89b11f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316370, "uuid": "bc60b7c2-2326-4703-8bf8-5d76db45061e", "comment": "Malware payload (njrat)", "value": "67cb43e25a76a7dbd05a195e3b070ae88b84ab6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316370, "uuid": "e1a0b5b9-ffae-4d63-9e2c-f50823132878", "comment": "Malware payload (njrat)", "value": "f2121a25fdff9bf60ec39844da438e1e521c5d356dd32ab2e2e4bf9ce81d3f4b2adfac282aee725244a5cfab1e0447e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316370, "uuid": "38183f61-0295-42e3-9b4c-2ff96cbd1176", "value": "T1E6E533A5AA9FAD54CA0C8975D43B3C8A6D02F23AB6EC57D413D73E827D17B320027752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316370, "uuid": "714727df-601d-47aa-87bb-16cbdad2636f", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316370, "uuid": "5cff5472-751e-45c8-862b-29a62547ec36", "value": "49152:3iu39/BY5evcddcGr/X17ixKbNTzV8DRhMj5Gd6gF80+Dcqi0oLYHvc:5U5ekvcG7X17ikxPV8ju4q100oLKvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316370, "uuid": "25b54e36-1e39-4dc9-b728-d6f999a8d144", "value": 3065856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316370, "uuid": "04b475d3-e503-4119-ab57-f55bd7b0751e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316370, "uuid": "24f6d7d6-2da4-4896-a143-8a3053eeebd2", "value": "cf98b99bfc23dd600c5a269257b96e19b8ef228631a8a1dd39bfe14ed89b11f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ba3fab-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632289466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289466, "uuid": "b9ea47d4-962a-40dc-acd7-05ee61eafca6", "comment": "Malware payload (SnakeKeylogger)", "value": "b81b06cda0def150089c0220511dcbc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289466, "uuid": "6adc3102-68dc-40ab-a9d8-20bbbd6dae88", "comment": "Malware payload (SnakeKeylogger)", "value": "d09a787825612ddedc0739ec53154c849e80ea431373ddaf0c5fb988ed30b8be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289466, "uuid": "4f35582a-9506-4ef1-ac3f-2044caab8850", "comment": "Malware payload (SnakeKeylogger)", "value": "c61edc0fe7d9dd9c3a3a54b1b41c53f86d6f4e4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289466, "uuid": "6d1cbc4c-ef56-4118-8c5e-2c9c6772ac7a", "comment": "Malware payload (SnakeKeylogger)", "value": "c244aab2051bc28145f01800a17983e974b96f94f847894caee6df488aa5c3ab875cc674af5601c5a7985fde75d34974", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289466, "uuid": "fd5d577c-e887-4543-a7a8-112ff52b3d6d", "value": "T1D164135BE2D0E0B6D4A54A3105BA7978E3F28304B056FF0347B87DB66522EC71B2ADC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289466, "uuid": "68e59f25-5e35-46a7-9d57-4f803024e656", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289466, "uuid": "8103686c-4aa1-487a-9688-55e50c7fd853", "value": "6144:b8LxBqWiH779rDD/X9wZXod4GS9UIR6HFk3WZ4a0XLz:nWibxrv1wZXoyGS9UIcl9ZNkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289466, "uuid": "edf35d0d-84ae-4cdf-887d-c8e5f932b937", "value": 320716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289466, "uuid": "6c5e3925-0de9-4302-adca-e26b385fffe0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289466, "uuid": "0ef4aa46-bc28-4257-bb02-92fe41b6c83f", "value": "22234678762234500009000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0a8a82-1b91-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632307276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632307276, "uuid": "b18958db-3cb3-45d4-be92-0a886e3dfba1", "comment": "Malware payload (Formbook)", "value": "6bd6345769283955da827076b3dbe2f0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632307276, "uuid": "5f6c2bfb-aeda-41ae-aea3-511bbe9732f5", "comment": "Malware payload (Formbook)", "value": "d09a804398b380810373f45defe68ce6bc057e7d803f22fa93253fe05043ff44", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632307276, "uuid": "f0c8a9b3-bc90-48cb-a99a-e4d759e4fa35", "comment": "Malware payload (Formbook)", "value": "1b0cb8e1afca948d265681b0faa36144c349b698", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632307276, "uuid": "63442444-1cdc-4326-9fb3-65a4ea9edec5", "comment": "Malware payload (Formbook)", "value": "3dc92171c4041b739025eb9b50e40ff76c37b36735f529db3aa574a7cee6e09cc65a66ec2cfc8bf5402651eba1d73ebf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632307276, "uuid": "21839e08-e1a2-4c1b-b9a2-add829ce2883", "value": "T14252E6ACC09341A8CF8A67B8171B9E48118D7A6EF3959133723C57756BD2E3A5113C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632307276, "uuid": "94157241-6c81-4b10-b0bc-04fc2493c731", "value": "192:Uh63mu7VziZtD8e52926hJORxImQQJ13jh4ag9mqjmTlgfwYpysEnNP5CAkCmORf:Uh63T6wekhJGP5lwQgfwoyfSsrrCA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632307276, "uuid": "3e21e73c-8d07-456f-826d-99d15e481c12", "value": 14084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632307276, "uuid": "d17e0fd1-a66a-4d85-bcb1-e88b8439f236", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632307276, "uuid": "d27d714c-5949-415f-a611-a2b9bac7760f", "value": "KOC.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7d9bf4-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316485, "uuid": "6dbd7a4f-e258-4568-a9c1-8323bd784586", "comment": "Malware payload (Dridex)", "value": "e8b1ebed47b1e3f52db1e35c69b1ae0f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316485, "uuid": "3873a39c-abc7-4a05-917b-3b9c64b68c7e", "comment": "Malware payload (Dridex)", "value": "d0b06cdbec8316b4e6c2d8cb5d696388a2a54850a4a997129c21f9be171f9f59", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316485, "uuid": "14cc8ad8-be43-48aa-b72c-c5fef4bac89a", "comment": "Malware payload (Dridex)", "value": "d4e53999535976fda652112c8f66650d9d73ec06", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316485, "uuid": "fa9011a9-fb66-4bc3-89b2-5e0a2b9ce673", "comment": "Malware payload (Dridex)", "value": "98019792e133700a0b7a387d00c7e61f547399d6e0d5d4ed6e2b4a8c9e1daa2ab02b22f0fccd343e9c79167c80010277", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316485, "uuid": "1e0862e3-76b1-4ce0-a325-5967cc84e8e2", "value": "T16BB5D010EF69E1F6C6B89F3E9408352727B93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316485, "uuid": "f2e791f6-7623-404b-9938-4667eeb8ffc0", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316485, "uuid": "724ceba2-802a-483f-8bd3-64926ed19df4", "value": "12288:PVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:mfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316485, "uuid": "8b11146c-2a23-4215-9439-4933390c73c6", "value": 2449408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316485, "uuid": "8f0be5cd-5b1a-4457-8086-e74373f67fcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316485, "uuid": "e25f7955-d156-40dc-b5c9-301fbc7ec181", "value": "d0b06cdbec8316b4e6c2d8cb5d696388a2a54850a4a997129c21f9be171f9f59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e80add-1b49-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632276340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632276340, "uuid": "d7896dc5-940e-4bf0-b9e7-a9b743062125", "comment": "Malware payload (RedLineStealer)", "value": "0eb503cae2ee76417a8608ae3b164bc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632276340, "uuid": "2edb56d4-d49e-44df-896f-f23442917c3a", "comment": "Malware payload (RedLineStealer)", "value": "d2337996fd62094fa4f4691011cda01602b389bff46d2a7f1b8a6c6a1bb0f4b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632276340, "uuid": "c6feff38-e07c-4f25-8fb2-c5d874f240b5", "comment": "Malware payload (RedLineStealer)", "value": "b26ef7ab9e475b7166520f6d55a8e80ad0a3b9ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632276340, "uuid": "e47ffcff-1b8f-4fa5-a9d6-68e0bc275177", "comment": "Malware payload (RedLineStealer)", "value": "9ce0a66c46a74d0ea20d1b5b1c77481e312f1d52ec9e01e2d4f358d616f87c83a7429928a7fc5d29f25bad453ec2f698", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632276340, "uuid": "90d48cf6-55f2-4f16-856c-127084197271", "value": "T18274AE20E7A3C035E5B702F9497A97A8993D7AB16B30B1CF25C226EA56342D4DD30773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632276340, "uuid": "80d4ea06-bdba-4e6f-a90c-e5cc97cc3d8c", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632276340, "uuid": "80a43c59-8db8-425a-8bb1-26534e49e2d3", "value": "6144:CA5aeeZYgckL1emgC133fJ5u7QVASTcl4+Kg7L0DQ2AvfUDoHM:LCZYgckLdv1/eQVdT1+Kg7XRvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632276340, "uuid": "4f338040-b17c-4b4f-b75f-a5201b5a1103", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632276340, "uuid": "fd22117a-9f4e-4dd7-95d7-c65e75bca7a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632276340, "uuid": "abb3a0cd-cb30-4952-91c8-c3c2299262b8", "value": "0eb503cae2ee76417a8608ae3b164bc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396d34a5-1bbd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632326006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326006, "uuid": "2cbcceab-1c03-4506-be76-26f9ee09fd48", "comment": "Malware payload (Loki)", "value": "4ebffc7b677cfa458f6833bc8e0341de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326006, "uuid": "edd00403-add4-4943-a225-9f4be0be035c", "comment": "Malware payload (Loki)", "value": "d2487b8e8d953d349a76d407b4156ec5bf8873621305c855f001a55484a3bfb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326006, "uuid": "5ffbe5f6-9914-4bc1-ba94-65d8612bb4b9", "comment": "Malware payload (Loki)", "value": "20bb2e44e7feea8218210bcdb7c5a258a25de0e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632326006, "uuid": "62e5b0a5-871d-4b18-a653-91e9e97413d4", "comment": "Malware payload (Loki)", "value": "81baeae33f199e02a4a0226dbd53a58233ae703862b10f1442b077accd6859f8f72213c386bafc70f48af290e08fba6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326006, "uuid": "71b4bf7c-5cfa-4e00-83a7-6dfe334e649e", "value": "T19124BF303B91C472C5970E3095A4D7A0567AB92157B1B18B3FA41B7E6F303F29A3A71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326006, "uuid": "74174dd8-b533-455e-ba64-2c0b171fe39c", "value": "eb3a4f4099156f85447a353ba89f6880", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326006, "uuid": "1fd8465d-e916-4ca5-8c0e-78f8bafdcbe0", "value": "3072:mLGO5Jo4E31j1EIqnzX81Nha9I2Z3MXi26Xz5cSOQsWvMkbMLMsVtwWS:3O0fEHTc8kiysMkbMLMsVtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632326006, "uuid": "08cb1671-c9de-4c62-b254-55cddd352403", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632326006, "uuid": "cd7994ea-6010-4e79-be94-8bdaa226403c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632326006, "uuid": "3141e2d9-04ce-43cc-8340-29f2846bd892", "value": "4ebffc7b677cfa458f6833bc8e0341de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac36b16-1bc2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632328075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328075, "uuid": "7c8b796b-aa7f-4329-991b-9f87df0b0c5b", "comment": "Malware payload (AveMariaRAT)", "value": "9b48f0e7c1acdf0529ad18d6f87c11c0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328075, "uuid": "c8409231-7640-4333-9dbd-8a6652a009c3", "comment": "Malware payload (AveMariaRAT)", "value": "d2754cfc2913bbb43c9ced52b6844c8da595bd68f9265696f90c7620e1ac2de7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328075, "uuid": "f8045820-4487-42cd-81ce-25b4a822de0d", "comment": "Malware payload (AveMariaRAT)", "value": "6a2533e9490cbe7e1471c377e8dbaa9ee91f4580", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328075, "uuid": "dcf7401e-973d-4e38-a363-c3c61c9d86e9", "comment": "Malware payload (AveMariaRAT)", "value": "c78548f94bec2e4d471cc1bc11f5e0cce71a975cfdd4e11b6aeb3ebe3eddfa36f60f611b286c761b33eed3a3e99a1814", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328075, "uuid": "7a781400-f13b-4980-8470-f4f6941800d1", "value": "T13B256CE7634ADCF1EC24353ED98675952704FBF02A120C4CEE647E8EA765A81FA485C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328075, "uuid": "c58ce8da-804d-44d8-acc7-be5c19baaece", "value": "91a12f22e7f2305a107edddf42c40880", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328075, "uuid": "65e0cc5c-e22a-40cb-bd08-cd17df945fe6", "value": "12288:FYfGUHuv5bSkBsFkT5m3GpOAz1TeoAdrL7i:FYOUUtBs2YqO8MrPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632328075, "uuid": "52dc365f-6c7f-425a-9daf-ce14e6e0eac1", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632328075, "uuid": "d5a0b1c1-b93e-4a18-8987-80d254db34a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328075, "uuid": "df90a7f5-4321-426a-92c9-4023e4820ff3", "value": "Jrrfsorsdnnsvgfslajjordvmzshfpnerx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4c5bf9-1b6d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632291841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291841, "uuid": "257b9358-a4b8-41fd-8f69-5c1913d61e41", "comment": "Malware payload (ArkeiStealer)", "value": "c211032bcf021e63c09f280334ac6715", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291841, "uuid": "928bb516-679b-4c54-b795-095d6f72a671", "comment": "Malware payload (ArkeiStealer)", "value": "d2d538e6714eda2fb624118d30db46c384988d16c56bbc2d51482091e5c0aa0f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291841, "uuid": "371f0980-3b92-4ae3-b057-4c9baa7d8136", "comment": "Malware payload (ArkeiStealer)", "value": "c2daaecb60d3d869a5537870dc76a877cff6b6c5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291841, "uuid": "4d903456-fbd1-4e74-89e3-fc8b3d9ebb2f", "comment": "Malware payload (ArkeiStealer)", "value": "d1592f64bddb30e800c403ee4670fbc1e09a2dc2f72aea45957f274f1a9bbcd64807f8294b1d3589077afbca82a13748", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291841, "uuid": "b5ed3d5f-5f60-43ce-93a7-6c19dc9c7e6e", "value": "T1BDE402123D92DA35C5B748314860D6F0127BF422F9A4DD4B7BAAFB6E1F702504B2A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291841, "uuid": "5f9037b6-0320-4ab2-a6a1-c4dc7968a850", "value": "6b158934b5de6d6c87c216a76be114df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291841, "uuid": "3a3d929c-1be8-4d82-958c-0d9d8cd5abed", "value": "12288:rk+6/861jeNFQi6aW9gRjy2aFqFDzj7ZpOBay:rV6/8XFJPW9gpy9crlsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291841, "uuid": "c1b133af-3f21-4dd4-8fa9-bf05e28a21dc", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291841, "uuid": "cf78b7d0-d83c-4526-b7a2-ec1a29a98765", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291841, "uuid": "940a1a53-59ec-4b63-a155-fd823b22d9c7", "value": "c211032bcf021e63c09f280334ac6715.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3553202e-1bb5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632322563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322563, "uuid": "e827b2d8-a86d-48f4-8e53-2afb05e5328a", "comment": "Malware payload (Loki)", "value": "ea6ef645d618f62f9b0253846fe1dccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322563, "uuid": "063ced2c-436f-459c-a190-ce87c995dec6", "comment": "Malware payload (Loki)", "value": "d3da13bac62e546e6c975e8e5387b145f41c84a7a27e7e208adb18c331449175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322563, "uuid": "db51a3d7-60c6-4b08-9cd6-bb0209376683", "comment": "Malware payload (Loki)", "value": "12f8f907b411909ddeff26248a2f1a852d0213af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322563, "uuid": "a5889e18-a366-4dd9-a7a5-e199d4956f88", "comment": "Malware payload (Loki)", "value": "99e7e4acce305c1ef89bb12902262c568cdbea91a4be51921b35d6d314836fee46b807135f325aa3fa384d0460e5cac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322563, "uuid": "3798826f-0928-4d18-9037-048824038cc2", "value": "T17284E0C89664F7CDC70F01B3A079FDA05547FCABCC02AA37241BA65A71A7056B98F364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322563, "uuid": "348e2bf5-6e2c-4717-bbc6-7beafb76b581", "value": "519d67c716fdf0c852e432342bc580b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322563, "uuid": "82ee9c00-8f1f-444e-a9cb-227f58c2af6e", "value": "3072:RaGt+nz3Aaw1cK938HAeD3zYV+KolvoSXD:UGt+zzwf93De7kVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632322563, "uuid": "02218056-09dd-4b9e-8549-515dc7e5b6ec", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632322563, "uuid": "284fa69d-7cbd-4cf2-8869-fb8c75df7b54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322563, "uuid": "ddecdbb4-c497-432d-b1d0-038ceeeb3e69", "value": "D3DA13BAC62E546E6C975E8E5387B145F41C84A7A27E7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2c7317-1b8a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632304296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304296, "uuid": "2d1b64cd-d054-479d-b494-75ace8fcdb66", "comment": "Malware payload (Loki)", "value": "014c2e92efa4666879aa2bfae030be10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304296, "uuid": "3af6f932-8947-4676-93e5-e0323d4be128", "comment": "Malware payload (Loki)", "value": "d4000f335f53b65bd47476d6367d470df6a8f345b7f4b0750bbba73abaed5942", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304296, "uuid": "c2745b11-7c92-41e0-bd4e-1b0c107f7842", "comment": "Malware payload (Loki)", "value": "41334fd2e39125ebddd8bb6c26f2cba27d7cd46a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632304296, "uuid": "abe9946b-761d-4ef0-8151-59046cf00fc8", "comment": "Malware payload (Loki)", "value": "88e8ce998a84c19d004bdf1e6d28635996bc86987aaadb6bde205393b538ccb94eeee7b00a982f0285c94a19c24e4b50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632304296, "uuid": "0aa292cb-9974-4d98-ac4e-813ed03282b5", "value": "T13AD4E09D765072DFC82BCEB69A642C60EB21B56B530BD313A05321DD9E0D6EBCE111F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632304296, "uuid": "d42e3bff-71e5-4158-b1c5-8e0ea17098a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632304296, "uuid": "74c477ea-bec0-410c-bac5-3b4982da6a37", "value": "12288:DjOmtiK5oBuzGX602cAZNBgkxZBMr2chYCmwFJ7bu:DjO+FoBuzV0vAH7Zur5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632304296, "uuid": "45c94527-f61d-4e9e-83be-48ea4eb94b91", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632304296, "uuid": "5a08deb4-3ff2-4947-aee6-b202eb01c5c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632304296, "uuid": "e3e65e50-48cc-400b-b62e-9a07353f79b7", "value": "014c2e92efa4666879aa2bfae030be10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c4d580-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632317013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317013, "uuid": "1f361c30-143f-4fac-afda-7386fded5def", "comment": "Malware payload (NanoCore)", "value": "ffba1dd3cf0a0a0963a656a10159baeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317013, "uuid": "d4cce6f6-3a71-44d8-a0f9-90f9c45ddf70", "comment": "Malware payload (NanoCore)", "value": "d4b95cc51509a1b2031d5512166beb0ee263dbb01b8484ca516e876e9d7be5cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317013, "uuid": "9674d764-2fc5-40cd-b8dc-1d6748eeb12b", "comment": "Malware payload (NanoCore)", "value": "13140189949929261ee48749f208934ea0af012e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317013, "uuid": "ec7d120a-ff43-48af-96f9-dbe3625d4745", "comment": "Malware payload (NanoCore)", "value": "7b648f9b6ae63be8423c1c112c0a766a34423d2797d3b9606ad453690a80a89d19cc4ec7a2c03f145f796b91b4ddbd54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317013, "uuid": "6435e7e7-6a1f-40c6-8ba1-72d22ef13632", "value": "T1EE14CF6A7BA88A2FD2DE8579601252038379C2E3D9C3F3EE18D455B74F167E40A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317013, "uuid": "ce88e0c7-6e17-4d36-b573-9a6b5fc9ddd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317013, "uuid": "b906edec-666f-47fa-91a4-a8440f04179e", "value": "6144:QLV6Bta6dtJmakIM5AlE4UXkD2rovrO6mlOK:QLV6BtpmkP24ttvr5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317013, "uuid": "13552801-3bff-45aa-bf80-3c6c0e469c60", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317013, "uuid": "f8637810-0af6-451d-b7b3-470b55833bfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317013, "uuid": "178413aa-d3a7-41f6-b44e-97e28c2fa950", "value": "d4b95cc51509a1b2031d5512166beb0ee263dbb01b8484ca516e876e9d7be5cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3085e1-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632316723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316723, "uuid": "380721d1-10db-42f8-9147-eca7954444a2", "comment": "Malware payload (njrat)", "value": "87665d443c7a883a9605213fa5028662", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316723, "uuid": "b9a41f19-0a19-400c-9d04-b70daf253dc1", "comment": "Malware payload (njrat)", "value": "d52a459560622be3d8ab5d46ccface98acb49641386b971d427784d9f14e413e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316723, "uuid": "233e1b4a-1aa8-446c-bee3-2425484ad1c0", "comment": "Malware payload (njrat)", "value": "04f910763ed46eb2b40be54f42ad7b7e4b149dd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316723, "uuid": "61300c7c-83aa-4186-83eb-115e086cd20c", "comment": "Malware payload (njrat)", "value": "a96ace1de93ce5ea1892fd9a262ea55bfa1d31bb78dd49224481091c73000e7b4d10474f9ad6b750b918edcadbaff2f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316723, "uuid": "7a28d74b-e54e-41db-a725-77e0328d1bee", "value": "T13A553366F1386DB8C86159B4954C31AE064ADB8A7032BB741DAED2F7DBF20C6B40D743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316723, "uuid": "1e50b8c4-9813-4ec0-a3e6-12984100a358", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316723, "uuid": "bc42218b-9781-4806-964b-338b90f04696", "value": "24576:OABeEjaBVjKpopSzdrpyQxzcVPR6hb/ne5PP8zpuRxujD4FyC+3dec09fKy5vOvr:JeUCjK1hzQ5RMmSrolRKy5vOVBVYCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316723, "uuid": "2f50c880-6b44-4526-a14b-0ab3664ef301", "value": 1285120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316723, "uuid": "b4eacbfd-76de-4ea4-ae01-1cf8fe96a3ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316723, "uuid": "a0fd6b14-60b6-47e5-b09d-d6ec1eac25bd", "value": "d52a459560622be3d8ab5d46ccface98acb49641386b971d427784d9f14e413e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce3c5cd-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632316295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316295, "uuid": "d82b1cc0-19ea-4752-9469-34500d6d2590", "comment": "Malware payload (njrat)", "value": "4b4dc6e050a52577e40b23eb0f2f1643", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316295, "uuid": "cd9a710d-dd85-4838-8eed-97518d702865", "comment": "Malware payload (njrat)", "value": "d53390e08acb0126eceb6eba27a1d9a0ce74b0441961f1f6ac1191ab61ff94fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316295, "uuid": "46a10133-829b-4929-8daa-469f60a8bae4", "comment": "Malware payload (njrat)", "value": "adc7f113b6fb190df89c41147a01206ab85411c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316295, "uuid": "9f47a301-0041-448d-8ff0-8584be7a4e5c", "comment": "Malware payload (njrat)", "value": "f102013af9796582dc5f56c78742bfb1f00ca1179175156a2acb70ee7c8022e5b9b9828b408250e088227bbc4f1d8655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316295, "uuid": "09031642-c2db-4e03-b29c-3d4a7696a342", "value": "T174063349B792DFA4F6EC60BDF921FBD81CA67601F18D71F5E514934A2E8E004A9CE0B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316295, "uuid": "7467e31a-ad96-49e0-a39d-79b38f1d5afb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316295, "uuid": "17372bdc-795d-4c00-bd88-fc063e585619", "value": "49152:FEB+WeqgnpnBk3qj39o9VM4NdqWN5nk+kTpy/Bwokw+k0IiqZgEnn5DHuyWk:uB+fbnFBk3qW9VM8dR5geyQmFq1Vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316295, "uuid": "893bae12-5271-4ae5-bd04-75a163c785e5", "value": 3833856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316295, "uuid": "7e4941bc-f374-4e59-b420-65bfdca339eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316295, "uuid": "2af70501-4c97-40b5-88fb-66138661a630", "value": "d53390e08acb0126eceb6eba27a1d9a0ce74b0441961f1f6ac1191ab61ff94fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4b04c9-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316508, "uuid": "9b54f958-e61d-4e1f-b718-90d8bcf743d0", "comment": "Malware payload (Dridex)", "value": "d00449b06137bb62ec09d8d3f7e6c988", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316508, "uuid": "81dfe827-0024-47c0-837e-e088cbcb6ad0", "comment": "Malware payload (Dridex)", "value": "d564d4cb819ae42de35df9082e9f6dd628f9aa2c5830e42e644a03e2f53b67d7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316508, "uuid": "a1db80db-0410-4dd2-bd33-a148e578990e", "comment": "Malware payload (Dridex)", "value": "ce6b9af1efa21274fcc3765616d27333066386de", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316508, "uuid": "b15718d5-a86c-4e72-97c4-46cd898e786b", "comment": "Malware payload (Dridex)", "value": "1710c1e61caae207161dd59d4d57d6e3ae24a8254f4eda8a0e88e68971c3839843e13a7010b28978f41fb71430920571", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316508, "uuid": "f37b7b8e-b188-4e19-9ca2-4a05606414a1", "value": "T103A5E020EF69E1E6C6B89F3E9408352327F93D75110D608CD392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316508, "uuid": "26b3eea7-0a61-42d8-95d1-29a0108e8739", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316508, "uuid": "1e7c2b2d-abbb-4603-8c14-1b969f596b70", "value": "12288:aVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1D:HfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316508, "uuid": "0e539c96-3c71-4a78-8b96-8be696a991bf", "value": 2256896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316508, "uuid": "b4584efd-2ee4-4e65-8a22-f5201f19309e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316508, "uuid": "f8448caf-ae4a-4bfd-b511-9e494d91c27b", "value": "d564d4cb819ae42de35df9082e9f6dd628f9aa2c5830e42e644a03e2f53b67d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04ff94a-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316381, "uuid": "8bdff480-ab4a-4c83-a50b-459855574f8d", "comment": "Malware payload (Dridex)", "value": "83cca249d898bb2ca10c60767aa7ef7f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316381, "uuid": "07ad671d-5b3a-4b9f-984c-e389f35789ca", "comment": "Malware payload (Dridex)", "value": "d58a34c09c98cac2a888f49d5e9d793c0000c968ce1e85e7f82cac77e995b748", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316381, "uuid": "131f729a-ba7b-4ba3-95f4-846ff038fb46", "comment": "Malware payload (Dridex)", "value": "7bf148c4046981d44259b4e6f00c77e0d67e5197", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316381, "uuid": "a96e98a6-7a96-4740-be7d-aa2fb839d360", "comment": "Malware payload (Dridex)", "value": "9122c0957fefda16d9def2c2c73a7d9a138b06cc411a9ce813b6fa30c7e5d143bb668727933d88132a6b8bad130ede54", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316381, "uuid": "0999086c-516f-4985-a760-6987d4d1151a", "value": "T188C5D020EE69E1E6C6B89F3E9408352717F93D75110D608CC392608F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316381, "uuid": "0b33638b-6890-4d90-b715-fb9bf5d0a4a4", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316381, "uuid": "1a4520bd-f7fd-4efa-ab62-65f67c3fc6b4", "value": "12288:XVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:efP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316381, "uuid": "c7df2ce4-5be8-41d5-abf8-8f2c3f7a3846", "value": 2658304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316381, "uuid": "8c3c7cf4-2c1f-4b9b-b7bc-2bfb9dea19dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316381, "uuid": "4e86915a-3ba0-48bd-b76e-fa92008ebc86", "value": "d58a34c09c98cac2a888f49d5e9d793c0000c968ce1e85e7f82cac77e995b748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b907024-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316480, "uuid": "74635483-433a-444f-8a81-77905bc5dff7", "comment": "Malware payload (Dridex)", "value": "c24bc02360f0bc5baec9debde4b71114", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316480, "uuid": "27762244-ba8e-45e6-96a7-f6c44b9d29f6", "comment": "Malware payload (Dridex)", "value": "d591f868bd400b91478b5df6566460b8172e02de48d6f7e5789006dc6d812267", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316480, "uuid": "58629bdd-4e7a-49eb-952d-737ff69b036a", "comment": "Malware payload (Dridex)", "value": "4b494be8ae9cf8e993a619c225dc96b06a4d900e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316480, "uuid": "56516a80-690c-4b6f-b8a2-bcc3503c6dc1", "comment": "Malware payload (Dridex)", "value": "789876eb9d7832a19427511720411c7c557a3a09a59fdd004c9fdf328b6f7883302f949e148c70872de1799310ce18fa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316480, "uuid": "2c74a304-84ed-47aa-a728-ffe54463c7a9", "value": "T1F7C5D020EF69E1E6C6B89F3E9408352727B93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316480, "uuid": "981487fc-48b4-4433-bdeb-8e794b356af0", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316480, "uuid": "37918a1f-f539-4606-8800-a7293d878401", "value": "12288:OVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:TfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316480, "uuid": "1b4dc494-6423-450e-927b-3a92bf5d36f4", "value": 2519040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316480, "uuid": "4c1df64c-54aa-4d2a-83e7-1720a489becc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316480, "uuid": "1f69bfe1-bcf6-4fac-9bdf-03fc529dbd25", "value": "d591f868bd400b91478b5df6566460b8172e02de48d6f7e5789006dc6d812267", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c936cd8b-1b9c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632312074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312074, "uuid": "6f428d18-9cf2-4097-8793-34634c29d794", "comment": "Malware payload", "value": "69e941a67a0bb5d95ad841af938066c7", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312074, "uuid": "c997d9f0-7195-47ee-80bb-26cc3c82b492", "comment": "Malware payload", "value": "d5c678abab0d9e738f0cd31e667551ec089989e82b154bc830129ac2ae4c2bd3", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312074, "uuid": "9c60e6ad-9e36-4dae-a2cf-8ef4d0950053", "comment": "Malware payload", "value": "b8874d089695c42b9252c5aaef29e5cee01a41dd", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312074, "uuid": "9b87aeb7-36b3-4200-ba8c-844adbdf15fa", "comment": "Malware payload", "value": "15fe3e6189ebdc1c2c4caf8eaedc9d1c7dbfa720ca9a6eb33f0448db099b7344298993ef227ec07a32e98d116e107535", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312074, "uuid": "fb9e3648-abc4-471a-87f0-f1d1d7ce010b", "value": "T10DD4F1925CA3085FC8F955BFEBA21CEE2007AF49B564E911437071A207BFDD1BC5A782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312074, "uuid": "540619a1-f71a-4d14-a937-c363ef217a8d", "value": "12288:xoHe9KH0YooUK7hB1K6X+yw8/JAfY1X3XSl/m54oK:KkXtahB0Uw8/tXsO5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312074, "uuid": "a5848710-a704-4076-82dd-66db793cf82d", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312074, "uuid": "c36f8571-6672-4a02-b939-5145946beb4e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312074, "uuid": "8e0cb6a7-6ba2-4888-89bc-c004824f817a", "value": "PRODUCT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a459c329-1bbb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632325327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632325327, "uuid": "44fa6e6e-db68-4738-befe-f4b3f22a4511", "comment": "Malware payload (Mirai)", "value": "687ec84da72e198ef32f2461bd65710f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632325327, "uuid": "a1def755-9c15-4b15-a644-4de6def73131", "comment": "Malware payload (Mirai)", "value": "d5d0596f0e2121eff480eaf551b12574340723b23b6db202173c0f9dafde697e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632325327, "uuid": "756a346f-6e8f-4456-bdc7-b9c56d665fb0", "comment": "Malware payload (Mirai)", "value": "c6cca83ba9e181e1615a72324d128d02a7124745", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632325327, "uuid": "668a28b2-d348-440f-b89a-b96adacb1f50", "comment": "Malware payload (Mirai)", "value": "dd65632ff80655b1f0f4917ad8598a30145a8c50cae16faa50340550c3e50ec28be4874f2ff1579ab9399467ea80eeac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632325327, "uuid": "4277fb25-dec1-430b-ae3b-0d72ce04651c", "value": "T1C464E18AEE01AE35E9C016BABA5F034D73774BACD3D7B111F610C72936DA64A4F76084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632325327, "uuid": "b0694999-fb38-4323-addd-d13e9c835a53", "value": "6144:p3lOYoaja8xzx/0wsxzSiNa77oNsKqqfPqOJ:p1CG/jsxzXNa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632325327, "uuid": "2e06a9b9-747e-476c-8ea0-98f503f5615e", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632325327, "uuid": "21ca2a51-d1ca-4309-8dfc-0b8f14a60287", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632325327, "uuid": "a7d6f29b-5fa6-43c1-ae5c-b5324e57144f", "value": "687ec84da72e198ef32f2461bd65710f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba694619-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632316774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316774, "uuid": "6b254be5-0688-459a-b25a-50dcee422e21", "comment": "Malware payload (Mirai)", "value": "7484fe33e17f57aef6a26f54bdc37ab4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316774, "uuid": "b3b31573-db02-4db3-ae7f-3c38df1edd4d", "comment": "Malware payload (Mirai)", "value": "d6d1cb815c73d171aed8303047fece59815876b1dbcfe22206e70437cbe95fd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316774, "uuid": "283598da-f455-4d2d-a632-f9dd36eb2e29", "comment": "Malware payload (Mirai)", "value": "ecb72a926c3460e9908b49c5aa1795b172c52cd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316774, "uuid": "94d85baf-f9ca-4582-9679-141bc66910cd", "comment": "Malware payload (Mirai)", "value": "faeeb45e2c6820562262f820df66b671adb0f1f433ff6abe594e2bacf5aa0ddfbbdc52e12c43aad378b2395cb9fc219f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316774, "uuid": "bfcb2330-2356-4102-9655-1a1525fa5a30", "value": "T1B1F3A53E7A21AF7EE168827107F39F70CF9529D326A19341E26CF6185E7128D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316774, "uuid": "8b20a5dc-1c87-4aa4-b2aa-fa6674d113d3", "value": "3072:B7esBFP23rWfOB7ZOOyGdWKmrThPaLEne7rNb:1euCloGdrmrThPaLEne7rNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316774, "uuid": "8310be88-6023-4f6b-a227-8f682d39389d", "value": 159493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316774, "uuid": "eedd5c0a-a1cb-4c6a-accc-5ddd67f0bb73", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316774, "uuid": "e8b1ef87-c517-4b00-90b6-65c41e359609", "value": "7484fe33e17f57aef6a26f54bdc37ab4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ff920d-1b69-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632290141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290141, "uuid": "fa716b30-6f32-4311-849d-ef5dd93ee95b", "comment": "Malware payload (Loki)", "value": "d492220a102bcd6275f5b8a0de6c166b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290141, "uuid": "ffeb91d1-a433-487d-b209-a9acba02fab9", "comment": "Malware payload (Loki)", "value": "d79d417721919524792003ee0401b967915932430d7272d4e5a27f7bf8115dd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290141, "uuid": "cb08822d-b5fe-4262-95a4-252ee84c44a6", "comment": "Malware payload (Loki)", "value": "c77a08eebac3baa915614c33e1fb3bc0641cf9bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290141, "uuid": "e4e4b87d-a68e-49cd-b5fd-13f665ed519d", "comment": "Malware payload (Loki)", "value": "91e4ee596207b97102d27370f0466897b6fc1da0f02cc19e8f2adb4e10aadeb8493b5c695d23feb971103d910d1545b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290141, "uuid": "942f191f-f208-436f-8ccb-07a7f15f220c", "value": "T116B41235C66DD363DDA987BE20A200461776F18D7623DB6BBFC1B098EC07B534816AB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290141, "uuid": "441358bc-42d7-4511-8a1b-f05d5236c258", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290141, "uuid": "29e3f19b-e4b9-430f-ad4b-38339c46023f", "value": "12288:H1AfmtiK5oBKkQmHja/ULsOGA91UOcT7F:u+FoBcmHjwULsRA91g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632290141, "uuid": "63af176a-e49e-44fd-846c-7202ca219bc6", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632290141, "uuid": "e29ac53e-61af-424e-8989-b26c0ac99538", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290141, "uuid": "96a807fa-65c1-4508-9e2d-63ae3fa738db", "value": "TNT shipment Documents_87993766478.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d44ce6-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Osiris)", "timestamp": 1632316999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316999, "uuid": "4668ba3d-7d98-4f41-9520-84c5e1d1e463", "comment": "Malware payload (Osiris)", "value": "abac8b5fb6a305939c7ac38ea06666bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316999, "uuid": "d2d3e972-a66c-4bac-b75c-ff9104d593d2", "comment": "Malware payload (Osiris)", "value": "d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316999, "uuid": "2d602a18-bc28-4659-bf83-6427d6321afc", "comment": "Malware payload (Osiris)", "value": "b42bbb582a8bbf08e865e5181dba0f67c659763e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316999, "uuid": "4abb0e1d-0d2e-4300-b987-671afdd1747a", "comment": "Malware payload (Osiris)", "value": "75862cbae1c83a55ec44ca20b667e8086d1a19fc9068bba1ccb858673b12c67e44faa73ccf16bb4ba0c5788c80fd2a31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316999, "uuid": "bfc62057-14e8-462e-9692-636ff91b79ce", "value": "T19194BF22F581C036D6B102B0CAAD7F3B97FDE524033559D7BB8809951EA44E67339B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316999, "uuid": "3d871008-86ff-4e8f-9d68-0484c4de8a99", "value": "cd3fc0dde37bf2787f0f054ef3b5a350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316999, "uuid": "276d4ffc-cd6d-4f03-a86b-16b1fad4a1e7", "value": "12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK95OTTsx/SA/WegYfdNbrqnuw:rXh6XcBXo8TsL8Y8m4OTTySA/DrfdNbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316999, "uuid": "947d7565-affb-4715-9de9-e64de8afba3a", "value": 444938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316999, "uuid": "280a1907-325c-49b1-ba94-d73773553a20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316999, "uuid": "45dc47c0-c918-474c-b7f7-546aa48372f7", "value": "d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b213c469-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632289701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289701, "uuid": "65ee775f-d588-46db-b6f2-99be7c66049f", "comment": "Malware payload (Loki)", "value": "ef3c94ecf933b29927f2e112a883a48c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289701, "uuid": "e26d298d-5809-4f1f-bb76-70e0db0d0d73", "comment": "Malware payload (Loki)", "value": "d7ba7686068a30baeef58c6e213beb0512324abbe38ee76cfae69c7dec00b1fe", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289701, "uuid": "35bb1345-da68-46dd-b00d-691faa6bb7bf", "comment": "Malware payload (Loki)", "value": "53ae287a0d4ae367361386373a689970ab3c1cd5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289701, "uuid": "8045fc6e-5c1c-4b0c-8830-af9a5c79161f", "comment": "Malware payload (Loki)", "value": "3f1de3ffcd1b11465983b113421e5e36b80347e2f5e9015f7b5ed20ffdaf22d21712ef89c09bbf262e3455447b216ba2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289701, "uuid": "2c14a32f-b977-46eb-9f2e-b67e56e4d52c", "value": "T116D3020335FA2CE0D395A87198A6A8F78436FFE5C11D27BE1785390F1ABE084917A177", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289701, "uuid": "ff1e3280-0fd7-4ea4-99e3-cefac4491090", "value": "3072:JKSYHdAauzf6KoGOc1gLRsNOJBudOr1g+cv0eu9e095CM:ktHdAvoVwhcgtu9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289701, "uuid": "20bc2fd3-6099-469f-a1c0-fd82af80e822", "value": 132440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289701, "uuid": "3ecf1d10-8f70-43e5-9223-6eb4256e7107", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289701, "uuid": "6fe60ba2-cddd-4161-bb69-948f102cd270", "value": "50K Fertilizers.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a72418-1bcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632334045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334045, "uuid": "1f2ea385-b7df-41a5-b85c-0e4eda3505f6", "comment": "Malware payload (AgentTesla)", "value": "ee9109a66361d111af05398b5203320c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334045, "uuid": "cae91a01-2199-4bac-b707-27cff576174f", "comment": "Malware payload (AgentTesla)", "value": "d7e04b393a25f29b335ec5b662fa6d11c9ffecb977151036c3a51281298a920c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334045, "uuid": "2c220c83-5ca4-4b5b-a97a-8c1685a7fbe5", "comment": "Malware payload (AgentTesla)", "value": "afdb6112622397e2671c0a887695f4a37df4fc9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334045, "uuid": "321816f7-ace4-480d-ae03-f5a08f7e595d", "comment": "Malware payload (AgentTesla)", "value": "feae5d4cb75830e77f4becc775067f6d0a8893681ffd55adb11fcf167ea2dbb1a9390ddeb3bb99ba79ea8939f8238000", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334045, "uuid": "ab2030c4-6954-4a4d-a916-b6a6f17a2624", "value": "T124058BC45D884613C7A44672DD5C624632296C0A3723938BCBE53DBB3FFE283D62D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334045, "uuid": "4e09b014-a85b-40f6-8fe7-c8d57c5df3a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334045, "uuid": "84ba1ac5-ddeb-4240-90e6-cc71c447c065", "value": "12288:5YmtiK5oWVjmb17Jj1HuQ0UscA6Vj7/nKRRq3yGeC1qyRc1PekCwk:i+FoWVah7Jj1bZnj7y3q3mw+sLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334045, "uuid": "2a9cc3a4-1bc6-4a63-bd53-bec2e0ed1957", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334045, "uuid": "9f714c57-badc-4783-812d-ab46c3a7beff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334045, "uuid": "e87e4295-681b-463e-a4b4-6c1668a7ccb7", "value": "ee9109a66361d111af05398b5203320c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01fc2077-1bc4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632328920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328920, "uuid": "67dbc5fb-6df0-4495-9955-bcdb2ae2ca72", "comment": "Malware payload", "value": "e7f38e62072436795c51509cf6bf038c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328920, "uuid": "330c7b2a-d3e4-485b-8b87-f789eed55d8b", "comment": "Malware payload", "value": "d80bcbdadc0c0a9a13fa0472b9fd115d6f86ddc12e8cef9a1b3525d5be41b33f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328920, "uuid": "cdc822a2-e4f2-439e-8d63-c7b8fff5544e", "comment": "Malware payload", "value": "8d948fa52434aa4a34c94e330e34886cb725e5b6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632328920, "uuid": "1d16f8a7-6e8b-4bad-865f-6c0aa9993bc0", "comment": "Malware payload", "value": "d08c0b37b0fffcf396ce378417e2e7d313a5d0d5009b701df0139057b714177c628113feba16509aeb8e489bf7e14664", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328920, "uuid": "f763d08b-9fa2-4ab5-a1c4-13882e1fc56c", "value": "T17C04CF198AB02F55CE4F1E07B42B55CA2D60F97EF4C9B5CB7C6EA91E3FA2000513B169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328920, "uuid": "783fb2bf-c1b3-453c-a805-9978e3c5193a", "value": "3072:6pxz8BmQvHdXPBLELSXqvRYQrKb6VtONVSMJb3OxqpbAVDaChIxQEIr0bVrE5LQ3:6XQBmCHd5LELSXqmTitEVSMBOYix9I+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632328920, "uuid": "d4a3c957-af3e-41b7-85e0-d0d40ff8cb49", "value": 190244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632328920, "uuid": "0e8c4555-259d-4d94-9ab9-6f1077e12793", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632328920, "uuid": "3718ee7b-97ea-4472-b07d-de368f965b25", "value": "Quotation Sheet.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fafbdaee-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632316882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316882, "uuid": "34e4d68f-2298-451f-85c8-89c152564c6a", "comment": "Malware payload", "value": "34979cc2338e3770164b72d8700d6794", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316882, "uuid": "bab1d3c5-d7f6-44ea-93c7-9f1220901a19", "comment": "Malware payload", "value": "d8cc416bba8f37d9696c77c7681fdde17e5e8f29f70bc0996407e4e72c733833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316882, "uuid": "186e85a5-5c14-4a73-9894-f3ed10bf49c8", "comment": "Malware payload", "value": "936b01b96c9aac30088b4f3ae18962c4af3dfa13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316882, "uuid": "e9728748-04a3-450d-88f7-58bb6b32d15f", "comment": "Malware payload", "value": "d7177f9aa86af0312d5406fba1f7970d49e6c7191c267e6ccf50f1cb99c6f7501d382903fd6fcb50d8c30058af39adda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316882, "uuid": "2c14819c-7e9c-4131-87ba-1e52bd3e6a9d", "value": "T1C5F47D1285FA73C7F12270B1515BB8F744D1B8F249D7A861712A3F0DEDB9902AF8B216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316882, "uuid": "9e650310-0e2c-4268-b4ba-8433c75555ef", "value": "514c554c4eccf8b5d18d8453867113c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316882, "uuid": "3a23cbef-9c8e-4115-bc3a-762fe4533a7d", "value": "6144:PFKiOzC8VEXAouuoSMSeXVgKEaRIVgraV8wYyjPC2TOjITsE9htl7mc4onhaw/BF:PHkVE/oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316882, "uuid": "a699a5e3-ca02-43c5-b3c4-a75774e05fa6", "value": 745768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316882, "uuid": "a9aab849-9c01-4091-bd3a-0723e2bd0198", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316882, "uuid": "efadb3ee-24d4-47ba-8f62-caf48f754ccc", "value": "d8cc416bba8f37d9696c77c7681fdde17e5e8f29f70bc0996407e4e72c733833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753c8a0a-1b6f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632292606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292606, "uuid": "6b3bad9e-5785-401a-acbc-bfef9e64aead", "comment": "Malware payload (Loki)", "value": "aa53fa17f4a2fbed593979efd1c41a17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292606, "uuid": "6d080fd4-225d-42fc-9217-d8924c6d7cd6", "comment": "Malware payload (Loki)", "value": "d8d1ebdb241277b39607ea8d4c63853c25b6523a3a88d720373a0f9efd03a686", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292606, "uuid": "eb0c5fb8-d77c-4265-8b9a-27a9e684ecb9", "comment": "Malware payload (Loki)", "value": "d18ed2cc59e8eb8b8fa980c54ada05e075e939c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632292606, "uuid": "73f383a9-73f8-4599-89d1-de66a3bfc037", "comment": "Malware payload (Loki)", "value": "4b38277410a6a2fd4226f9812c9dae012d6e7e0ecd462317b9c50cfd58226c01a57c83f06b92d55d9d81af9d85a865ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292606, "uuid": "2f88828c-a94e-4458-a94f-61a4ca6071d3", "value": "T114341266B5C246A3C98646B017B3BE7EF7FF912242131C8787980F751A2048FE95B78D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292606, "uuid": "b05e4303-8241-41d7-8ffc-32487a6f2538", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292606, "uuid": "27b61312-c34f-478a-baee-4d4f956b2ef4", "value": "6144:R8LxB/LfCQSL9LC2Qh/3Y79ShIJq1kVeEHDg:Mz3gLCjAkl+Yo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632292606, "uuid": "0eb3a6bb-c60b-44b1-a1e7-f393f82ba4a3", "value": 251261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632292606, "uuid": "a03c4886-fa0b-4cf4-8c3d-4573bda3c858", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632292606, "uuid": "a883b599-f621-40d8-9078-9098f11dd4d5", "value": "aa53fa17f4a2fbed593979efd1c41a17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af022bc2-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316325, "uuid": "8ebef5a1-55ec-4fae-a22b-cdc58036a454", "comment": "Malware payload (Dridex)", "value": "fd6f9a283fdb6e98a140de6e83bf7234", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316325, "uuid": "6d4fc096-b370-4f45-9618-b858a05e1c79", "comment": "Malware payload (Dridex)", "value": "d91ccc7a9c9e9c8abeea8b7c665459c937bab61a0589de5a5c22b906cff05939", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316325, "uuid": "b8194abf-9f80-4578-9099-fac0f4ff9ed3", "comment": "Malware payload (Dridex)", "value": "8d9f83199024edb30f16c452207b0469a2f0319a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316325, "uuid": "1990a300-161c-4e87-bc91-e745f83ea006", "comment": "Malware payload (Dridex)", "value": "994c4937204384420d3e9e398b7575d2e03a83590e535d9abb5061c2c5fe80f1aee9c5b48a4e5065a3e5f3e8545fe2db", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316325, "uuid": "9f180987-adf0-44b4-a430-f051973d8add", "value": "T1E8F56B10FFF205C3C09DF73D789D3416A2B3AB65811F8A1D824E131E6CA5B512EAE95B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316325, "uuid": "182751ea-bc7a-4907-b03b-8927f81561f5", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316325, "uuid": "b6f1bdaf-befc-4101-a0a8-a023a480664d", "value": "24576:yfP7fWsK5z9A+WGAW+V5SB6Ct4bnb69N:GDW/e+WG0Vo6CtSnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316325, "uuid": "072e1de6-7f56-47b4-b43b-bea23d15f68c", "value": 3334144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316325, "uuid": "0afcbd43-f5d3-4046-9065-7846601a8708", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316325, "uuid": "8d0d86e8-a7cf-4b6f-9136-ee334d382934", "value": "d91ccc7a9c9e9c8abeea8b7c665459c937bab61a0589de5a5c22b906cff05939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255d5033-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316524, "uuid": "9228f2fa-6831-4c39-a783-ba133458366f", "comment": "Malware payload (Dridex)", "value": "9e88cc2923ead601a4c6db845bcc2ce2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316524, "uuid": "8a926db2-9d38-47ac-ac7c-bf759c8e3a93", "comment": "Malware payload (Dridex)", "value": "d9398dcbae023403cbbbc495a8c2d0798d6444bcf456e6a3d3d3bf840e3c1de1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316524, "uuid": "68910f54-a277-4ec7-864e-0663cfbd38de", "comment": "Malware payload (Dridex)", "value": "d4236288af3ae6e69324a70cbf4f144e94fed6e7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316524, "uuid": "ceec6d5f-c543-4aa1-b8e5-c8974e880c31", "comment": "Malware payload (Dridex)", "value": "da2c5258b9e26e50ae5ddc7a432216473fe996d5e05516fa7ed77b4b82b58826eec943970d5cdbd9ed9d71996cb742d0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316524, "uuid": "b64a96f0-85f1-4ebe-8c90-2dbcf9dae099", "value": "T12CA5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC396704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316524, "uuid": "d4ba2c8d-3de7-4ede-b4f9-a3009dc101cb", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316524, "uuid": "56566a13-c9d4-4e9b-ba64-b1ff882d8f09", "value": "12288:mVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:7fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316524, "uuid": "fc4387bf-863e-4f88-aa08-b9cfd4bfaa0c", "value": 2195456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316524, "uuid": "cb413720-6df4-46a8-bd75-7a037dc7d815", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316524, "uuid": "488bd4ef-333e-4e0e-8134-fed986bb04e6", "value": "d9398dcbae023403cbbbc495a8c2d0798d6444bcf456e6a3d3d3bf840e3c1de1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237723fb-1b6d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ServHelper)", "timestamp": 1632291610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291610, "uuid": "62917297-8675-4962-b4a4-52162f707548", "comment": "Malware payload (ServHelper)", "value": "61d5e32562d1c70daf0a3112f7888258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291610, "uuid": "dff63ff0-2091-4e8d-b4e4-632399d4b945", "comment": "Malware payload (ServHelper)", "value": "da012f669961c3631b10dd147f38ca34796c40692e01b51dd206f6a5b755e605", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291610, "uuid": "f8e2cff0-cff5-4f32-9564-f26fc77faf11", "comment": "Malware payload (ServHelper)", "value": "11c54ce99e87637f58c7bc0bd8134c73df9bf879", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291610, "uuid": "3b283263-1f3b-4ed1-b4e4-ca24c997382c", "comment": "Malware payload (ServHelper)", "value": "9ee2bf10b8cdf3bf7542da9b1048b2a22c3239bdc5c8919c6bebf627d26e23a2de1e80783e1c73d3b0f2426b69c9b448", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291610, "uuid": "ae02a072-664c-4d8d-a874-e8dc8c07da75", "value": "T11A56F103BC9164B9C9E9D23189B592513731B8490B3577C33F46A6BA2FB77C41E393A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291610, "uuid": "d13b526e-89b0-47c9-a60d-249ef0d79fa8", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291610, "uuid": "047f3006-fbc6-42b6-8faf-616b028a8a5b", "value": "49152:wDK8merb/T/vO90dL3BmAFd4A64nsfJdo5GQ5shfTuU92flI7MhhaftEhamnybrN:wD+3eGLmAQQQQQQQQQQQQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291610, "uuid": "630deadb-1916-449e-be92-b473c3c82c45", "value": 6024192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291610, "uuid": "c672799b-f24a-448a-a2cd-9b6a8efe1220", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291610, "uuid": "2e0b153c-4195-4893-a0df-e79489490748", "value": "61d5e32562d1c70daf0a3112f7888258.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61139408-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316624, "uuid": "3aa902ef-afec-4e25-87f1-f62a3b74a852", "comment": "Malware payload (Dridex)", "value": "6988ab2cd1e76a9f5b6bd1583ee26200", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316624, "uuid": "1b3c0c4d-1cb3-4243-a52d-36bf9e38669f", "comment": "Malware payload (Dridex)", "value": "da0e5eeeacc89f3ac77a41a47314d5c92db49342aefcf821f32d538d9e88d638", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316624, "uuid": "6b5c1f87-9ad2-4af4-af78-1af3d33cb369", "comment": "Malware payload (Dridex)", "value": "5bb15ec2e70a91ed4d43435c5df16fcea1aef5ac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316624, "uuid": "0cf3cd8b-f6d0-49f3-b81e-e5156396b717", "comment": "Malware payload (Dridex)", "value": "f655e68078eec7dd4332c653f049829a7773229d9fe01e380bd50b4617514d2c1222d8745d3fc01bf44248d345deefc9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316624, "uuid": "9a4a26f1-ff2d-41b3-984e-6929e394a058", "value": "T132A5E020EE69E1E6C6B89F3E9408352717F93D75110D608CC392608F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316624, "uuid": "9d5d1b2c-6578-4a4f-b618-d12d2aa4110d", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316624, "uuid": "c0d624e6-786f-4d1f-8d5a-f8105a5ecc64", "value": "12288:2VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:rfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316624, "uuid": "fd17f599-0c8e-41d4-8f35-d363576dde3d", "value": 2088960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316624, "uuid": "a66f4ca3-9156-4258-ba7c-120e1d38fcec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316624, "uuid": "b05df627-887c-4c67-b849-c818bedf97e8", "value": "da0e5eeeacc89f3ac77a41a47314d5c92db49342aefcf821f32d538d9e88d638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc68cc7-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632317128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317128, "uuid": "40076f15-9fad-4b9e-977a-72895f258440", "comment": "Malware payload (Formbook)", "value": "7a23da05dfbd236cb33b6d7a2a1f262d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317128, "uuid": "9a9eb5bc-83aa-4036-84dc-1b7f75ae3253", "comment": "Malware payload (Formbook)", "value": "da641202fb53638f3aad2bda8a87d215855cf03aa658637e3dd70dbe5c3c47fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317128, "uuid": "6dcd99a6-9d8b-420d-ad50-ae75d0a822fa", "comment": "Malware payload (Formbook)", "value": "21e1eead89fa43d2af110cf3b1b88ba8c1e8b136", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317128, "uuid": "0be36cf9-8b1e-4895-8b5b-b78a8d982ba1", "comment": "Malware payload (Formbook)", "value": "5c666d484b5a6c799158ae21ca2c27d02e2108df6ad3f0fa9d6789bd538c69c76f71a264f9bb533f1a8c82e1693b17c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317128, "uuid": "3535adfc-2392-44c7-abc4-6c7367ff516d", "value": "T121F479C85D884613D7A44672DC5C264672682C5A3723838BDBE13DB73FFE683C22D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317128, "uuid": "52e340fb-8b48-47ee-b397-d38a6ca8d476", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317128, "uuid": "7ef26537-8087-404f-8bbb-069356796894", "value": "12288:lAmtiK5oIXkuAiOM/KJ+OJ3lvUtuQezKJU8rpIX1lQ5WSDQxfFT1Sk:G+FoIUOON+wVvnzK/elQRD+fFT1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317128, "uuid": "032731eb-9f2a-432e-81b3-1ff8afdd97fa", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317128, "uuid": "ef933756-ed77-41bd-83a1-4e6e7351dd2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317128, "uuid": "a67ce8a7-3a48-40b5-afbe-2029c2a36802", "value": "7a23da05dfbd236cb33b6d7a2a1f262d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460aa0b5-1b82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632300687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300687, "uuid": "17be754b-e5e9-429b-9733-9156fe8e4fe5", "comment": "Malware payload (Loki)", "value": "b923dca0ef151df40c25e9e76c9b2e51", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300687, "uuid": "da0aac56-3bac-4051-bb51-1a874005dc8f", "comment": "Malware payload (Loki)", "value": "daccb66ba24bde0c77274d09928a0b28531d5c8c34c6d6d8f1479b67c957d434", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300687, "uuid": "0a1a0689-4815-47bb-bad2-9933c11526da", "comment": "Malware payload (Loki)", "value": "3c79f5a1c403d8f52262d172e70eec120bcef554", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300687, "uuid": "5c501a76-24e9-4eaa-b3da-92e3f155715c", "comment": "Malware payload (Loki)", "value": "9000b8abe1d6f74a00f4ed88b11dd86b7349c56a80c361b227dcff0312c041dec8ec987e640713c2a8f4813ee1718c71", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300687, "uuid": "fd8a0380-e76b-414c-9f24-5e30b56b232e", "value": "T1E3D3016A6763593BDF232938E56BC0318F51EC3576A865F3B98435B26138781D33A23C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300687, "uuid": "1a224b38-c8ac-44f3-9193-9989bd514322", "value": "3072:EDEuJfxA4rN1lb3XKscpfp792se4zxKBVV++Y:rofq4rpHApRJ2s5dAV++Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632300687, "uuid": "703380ae-29f9-49ed-8635-ec4073d6b14d", "value": 132728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632300687, "uuid": "1ebb88b8-500b-485e-8fcb-2aedf4b83fed", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300687, "uuid": "25c713b9-d398-4b23-8717-463faeaa8d73", "value": "_Cargo receipts BL,INV_.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42302d9a-1b77-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632295956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295956, "uuid": "63cce73c-4fca-4f3d-9d1d-26b1d8c85a79", "comment": "Malware payload", "value": "282b35ed9551c6f79e123bb2d2a956fb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295956, "uuid": "8b378a78-5470-4b73-bc5c-1aaaeedfce16", "comment": "Malware payload", "value": "db6246bd102fdfa9614a9fa5968362c5de8a3bb1cd23b5740392210d20a7d22a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295956, "uuid": "db9b9891-3287-4a6e-9b5b-881ba6040d79", "comment": "Malware payload", "value": "a92dd02afb3780bfb5d0e1b9dc845d0325c59ddf", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632295956, "uuid": "38f4cca7-f454-4697-8fd2-8650d52a8efa", "comment": "Malware payload", "value": "d749eab3727ab5727475d722c10212c50b4ce7d657779534a5c0191d5ddbfdbec35ca33e6e885bb46e7a731071325d7d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295956, "uuid": "383850c3-aaaf-4e88-939e-1b2e6adf95a7", "value": "T18C0633D4FB965021CC0BEC32C81196DB6010468E0658D91F2F6DA61A5EF7FBC8A1BF67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295956, "uuid": "607ee582-3389-4bd9-a69d-3ba61c149fe1", "value": "49152:w7J7KZCRgwaHe4VIoVyBh+adhmeyljt3dxZFUI+Gu2y8eKqfyNB/D0NcxZBY5h:gmZCN4pVuj3mrNFdXFF7ug4KwyxrYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632295956, "uuid": "b22f992e-daf9-4dba-acee-0235de85f3fd", "value": 3910705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632295956, "uuid": "8418268a-ad48-4ebd-8df6-2f24fedb354d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632295956, "uuid": "2b652b06-6b8d-4af5-9828-78147e9ab65c", "value": "mObywatel.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d18a601-1bcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632333878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333878, "uuid": "189c3e3b-ee71-4b00-bd4d-561665f24b0d", "comment": "Malware payload (Loki)", "value": "e1c271fec5a9b690482b700d4ed8316b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333878, "uuid": "ca5850e5-2296-4778-87cf-bc3257780f6e", "comment": "Malware payload (Loki)", "value": "db675be67b9d8a031a3d9176f757bdc0f13af3f3c2e9f63adde1645cedfc53fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333878, "uuid": "7875281c-4a3f-4e98-9d85-85d534d8f733", "comment": "Malware payload (Loki)", "value": "2d8ff7794b8fa406774b40dfb7744e9e6083aba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333878, "uuid": "8b30b3b2-89e0-4a05-bd39-39a9fce57656", "comment": "Malware payload (Loki)", "value": "87dbce00f1a25e2869633353ea6dc272032a2f5c0c712cf156a203d03c4b1f063ced83f5d0db6f389af703bab73bc91f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333878, "uuid": "0de97331-59a4-4cbb-8226-48e1eafd61b4", "value": "T150D4026D379071BFC827C977D9A42C10EB20A0ABA70BC207B45351AD6E4E59BCF254F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333878, "uuid": "3a579dd0-43e6-4905-811f-a15fc8dc4008", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333878, "uuid": "4ede2014-303b-46c4-ac5d-09c24f70c282", "value": "12288:DiTwmtiK5ovmm1pHlE9lllh7T+vvh4Tc7i5Ng2MexYO:H+FovpLHlUlbh7T+vvh4Tls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632333878, "uuid": "f6885c64-90c4-4baf-bf01-5b89fb1d5ffd", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632333878, "uuid": "6f07d307-15a8-4228-97d5-634e2182780a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333878, "uuid": "29ba6957-45e5-4f85-852f-c21344247dfb", "value": "e1c271fec5a9b690482b700d4ed8316b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6239e8d5-1bff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632354422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354422, "uuid": "abf46507-4fce-4506-b72c-5b4f28e0aa60", "comment": "Malware payload (Mirai)", "value": "e6ba2b802e1664ed9a287fcaef52fa61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354422, "uuid": "e0a755cc-22eb-4b32-adad-747a994da275", "comment": "Malware payload (Mirai)", "value": "dbefe6ba418c04cba677b836cff51854bfa57615a0497fe58459c0f355bdf92d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354422, "uuid": "7f9c7087-60e6-4684-bba2-4947e5e6a1f3", "comment": "Malware payload (Mirai)", "value": "4992d3950f2c650196031749c7aad749d4b381a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632354422, "uuid": "0ad2cedd-cc47-40f1-a8ba-66243a05fe92", "comment": "Malware payload (Mirai)", "value": "c4f3f4195f65c2176520a0c56001a61b5521f40519697b77249f78174e8c7a1b2ec113d1a16dc27b6b06cb1da83e9573", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354422, "uuid": "83c14347-1bb6-495d-a06a-46039327d956", "value": "T14F73E81E3E219FBCFB9C873547B78E219658339626E1D284E19CE9011E7034D742FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354422, "uuid": "a8f94a82-8f34-4a40-857e-87aa35329e1d", "value": "1536:pVNzbOfVDFzxJXilJHbj90OproByEALurtTgF8S1z3bvUz1:pVdbSTXibbj90OproBeEtTgFl1zy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632354422, "uuid": "4baf7e5a-c893-406c-8c8a-c8678a6c6615", "value": 77348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632354422, "uuid": "ba3c8465-88ed-4971-8160-5e205bf386f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632354422, "uuid": "3d2f91a7-fa03-49fa-b669-60d00da3fe51", "value": "e6ba2b802e1664ed9a287fcaef52fa61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1538c67-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632316759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316759, "uuid": "1ec01f2a-f442-45bc-a1a5-db4e7c62a410", "comment": "Malware payload (AgentTesla)", "value": "b80aee6108833308db15c2b4dda4a3de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316759, "uuid": "2a1216a1-5c1a-47e9-be57-37b1129d502c", "comment": "Malware payload (AgentTesla)", "value": "dd31bfbcf0dad562e03dc771d93f0c1eeef6d924494aa078bcdc61458e047307", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316759, "uuid": "7dd1575e-4045-4c71-b41b-e76b6183dd31", "comment": "Malware payload (AgentTesla)", "value": "4eee06abd668c16394323dc20812945764816893", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316759, "uuid": "453ccd85-d771-4866-ae01-6e60330ca7c1", "comment": "Malware payload (AgentTesla)", "value": "67c4da66e327e4accf47cbd9caeb6d63d35242cd76fd42b507cbcb5071916440e005ceeb7d3c861c1be799c8a94c1069", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316759, "uuid": "fd0f5575-31ac-47b9-82c4-baed211b7d31", "value": "T1F4A4BF33770EFD5ADF360C38A9403D700CA56987526C85C6BB89D7FA509A5E0FBA94B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316759, "uuid": "209ad0ad-f2ee-4275-95e8-981e2e36e433", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316759, "uuid": "830b7e02-4ff1-41ec-8ce5-c3f31031bb2b", "value": "12288:8mHrIfkWN9miF4h8uGPaJ7IXw3VkAj+IwywBiJXA:ivN9m+88zw0Ami+IwywBiJXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316759, "uuid": "a02a41c2-d701-49da-a044-6ec471b5abb7", "value": 453120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316759, "uuid": "89100de6-3786-4313-80ba-3270efa35c09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316759, "uuid": "63e11322-6be3-41d9-80db-1ca1afb61943", "value": "b80aee6108833308db15c2b4dda4a3de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55305eb9-1b4b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632277090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632277090, "uuid": "2fd0620e-8150-4cf6-8cea-b73528f87d9e", "comment": "Malware payload", "value": "6aa681854d97bac8bea9bd0c53db7aea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632277090, "uuid": "086e3b15-9376-4448-8a99-1e7d1b2a9e6f", "comment": "Malware payload", "value": "ddd5f6afb29b3c8f1f8482e1407411271f172cb589c5379bae0d9a59053480ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632277090, "uuid": "3c1a7743-b9c1-4f69-8f21-0aa61c4227d7", "comment": "Malware payload", "value": "e2aa026855bb5207f630c0cb6661e6236b3b82d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632277090, "uuid": "0c449fbf-21f3-4c0a-b986-74ac88b5c17c", "comment": "Malware payload", "value": "f104023ad1ae2bf72b0985562d8d2a20583df699c2d6cda133d5179e1c6c64b46c625e04b3ab66014ee1902df2519b9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632277090, "uuid": "81a4b000-1c40-4486-a19d-5fa397d3dbb1", "value": "T112746C73F6C08537D163297C9C5F9BA8AD29BE503D2468462BE81D8C8F39781743A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632277090, "uuid": "9bf1a45f-0e7f-4f07-b5df-e9ce47c65c2f", "value": "e8731cf7b250a548d4ce8e544c35435b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632277090, "uuid": "c59476f2-e6cc-4c12-a825-bfd6c5421ba3", "value": "6144:n1/iXvse4QOwJFLJWk1VlxOkKISMg8hLmbmX6Kt7I5l:1qXvsPEVjOP8hSbtKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632277090, "uuid": "d7991a7f-ff90-4b1f-8d26-363fe45a22cd", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632277090, "uuid": "1442907d-c6bb-4c62-981a-358a9978d315", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632277090, "uuid": "7840bcf0-2512-43df-ab31-306c28998c55", "value": "6aa681854d97bac8bea9bd0c53db7aea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf14456-1b9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632312859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312859, "uuid": "8bb572c6-1140-4277-813a-5dc15cc44f21", "comment": "Malware payload (Formbook)", "value": "bd10cfbc74df5f93922b858d615dd5f1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312859, "uuid": "6c1b1150-590a-4a6f-a1c4-f4d1488321ff", "comment": "Malware payload (Formbook)", "value": "de12c9134fcde73ecd31ab3feceb690c5444c713c81ff16948d748df282348c8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312859, "uuid": "2855d898-19c2-4ecc-ab38-a01d782db064", "comment": "Malware payload (Formbook)", "value": "78c562ef8dd4249f54ce7d3969319fc846e4932d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312859, "uuid": "8fbeb723-87b0-4c31-a4fb-54d3c086cbb7", "comment": "Malware payload (Formbook)", "value": "8aadf7054784efb50e38d24a8ffa8a85fa2c55f8da8cedfa768b61e2c004cda437f3a726537ab6edd03e03075b1ec1dc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312859, "uuid": "56fd3cdf-4d99-4927-97ab-ca30beffea17", "value": "T1D6A42386E8865570A720ADE5617D9FFD8BCEC0628073F5060BEE73485A21BDBDC4178E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312859, "uuid": "7431d739-eaed-47c5-a9fb-f6df3980a2be", "value": "12288:Hbq1tUWfPgKmyF2rE+k8xNmc5FAiR+PGlmLSYcfG2kW6vff7:vWA4yrzmc0iRBmNcfG2kjfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312859, "uuid": "7325112c-7231-41b5-b633-d87ee724bd41", "value": 484571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312859, "uuid": "f52a12eb-fc35-4cdf-8528-3e62eb24c244", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312859, "uuid": "869ccbd8-b2f9-4ad1-8cc7-ef803e725326", "value": "Updated SOA 210920.PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe0e049-1bcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632333936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333936, "uuid": "233b8d89-3ff1-4dde-9f70-7b4793d38476", "comment": "Malware payload (RedLineStealer)", "value": "9bce4cf2cabba00cb15be050754fc478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333936, "uuid": "652b527e-cebc-47ee-a132-83c2bc4f5d1f", "comment": "Malware payload (RedLineStealer)", "value": "de995ae2a901c32c4a4800d423fa4dab1274d58bbf9f4be57ed59c5e184a04f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333936, "uuid": "18148a94-6af9-4b5b-bbf1-cf8d0d9b68c8", "comment": "Malware payload (RedLineStealer)", "value": "01fb74afc137c91533f2f19379d4c12eed4754a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632333936, "uuid": "b09a5fac-f946-4c74-8997-d149e2c7543e", "comment": "Malware payload (RedLineStealer)", "value": "903173a6b5b1e0ebca45b29c966d664e7a42ec80502d8266521be777a01296a55213ef33effb7932b1abd6e21843cae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333936, "uuid": "6bcb5492-5a74-4afa-b1bc-e6cf238a135c", "value": "T10BD39377406150AAC5B81330E8695F0B7E6CDE240E40B6D8F04FB2EADD3DA5D8EF52A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333936, "uuid": "889ed895-883a-4753-9534-8a0bf3a8fad0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333936, "uuid": "2629e94d-2ddc-4a35-898d-8676898cfdeb", "value": "768:tLx3eKZ8wzydMMC2FeaiggFwhgpjSCjTgvF0vy1043nrZ12zsQBm+kmzN1E4YIvH:tZe62NTxaDp59HaXI/Y16wYYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632333936, "uuid": "906ee36c-1962-4d4a-9c2f-f895e9ff15c6", "value": 137728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632333936, "uuid": "05508fb1-8a69-4749-b0ee-7946a6cbee71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632333936, "uuid": "f5a57120-ddc1-4051-a477-7cbfdf030b4a", "value": "9bce4cf2cabba00cb15be050754fc478.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adde66d7-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632334362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334362, "uuid": "1c61acea-665b-4fb8-9aa3-59008a95733e", "comment": "Malware payload (RedLineStealer)", "value": "cbceef20cb968e39c9bb664e420e3380", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334362, "uuid": "c307c85c-e63e-430d-b6b0-740990a8444a", "comment": "Malware payload (RedLineStealer)", "value": "df1f97bc36b16e89492eac798745c9427681c448aad6bc5398cb32d1f3c96891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334362, "uuid": "ee1a4e22-ad41-46fe-a1fe-bd608bdd84bb", "comment": "Malware payload (RedLineStealer)", "value": "408a6218b5782a62ef48c93948b58dbf24316fd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334362, "uuid": "176df699-4a51-411a-8997-8b7c89ce7b83", "comment": "Malware payload (RedLineStealer)", "value": "460e090240c4db2410ca235fe33594d913af9372b354f55f8c84309ab3fdb8ca3e2224c099f0c654a22f00ebb554c298", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334362, "uuid": "311d5e80-1fc5-4fc7-a81a-ba473e3657f4", "value": "T1F874AE10B7E0C034F6F712BA49B993B8A53EBDB16B3885CB62D416EA56746E0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334362, "uuid": "03b1ac2e-92ac-40a0-b292-1d54ad340578", "value": "1f3d09de0e7da5c165527f71e6a1c9ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334362, "uuid": "337080da-7793-4b54-8080-cc5208d9dc54", "value": "6144:qjEPI7Q5b43l/M1qMr66CVq9MIdzToV0aRj+BAoK:qjEPI7Q5b4/h86VzIdgV0aRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334362, "uuid": "b7fb84ae-8dd3-40dd-91f8-211e213f07cd", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334362, "uuid": "5bf9fac3-3fb1-4e20-923f-0df1f93a5dee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334362, "uuid": "77e316bc-ad68-43d9-83b6-0ba5c3a1daa2", "value": "cbceef20cb968e39c9bb664e420e3380.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c3902c-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632289646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289646, "uuid": "ff8f10a7-6ebc-489c-ac19-fc38b86c0f66", "comment": "Malware payload (Formbook)", "value": "b6a0db586cea7dcb4e3637742cacac01", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289646, "uuid": "38e580a1-2c38-4055-aab1-0b0baf6e02d7", "comment": "Malware payload (Formbook)", "value": "dff72b59f7cad8f3a96ba77b154b9df86c402e3684fc1901769c9a789cdb814f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289646, "uuid": "8408320c-0bec-46ba-a566-430fe6e2de48", "comment": "Malware payload (Formbook)", "value": "7628f1bfd197f75b8272e4e48fbfcc13837538b1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289646, "uuid": "c76b31a2-393e-409a-aa95-2cd45429818e", "comment": "Malware payload (Formbook)", "value": "8256e35a81131a61901d2aeed4b0e7081ae434b48a723364f66bcb7b40bfb0dd486c051a44adec7bd65a16e5bd18365d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289646, "uuid": "50258be9-ca0f-49e9-bd17-2efa23ecc778", "value": "T134D302D4FAF18D30E019987C1DAF9A5AC76BBC0E1800305272FA799705758BEC5D8B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289646, "uuid": "162c623e-08d3-4bb2-84ae-a76e718392be", "value": "3072:4p7TuyNjNZSJp3hrUVaqd/7b6+s4xiWi2KC4hwlQTZM:sWyBNup3hrhq1f6+FZhKCe2QK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289646, "uuid": "6d439333-aae1-4e2f-83fb-7f9b8bf91c7f", "value": 132888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289646, "uuid": "f30cf1c5-f8c9-47f3-8eb1-e20a3bfe548f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289646, "uuid": "986559e0-13cd-44f8-9aee-c2a839e7c45b", "value": "1 Balance_PI Dt. 21.9.2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0c9dbf-1b6c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Socelars)", "timestamp": 1632291493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291493, "uuid": "e6693f3a-b7fc-4733-a1cd-9b8eacf7d799", "comment": "Malware payload (Socelars)", "value": "ab24fad0df703108ff6a927aaaa42d34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291493, "uuid": "69266672-1ec0-4272-a7a5-cba1715648f9", "comment": "Malware payload (Socelars)", "value": "e0936ae8455d902825673f693534f4d6fb787a85f7bfe3fd28a1ea5618d4d29c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291493, "uuid": "39978df4-5305-4ea4-a69c-e28a6098a8d1", "comment": "Malware payload (Socelars)", "value": "690b6bbb18806420de9665a3fe9cdd3dfc102c02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291493, "uuid": "e2871402-c5d7-466c-aa03-e83135a9169c", "comment": "Malware payload (Socelars)", "value": "01a56ec2c47bad8828bb4438419b5a48311e43b50f17ed44e4ff9efdcd9a299c0b6163098c5fee0e186d0e827a1f3fde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291493, "uuid": "88e40357-cb8b-4d29-9506-6cda9a43f29f", "value": "T1D6658F21F642D036E8E300B6C6FE47BE9968BF21431494D7D3C42D699A709E27A3B717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291493, "uuid": "b2f6909b-deda-430e-8ce1-5005e276890d", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291493, "uuid": "a7e18a1a-3f97-4a85-8fa7-3d002f2e7ea8", "value": "24576:vIVFA1pqtg/TnMbX0lwyh0FVmEByU1/wFYyOs7rKOnrSSs974QtYfbpgY:+FA1pvTMbOwa0TmYJMYEXHnrSS5QtYz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291493, "uuid": "1423fd4d-b982-48f6-98f5-ee24ffde1efe", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291493, "uuid": "77e65c95-eb4e-4202-9ffb-9b8a0c1c9c21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291493, "uuid": "19f4aedb-fa37-4272-9e3d-0cafd6b34072", "value": "ab24fad0df703108ff6a927aaaa42d34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902d89ff-1baf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632320139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320139, "uuid": "316df67f-40d3-4e2d-80ce-9414d9568b7f", "comment": "Malware payload (AgentTesla)", "value": "1ace905534c47d1f3196d97c4e6e74cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320139, "uuid": "25a37bb0-44b7-4dc7-aa8c-fe628aef462f", "comment": "Malware payload (AgentTesla)", "value": "e1166a3d2b321f12effe0ae997a891700cd91b948f32e601630460dc7cc99aa9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320139, "uuid": "7b20417b-fdd2-4678-bee4-8e5a37a9bb66", "comment": "Malware payload (AgentTesla)", "value": "9a2415c708febb6dfc0c092319f216481ebaee92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632320139, "uuid": "3a3281ec-fcd2-43d3-80a7-7cb8132bb1ad", "comment": "Malware payload (AgentTesla)", "value": "f35ead2187e3aa682ccebcc9dde68207ef74f782f9cd4f25a25c4fe7c082a7b739ac9c2f5913e1059c5519ac1ea68f8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320139, "uuid": "13c6715c-436f-41ac-b933-80dacae2de58", "value": "T11BD4E099375075AFC867CE76C9682C60EA20B577930BD307A45321ECAE4E69BCF051F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320139, "uuid": "138ea145-ee2f-4b7e-a184-8b0f404f3bcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320139, "uuid": "c3e5168f-12e8-4d65-b26e-f52b5efe3724", "value": "12288:RmtiK5oBMG+1IZy56701E8KuAc+EPhQbQOXM6Tm4qhLPr:R+FoBMG+qguB/EZQEO86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632320139, "uuid": "6a360bac-8fc5-4c33-adf5-6e95ff8ca478", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632320139, "uuid": "052f25c3-6eb5-45ec-9c74-3c4e7aef4a48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632320139, "uuid": "c2a0c7da-41a5-47b5-9752-b95d09ca6aaf", "value": "71j95pau8Z7HnCE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddf027b-1bae-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632319786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319786, "uuid": "0c6ed918-d0d8-4a9a-84c2-5e7a6c62abe1", "comment": "Malware payload (AgentTesla)", "value": "af62f423e595f322282383a285c8b66b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319786, "uuid": "bc7f4874-4fa2-4382-9573-4737cc3afaf4", "comment": "Malware payload (AgentTesla)", "value": "e15cc768ba82ddc8796458615807b22d2cc793cc816d8469f39c4f40a71ea57c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319786, "uuid": "6bba50b5-341a-44b6-bc20-e2ea83734da7", "comment": "Malware payload (AgentTesla)", "value": "80775c1a1e0fc204cc51f9f975c443030a3b916c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319786, "uuid": "666683f2-850c-42ec-b18c-02bad698c4f8", "comment": "Malware payload (AgentTesla)", "value": "36f992e10ed3b776eb293c2156169833c50710aa306e3cd0d116db3cfd82fedefd9076652c71e432aa8c403907b2fdd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319786, "uuid": "67db9dba-e416-4802-94fa-fc61cbae2856", "value": "T1F535BDF0A143AE9ACA1D69B1033D3DE9F07A985B563EC75BDA91006078170F9EE7D183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319786, "uuid": "26462e06-620a-43c2-9648-825b9b8a405c", "value": "6144:7lRyIfuuIqjFh+QYScUxFtxDUQBT7xBsnE5w6d9XgJt3iEvzjhqFS:hRF2uLhJYScUxvSQRxmnE5nTXgaEvvhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632319786, "uuid": "47c28a4c-0d2b-4040-8e91-1733d1ef2b38", "value": 1075059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632319786, "uuid": "54e9153b-0ca3-4a24-a08f-7d2eaae5f139", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319786, "uuid": "37e13f88-f944-4207-99e6-0856a7afbb99", "value": "USA NEW ORDE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43df816-1be8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344734, "uuid": "a55a435c-836d-48bb-bede-fc56b7c7a4bc", "comment": "Malware payload", "value": "977c4b749f52d854c8b79371d63b0948", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344734, "uuid": "da93cd24-0afb-487c-be0c-08c3ac385f6f", "comment": "Malware payload", "value": "e1c661c2e12cc308e586bdf12691d4cf43135c03cbcfb1fc60c0cdb181d278f5", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344734, "uuid": "2ff37acc-806b-44d3-abf0-1b4af501dec9", "comment": "Malware payload", "value": "bd14fa4236770bdd14c06e21bec7cb9a6cce65ee", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344734, "uuid": "8555db1d-2887-4722-8ab3-0aae8d14dc94", "comment": "Malware payload", "value": "296b96214d1a0c247331173dc894d22a071035ebd9a256eba8a1e3f8e63f8e1ff36508d5727f5cf3a3d96c3daea7b42b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344734, "uuid": "d09acb7d-127e-4643-80cb-4fd18541cc60", "value": "T1D3A4235A38822458EE4811BCEE619D6808641E26DDD18B1FD4BFC7ACF587972C3CD78B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344734, "uuid": "203500a8-0851-4e54-928b-2a3a478096cf", "value": "6144:Wdt1VI1JuwtooclMS6bSCSQHMDjKT3793GlnaM1AL3JPS2hUKoAIAjzI8VEZyCNw:lko2MgCV1LB2pAbrBd48aYCD9VG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344734, "uuid": "8ed8723c-b478-4ad4-81db-7740ed8e2742", "value": 460983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344734, "uuid": "c656c5e8-d0b4-4588-a0fc-695f5f63c514", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344734, "uuid": "87b9dd96-ad89-42f5-b127-bbc09f2ff9ac", "value": "\u8fea\u62dc\u5973\u63a8\u5e7f\u5206\u4eab\u81ea\u5df1\u7684\u5f15\u6d41\u8bdd\u672f\u5168\u5957.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c4a349-1b7d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632298620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298620, "uuid": "35ca6fa0-efa0-4d12-b5b6-c2e87bf0ae1d", "comment": "Malware payload (AgentTesla)", "value": "9892db7c26d2fa3968a73373c915fd2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298620, "uuid": "48c01f3e-2012-499f-b250-8969f9a630b8", "comment": "Malware payload (AgentTesla)", "value": "e257b2e14eeec6202dc51fe3eee31ed52ff0b0777911e85d58d1405648583fd7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298620, "uuid": "aa2a2329-ae94-4a03-8ff0-e69e934a14dc", "comment": "Malware payload (AgentTesla)", "value": "51026845dee71d8dd783862c5628b1d897cc85e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298620, "uuid": "7683ea4a-b4a3-4ba3-87b3-e2fa2a8cddda", "comment": "Malware payload (AgentTesla)", "value": "677b52113b70abab8583d32d2a775f2c6bb6772e777e0a7ecf4c06a3d100446f0f4cb8d57b79aa1c9c41a49952203faf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298620, "uuid": "36fef052-b5a0-47f8-86d4-79aebe968860", "value": "T1BB2429166714D411CB5F417FC016821831F1DB07A72AD3CF5AA6D8FA2F822CEF92A9E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298620, "uuid": "81325564-a8df-43de-bfcf-838dce387c1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298620, "uuid": "852e9f4e-f406-4e6e-9cf3-fa9ad6e99222", "value": "3072:ZGW7nK5cZ8FIk7ZjwqZfFkwin3bUimtF37mTXbb0LxqaNMKdvAx/6qT7hny72tAE:Z/dEf2LUlLmrgrMK/c6yAuLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632298620, "uuid": "c1cac633-2206-4533-baad-cc1a381b5d6f", "value": 227256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632298620, "uuid": "200b2b34-0337-4a08-89ee-8512408ea303", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298620, "uuid": "2f2c3e2a-e1d2-4547-80b0-a5b9b194c397", "value": "9892db7c26d2fa3968a73373c915fd2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da1f186-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316591, "uuid": "e4061676-d263-4c99-bddb-453ed5647332", "comment": "Malware payload (Dridex)", "value": "8e85d5c1ced91d442fe22d8d76a9c3ab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316591, "uuid": "297a599f-7a62-4df7-88e5-2ae5fd972556", "comment": "Malware payload (Dridex)", "value": "e28e980cbee4e2410da4cf95542fb62743d30ae2ab6deed43561b61ffbc95c64", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316591, "uuid": "6a24eb53-436b-4f4c-a760-95a1e2fc47c2", "comment": "Malware payload (Dridex)", "value": "8b702fb7435501c16bedfaff3e781429556f52a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316591, "uuid": "0976c44b-d9c6-4f97-a1b1-42207a7b332c", "comment": "Malware payload (Dridex)", "value": "c8b0f518b035597bc6c490924e8f43ac74f48e3f71c4bd42b2f3ec18268777cb68a7ea195789c15bdd54d180964fe09e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316591, "uuid": "7d8e263a-4dcd-476a-9f89-c6e457e31a49", "value": "T1B4A5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316591, "uuid": "6331829d-2d6e-4935-87fc-37790642cdaf", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316591, "uuid": "0e36b364-d042-4578-8c91-e6f1c9fd520d", "value": "12288:NVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:UfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316591, "uuid": "9dc90fef-09fc-40e1-a1d9-02d0bd82b609", "value": 2146304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316591, "uuid": "f7812e35-24a8-4e44-a83e-4ce6681c2482", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316591, "uuid": "f1a3405f-b3a7-4496-a249-e5fe922f7f83", "value": "e28e980cbee4e2410da4cf95542fb62743d30ae2ab6deed43561b61ffbc95c64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a931663b-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316315, "uuid": "291e26b5-c0e9-406b-923b-058c0dbdf8b1", "comment": "Malware payload (Dridex)", "value": "e829a5a69c3186c68d15fb6aff12ca9c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316315, "uuid": "144f0a07-6a58-4810-bc79-48d71057e37a", "comment": "Malware payload (Dridex)", "value": "e2a9f9d7dae81ef89face6fb9f57dbf9a313b983e546d7eacc23b6e33b72dacd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316315, "uuid": "ae53c8a0-9682-4070-b93b-e5f63b007b0d", "comment": "Malware payload (Dridex)", "value": "688c010cacb44fab15b23ef2722bcdb4045aa6f9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316315, "uuid": "6b1c114a-fe48-453c-93f6-9178f9508243", "comment": "Malware payload (Dridex)", "value": "fda1cdc3ca98a160124ed76b906623d0de31cb670ab24f6c2a8bf87b6c39aa516af9d8f5878f43eb5100107ebdc82c04", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316315, "uuid": "2a0e569f-8700-4754-8564-e4181d071824", "value": "T19006E010FE69EDE6C6B99F3E9408352317B93D75030DA18CC392604F5EF82546E3E99A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316315, "uuid": "218fa104-26f0-4dcb-b877-18fd11281cca", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316315, "uuid": "e3c4cc74-2e4b-4497-8d92-59cf6ca8f2eb", "value": "12288:KVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1xP:XfP7fWsK5z9A+WGAW+V5SB6Ct4bnbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316315, "uuid": "cac2b8e2-7d14-4e7e-bdf8-2e5edddb14fb", "value": 3760128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316315, "uuid": "be71e4be-8934-4787-a4ca-f5a7c5bace23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316315, "uuid": "6784c8e9-9927-41f2-bf3e-cda99f5fa728", "value": "e2a9f9d7dae81ef89face6fb9f57dbf9a313b983e546d7eacc23b6e33b72dacd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775c47e4-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316661, "uuid": "902ad7d6-9f01-4614-9a90-3584a49f257f", "comment": "Malware payload (Dridex)", "value": "db26e6af8bad2cdb0de3d55fcec9ef79", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316661, "uuid": "527af9a6-f77a-4d20-9943-08927b2d272a", "comment": "Malware payload (Dridex)", "value": "e350c4516edc66263b33e9d90ede375c0803dead6effc66e7c14c48ff49cd644", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316661, "uuid": "bab30d5f-ad59-4b9d-ba05-8d9c4141492d", "comment": "Malware payload (Dridex)", "value": "420dee14f77a86fd7c5f5003b77feb6aadef4e6b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316661, "uuid": "63f081fc-9892-4a4e-8931-084ce689b108", "comment": "Malware payload (Dridex)", "value": "dec81006b394c94ed17d0e5ed5f0d0988d37ec0711449c02b86afd91e6ea537a04e616da212629970a990b703b145ac2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316661, "uuid": "8dbcb10b-da75-4f65-8eb5-514491882abf", "value": "T1B375D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316661, "uuid": "ac878296-d49f-4f50-8024-569f30ec026a", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316661, "uuid": "0a32b16b-c6fa-4b65-887c-e2c3d3f1e66c", "value": "12288:ZVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:YfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316661, "uuid": "ce036d07-691b-499f-885f-f6345f94374d", "value": 1667072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316661, "uuid": "abe795cd-5e10-442c-9c86-aa1bd0bb8be9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316661, "uuid": "47f67b5d-0bb5-4540-8468-b733877e71bc", "value": "e350c4516edc66263b33e9d90ede375c0803dead6effc66e7c14c48ff49cd644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62be62e-1b7e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632299265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632299265, "uuid": "0d6979dd-eee0-4e1f-8336-b1f7d59cc89b", "comment": "Malware payload (AsyncRAT)", "value": "573d010ac84428058fd7959dfa5b6819", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632299265, "uuid": "6dc3297d-024d-4d65-965e-c378959490eb", "comment": "Malware payload (AsyncRAT)", "value": "e40828419d3d17ba95df5804bd5ae4315e451dbae29ac4e857317549c9944d85", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632299265, "uuid": "e645628b-29a2-4628-90ec-665090b31114", "comment": "Malware payload (AsyncRAT)", "value": "93a79eeefa3e6a0ffdffdfb053e7b42f555a79bd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632299265, "uuid": "473cff6e-e9fc-4edc-9920-bcb8d42b0a4d", "comment": "Malware payload (AsyncRAT)", "value": "97832c1c5b3d5fdf1628218c5561e7c4713583ba61858d4847be93d5e760033aae11cc36a7647b7fa079890df27912f5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632299265, "uuid": "2c08ff4c-063c-4d91-af56-3a036ef1fa34", "value": "T11E940235ED68AAA3C4BD0B7BE4B805012779C486AE03C75FAAF030CD5BE37EB4415906", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632299265, "uuid": "697963c4-0eca-40ad-82d7-5fdd7753f326", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632299265, "uuid": "17cf76c0-1694-4cb1-aaee-6d6c70fea417", "value": "6144:kl2pNmtiS3/NpZZaBAqCqPfqw628uaTua7363jKTxnE8bBCshIaQ/ls:jmtiK5oBAePfqy8dX732mlnE2Cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632299265, "uuid": "29fc1c51-9e08-49db-b911-ff6482eca857", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632299265, "uuid": "1adeb54f-1064-4ca4-85a9-35efabaa1337", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632299265, "uuid": "c9ea05d3-8d4f-4319-ac1c-cec1617d816f", "value": "Request for Quotation - P02979.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de7a014-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632312189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312189, "uuid": "6c63abb2-3659-4ca3-bc72-6a996c29abc5", "comment": "Malware payload (GuLoader)", "value": "2be4cef3c2e36231b7adcb4a159a00eb", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312189, "uuid": "ef2ef3d8-498a-48ee-bb00-3486edbb1104", "comment": "Malware payload (GuLoader)", "value": "e45126e1fced974616b02a44e0a0d6c17d3788161010dd18a1429e69b5f6a947", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312189, "uuid": "1433265d-d25c-426f-ad7b-66f91148b3ef", "comment": "Malware payload (GuLoader)", "value": "cd463062a6a40ee0297aaa35213d6f4ace727902", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312189, "uuid": "0c75e398-ba3e-425b-8fc0-9c2d7d3063cc", "comment": "Malware payload (GuLoader)", "value": "f5bc9d831f602e0e3746ee94b557d91cf1e02d4bc1cb3564aeff911cb33fe700fa30dc3f862486b1f08a88de02961f85", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312189, "uuid": "5182f07a-1d4a-44da-91aa-14fd79e027a8", "value": "T120939E3A6C9FDDA7D0D6A071C94BE6F5F121AC25F60BCB076D10BEDB3930E025192166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312189, "uuid": "974ff234-e058-489a-ae5c-b6954eb03129", "value": "4b82967fdfc14d4519122dc367d279d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312189, "uuid": "1fa7abab-a8da-4b81-90c3-5f6727ce9141", "value": "1536:cO8LKTwVS4WXIf+DqjxrrkKvLU2da81pOMI/:q+ISXi+Dq1/jvLhda81Do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312189, "uuid": "368fc051-084e-462d-8842-516a1d7c4c14", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312189, "uuid": "8bda7a6a-212d-447c-a44e-55a171629d8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312189, "uuid": "7ddc8efe-63a9-44ee-89c3-2af20be5eda6", "value": "CONSTRUCCIONES Y SERVICIOS VAZQUESUR (OFERTA 092122).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b344e4-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632334273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334273, "uuid": "6321b9c4-3be1-4056-a83b-60f6cbfb280c", "comment": "Malware payload (Formbook)", "value": "4648d959e6efdc8b6f78cce0656adbae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334273, "uuid": "273b0a8a-eff4-49eb-92de-91c8525ea7a2", "comment": "Malware payload (Formbook)", "value": "e596ac1dd5978ef67f061190fc9fb647a4497429c63ea621eb2dc3fe024af7aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334273, "uuid": "3cc58b6c-ea7d-4035-8e23-34d51ddcdd29", "comment": "Malware payload (Formbook)", "value": "c3ab0b7401afd70c1c6f3aeb9026adb34efe17f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334273, "uuid": "6eacfd35-89a9-4abf-959c-c0158363cf30", "comment": "Malware payload (Formbook)", "value": "fa6302ad8cd1d753b67da0edc2980db592a8f41e07da073214b1332e4cbdd87eadf969fb3ad2e94c2ca17cbd7cfa9577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334273, "uuid": "68752c55-29be-45be-86e9-f1815244f56d", "value": "T1B6F47C9D321076EFC957C876CE682C64EA2174BB530BD243A01716AD9E0DA9BDF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334273, "uuid": "4148b27f-58d1-4133-91cd-da57b02a4ecd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334273, "uuid": "efcc6a53-808d-454e-933f-b2e07bb3b4d0", "value": "12288:t+Fu3RVm8g3gj08pcwljwOjSM9sGFV65CMGqhp59yB+KgeijSGAu97UGyoc66MV8:EMhVngS0xWbCCMdhNUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334273, "uuid": "1b4d60f0-4603-4d95-83c0-86fb69e16c74", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334273, "uuid": "f8c4c216-b328-4583-be69-27f0898df89b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334273, "uuid": "d6ba7059-3a3d-4ffe-88c7-3b028365c56f", "value": "4648d959e6efdc8b6f78cce0656adbae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d0793a-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316602, "uuid": "bc7295c4-1794-4dfb-8cd2-d35a4bf02738", "comment": "Malware payload (Dridex)", "value": "9c8767be03b96eb0ad8d95e9aca7273c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316602, "uuid": "70f19537-0f83-466e-bb09-52d28b5fbf9b", "comment": "Malware payload (Dridex)", "value": "e5ef0b6cca407c16bb35b2bdbf2f4ef49282b8ea5233e60943ce1fd35e7b0a6f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316602, "uuid": "aed75ffe-4549-4def-8854-857f0b75033f", "comment": "Malware payload (Dridex)", "value": "b32522ad2200fb4f69265394d50f95bf5b59780c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316602, "uuid": "09164c44-cfd9-4b41-adec-cff05bc61422", "comment": "Malware payload (Dridex)", "value": "662a160d2e16caccc3bbd1190835808b63331d711ca2e09c8a6c04d74c9d6f4716f2d0c17e8ace00c2fe3ab40de3ce9e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316602, "uuid": "ac7a5eb6-bdfb-4eeb-8c82-aa8391ab6808", "value": "T1C7A5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316602, "uuid": "f9145580-9cbd-41b8-807c-03480563971c", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316602, "uuid": "94e22fdd-993c-4165-95d4-c258778cac28", "value": "12288:HVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1Y:ufP7fWsK5z9A+WGAW+V5SB6Ct4bnbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316602, "uuid": "77344650-14b3-49a8-8a3b-42d74ce14351", "value": 2138112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316602, "uuid": "4b4fa84c-f657-4109-811a-b062eb4e11ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316602, "uuid": "f08a1594-63c4-49fc-80f1-50d17211be1c", "value": "e5ef0b6cca407c16bb35b2bdbf2f4ef49282b8ea5233e60943ce1fd35e7b0a6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe84426b-1bd9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632338363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632338363, "uuid": "893973b3-a89f-4eef-89f8-ea9d9b30dcc3", "comment": "Malware payload (Mirai)", "value": "556cf5b66d0bd49a9b33ad56810e00c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632338363, "uuid": "03a646ce-0013-427e-b9ca-b85bbd43f903", "comment": "Malware payload (Mirai)", "value": "e64bf99a66914b7ec108e77a0ba0001f8c740308980d2c024b6dbe9e816c56c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632338363, "uuid": "5aee4e99-049a-4a73-834d-92d172fc7ef2", "comment": "Malware payload (Mirai)", "value": "31e822e15098b397168d5c9490c37c3766a4e0c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632338363, "uuid": "9939dd8f-e853-4903-baeb-eaf16b71427f", "comment": "Malware payload (Mirai)", "value": "7fe840e7f55e5d4f50ae5ffe86fcb2985f1a4be16bdf7d5ebf3a757b92d85636d820c038bde61e782063438b7a0c3767", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632338363, "uuid": "9e37c325-b34e-4f68-887b-a7c7b1e454c5", "value": "T156C31965ED04472BC2D227BAE78E038D3F351E6B97D733155938BDB02BE57982E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632338363, "uuid": "42a54522-a407-436a-a9c6-54747a687a7d", "value": "3072:ImaoRqudCAG/fWJxXmGcQA4mP46aQyQPcENWNZ:IQzdCSJxXm+9mP46aQyQPcENWNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632338363, "uuid": "e0811984-46cf-473a-be05-6535582451e0", "value": 128877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632338363, "uuid": "ff884e44-2af4-43cf-be56-d2e1d2ff7187", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632338363, "uuid": "d4f935ad-9b25-4f7c-ba30-bd8d5ab23bad", "value": "556cf5b66d0bd49a9b33ad56810e00c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ef32ad-1b78-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632296691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632296691, "uuid": "fcd189be-00b9-4355-a424-c42aa0a78994", "comment": "Malware payload (RemcosRAT)", "value": "8a13608bb749ecaead86683f640007ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632296691, "uuid": "8c253621-7567-455a-aad2-a098f6e19f89", "comment": "Malware payload (RemcosRAT)", "value": "e6e8bb23ac6b68e1d48dd81f6012451d62b292fda9140e6012fe9702ab283732", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632296691, "uuid": "a4134719-2f1c-4664-8ddf-a341a544700c", "comment": "Malware payload (RemcosRAT)", "value": "c72f47b7a5c636b6ca58fbcf65a1d5bfeddada3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632296691, "uuid": "e6cd7d94-6442-479a-840d-8ba5f0988dea", "comment": "Malware payload (RemcosRAT)", "value": "d01aa49914694eec7ef1e263c7454a1ce7e165e9e3f69422087b140c952102c63571ec3376af23893a9f2d3d0be397a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632296691, "uuid": "873d910a-d4f9-4f85-9488-c54b58ef1458", "value": "T17335FE394D2682F747EEC66CD48C1BCEDEA6A4837B919F1AC496D7C2025B70FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632296691, "uuid": "e885ded2-75ea-49bf-b654-091fd9fe3c58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632296691, "uuid": "bf832ae3-9e3c-4eae-8ed3-93e62e16d865", "value": "24576:eXcecnzOiCIknZKLIvYBmGgUb65fy1lZKEkFKr:eXcJzOizEZKLIvYBv5b6w1uTKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632296691, "uuid": "2ba52dff-80f4-404d-9b82-7f3210142358", "value": 1122816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632296691, "uuid": "004e8a78-a8b4-43bc-9e74-56449a087427", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632296691, "uuid": "02a348f8-dc06-4fad-a0c0-07841a3247d7", "value": "AW QUOTE 21505 HQ1-Scan-068703_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0295e544-1be9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344812, "uuid": "5a2809b3-466a-4ce3-aa56-2499b87bc655", "comment": "Malware payload", "value": "2619e57a4c38db50f1c0d77d0db7dff2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344812, "uuid": "a8f335eb-9ac0-41ea-b58e-8c2ddd75b247", "comment": "Malware payload", "value": "e95c6dcfbb6721aacac7a99d3c8a3b86c2114c9914fd78c344d6fcdc535bb4b8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344812, "uuid": "77c661a6-1d96-4218-a0fc-d9501af0a397", "comment": "Malware payload", "value": "c00024f387cb3db2c42e5c01e6dc039b57c30e9f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344812, "uuid": "d371d5d8-f37b-4ac5-bcaa-35986cc5b672", "comment": "Malware payload", "value": "ed7246c9d8be0aa0630ec8d72467582303f795e9c0318b0294632cd1064d474dc9b6592a44280dd42068147519aed7b6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344812, "uuid": "b9a3f395-e98d-4ce2-a0cb-a60f5f617191", "value": "T12EF4236F27F8C19FFF1B6C7881E46A51A40AA3944F149676F2388F03CEA515C309AE57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344812, "uuid": "b974015b-ab16-495d-96a6-2334f3b4d0d4", "value": "12288:jB7XjND1/sZUFl2BvXjlGiqnWHdvEzwlDxAE8WZej6tCzSvcvv6ETzPM75ck3k75:jRjN1sZUP2BvXJXHREgxl868zSvcviWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344812, "uuid": "e023d98d-a9b7-4bd6-9259-a232ca9d8f6a", "value": 723540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344812, "uuid": "b4666039-90fa-489e-b990-060cb41c5b0d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344812, "uuid": "56dc9831-42e3-4bf7-95dc-025db490e4d9", "value": "\u8fea\u62dc\u5973\u72d7\u63a8\u88ab\u8f6e\u5978\u66b4\u6253\u89c6\u9891Mp4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffcc20d-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632334151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334151, "uuid": "6e05c745-6489-45e4-a32f-fcacc2de7411", "comment": "Malware payload (ArkeiStealer)", "value": "b44325a20f1f6455822db78851ea62e0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334151, "uuid": "d14ed58a-0ad7-4ef6-8644-25336f31e6fa", "comment": "Malware payload (ArkeiStealer)", "value": "e9c16d954e11dae123f981ec7477975abbca8fcbbdbf0a4104eb79ead96ad8c1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334151, "uuid": "172e199d-1de7-4387-a80a-b1da612ddcfe", "comment": "Malware payload (ArkeiStealer)", "value": "c0188c5e307595d01fc5fe2e59dc3bec1050c494", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334151, "uuid": "dc6b35d3-a650-4f0f-9137-5c0c9f2e95fb", "comment": "Malware payload (ArkeiStealer)", "value": "8ff6bc89bf9d5aa1da92157bff2abda92c12869341bd8251df607741611b3b78568671b9298c34e242f5be51865c0aa3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334151, "uuid": "028a2cdf-b8db-471e-a748-11e432193a78", "value": "T1D865E025D281F033D2B3FA38DD9A9B7F9B387E103914180B6EE82D691B253C1B519767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334151, "uuid": "44b5dacb-4c07-4192-957e-7ec94e8ecd77", "value": "c32368f78c61cf2d9d6654d89861a9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334151, "uuid": "dece1625-9c1e-4e0e-b798-43c5946df27b", "value": "24576:HBuzcdGnDD8NFX9qOZGPlhOCoNS8M7TRNF8mTWncJ4UdZpK:H2DIXxZwxiURNF8c/7dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334151, "uuid": "f5c52748-e1c6-4cb2-830f-443dec9bddde", "value": 1534976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334151, "uuid": "10bfb691-d588-4188-bc11-b20693ce195b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334151, "uuid": "5cb1c9ac-6a34-4f62-afac-3e2e036f7ecf", "value": "b44325a20f1f6455822db78851ea62e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557a95b3-1bcc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632332496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632332496, "uuid": "eefd9504-a2b9-4095-9ec7-a6095488d74b", "comment": "Malware payload (AgentTesla)", "value": "9f4da96a53bdec3b0b6d9b0b0485bf4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632332496, "uuid": "446f90e7-134e-48df-a82d-b144a55f23b4", "comment": "Malware payload (AgentTesla)", "value": "e9df10889f9591164da6652ef244bc05c5434123230eaaa1c52d82560a7447ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632332496, "uuid": "eae5234d-24bc-41be-ab09-84eeb8cd0bd2", "comment": "Malware payload (AgentTesla)", "value": "71b226076e1d9d66dde8064976f284f45b424346", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632332496, "uuid": "191c33f0-959c-4e9e-8bd0-704e3d333f46", "comment": "Malware payload (AgentTesla)", "value": "6f97f060bd7f8d7ff100d7af8a5d778194223343544503386b5f52b1b86137441050320103f1ba60ab5571a56da2ab4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632332496, "uuid": "c0cf2eb1-f89e-4861-94c5-b93b7fb7c73c", "value": "T14EF4F173A193CDA6C6494A3D5660F79C433C8F921E1BF29565663122EE33E4B2F08CD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632332496, "uuid": "577897b9-40a3-4ab7-8511-a264291d3824", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632332496, "uuid": "6176d488-b617-4839-8d0c-e452756d1e88", "value": "12288:GJcY7mtiK5oBdIswvEeiNa88qKaNUAFkDcFzU6AnHJxJKm0I/NLHNgJ3GuamzsfM:M7+FoBJwVBqtgDEDgzJCaN0XPAfJYOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632332496, "uuid": "84bd4c3c-0ecd-435f-b189-ae60d95ce114", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632332496, "uuid": "f81fc109-033e-47ef-b0b0-0b03072a6abe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632332496, "uuid": "2e89c440-38a9-4094-94d3-078a9a13367d", "value": "DI-SEPTEMBER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e3d505-1bbb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632325247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632325247, "uuid": "5f0932f1-0640-4eae-a51e-07469f085d48", "comment": "Malware payload (SnakeKeylogger)", "value": "57e65216f5b4d3925e1593a0b75ec893", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632325247, "uuid": "5256e1aa-4a6d-403d-acee-25fe84d7d075", "comment": "Malware payload (SnakeKeylogger)", "value": "ea83d4442ac800dfc597cb4a8dff685ecaf4528555e6dcc7eb091716b5d81542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632325247, "uuid": "fcb78698-ace0-4420-aae1-6ad6e19b29a2", "comment": "Malware payload (SnakeKeylogger)", "value": "8c494194b5058cf52ae9ccd37587d24628e30315", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632325247, "uuid": "9e0a1a9a-49a8-4f04-98fe-ff047538d191", "comment": "Malware payload (SnakeKeylogger)", "value": "3609fcc2814c6940927165eb29fb14f5497c94fc11e0420a9af8b5a552fc944c317de7318f1cf8301240133b1be1117d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632325247, "uuid": "07a1c5ce-9501-4b46-a88f-8c3223cc4622", "value": "T1F1E47AC49D895607D7944672DC5C664632282C4A3B23938BCBE13D773FFE283D22D99A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632325247, "uuid": "7aaeff36-8ed0-4dee-bec6-88a4427c7222", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632325247, "uuid": "b34f705b-e1b2-4d9c-ba1b-dae57e382dd0", "value": "12288:++mtiK5oh4lXHZ2LQZDKgKFR6fOstQMMK2k:5+Foh4l3ZDi8Os16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632325247, "uuid": "26f163c5-7720-442e-9f99-7c5f49183f53", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632325247, "uuid": "e9ee8b97-3c6a-4b77-9108-e60180cb8b3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632325247, "uuid": "82867ae6-f5aa-4145-9b02-6fee2b5a6be0", "value": "PO 4500151298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bb2190-1be9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632345084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345084, "uuid": "b5ba048a-fc9a-43ff-99ba-e8efbca8c4ca", "comment": "Malware payload", "value": "4868dfdcd24d67444a0272db7257bf48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345084, "uuid": "fda86cdc-e781-4c81-8fc9-c92fbd2c0f77", "comment": "Malware payload", "value": "eb01e20f2ed8f884f535bf058d1a9136aaa4508ad781a2b0c5ddfede40cf3165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345084, "uuid": "62ae6c8d-5708-41a8-a6fe-47a4700d44a4", "comment": "Malware payload", "value": "46eff8dbacc5687128c39be0c35a7c9656d6df4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345084, "uuid": "f03b01a9-9217-4c7b-ba32-48e81b9177f3", "comment": "Malware payload", "value": "0d82aa844a9cf2f9e36cc2b647c280548549a338d6a1c2ac338c8529158454e6812bbc7582d1203945f3629dfbf1ddfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632345084, "uuid": "90c00a92-711b-4bf3-adab-4804f3ccd6bf", "value": "T157756C227FDC86B2F1E71270A5AA477456B5BC10AB10C2C73394B95EFE70BC19A72712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632345084, "uuid": "6cc424e0-2e57-4d57-90d6-a9c5f45e8372", "value": "e2afc946bb1a7942e18b4d1a8f444ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632345084, "uuid": "49abf3fc-d894-4fa6-849a-6d214afa3f49", "value": "24576:qfnAFlGkImyME0yPNazakzcUs3Ooc8DHkC2exwfw+YBGKAN6+lEF:unIAkIT+yPNazBzcUvYBGDkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632345084, "uuid": "870891ca-0796-4a10-bef9-b22e3c6e96ef", "value": 1626112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632345084, "uuid": "5a219524-815d-4296-97fd-3a1184f1358b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632345084, "uuid": "9b8ca43e-bef7-477a-870b-534fac08da20", "value": "\u201c\u8bdd\u672f\u201d\u798f\u5efa\u5973\u5b69\u7528\u8fd9\u5957\u8bdd\u672f\u65b0\u589e320\u4e2a\u9996\u5145\u4f1a\u5458.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65f4c11-1be7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344335, "uuid": "d1eacfc3-2f31-41ab-a846-07d0cb18238d", "comment": "Malware payload", "value": "4ca179309d597aa93ab935503f06f89e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344335, "uuid": "2a6fb707-4e35-479c-844a-baa00adf7cdd", "comment": "Malware payload", "value": "ebc9a58d0952529700751709eff477dfcc97b2e65be005a6596494ffff4d0408", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344335, "uuid": "4c8369a2-ff0b-4458-b251-ae816e2cb613", "comment": "Malware payload", "value": "090f82ec6f15dfa89653dd4f78fa31db223a541b", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344335, "uuid": "cbe7252b-20cc-42f9-a7c2-276adf1831d7", "comment": "Malware payload", "value": "9ee27460f1ec3672e84653609003ce2761c804d632ee23f9da4e6fe7494a820eaf8b76bc524502cddf54b98e8483232a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344335, "uuid": "95315126-5149-40cc-9464-e30d74e0d14a", "value": "T1096423EE49230A17D84612FF978408A997DF3A4F1AE61743B2FB504EFD64C12B653722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344335, "uuid": "2de220eb-27a9-454f-867b-abee52316b76", "value": "6144:vKrgI6UOkTntv1TPQlU4KUd5FQZpG6BEgd9spn0LExhq9+uAr+SymhRqDKNTwGgC:pI6otVQyQdnQZpRPD3LaqkuA6Sym6DKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344335, "uuid": "4fae71b9-6424-4a48-923d-df3c013c06af", "value": 325838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344335, "uuid": "8ca56eb8-99dd-4f65-9655-4118e5887b3d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344335, "uuid": "caf9a2a7-a55f-4a92-b2fe-bc20925b456a", "value": "\u8fea\u62dc\u5973\u72d7\u63a8\u88ab\u8f6e\u5978\u66b4\u6253\u89c6\u9891MV.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b2f4ae-1bfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632353751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632353751, "uuid": "14dcdc40-a65b-42a1-8b07-46d886ab1552", "comment": "Malware payload (NanoCore)", "value": "56333c227b58bb5f3397dac80fd2993f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632353751, "uuid": "d4737547-e5a4-4358-9843-0643f7a74a74", "comment": "Malware payload (NanoCore)", "value": "ec08ae513fdf6245bb4f45c71eb532a887fa4702cba530055806f99f00aa705e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632353751, "uuid": "061bf27c-20b9-4c3b-ba4e-fd2e2367e69c", "comment": "Malware payload (NanoCore)", "value": "12c7e0c1f68d9b5a7cb7c4846d53578033403bb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632353751, "uuid": "6c020673-2e74-4d07-b7dc-e1e8d1f4d7a1", "comment": "Malware payload (NanoCore)", "value": "fa8402db5b683603be5682cf4fb89549273f0402e50d7f92859696fdb962ff7e63d5561b33153783e82bba00f707aa58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632353751, "uuid": "0c5f9887-0101-4378-bbb5-50f60b49eebd", "value": "T13A258A855D1C8851CC05A53B1624AE35FA2FBC612BF40AEB6397767FC2B02D261B743E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632353751, "uuid": "7d10ad33-64af-4094-8079-65317145b25d", "value": "fcb21c59d99c37755b5a8d0446ace99b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632353751, "uuid": "0da66b9f-1c25-48de-a096-e7a436ea9030", "value": "12288:uAhY9HGbus7YjeLIcSdThuQsx9I9UF8KRNQ9HalP+LCersEKoi+S/9hzfsS:uAhGSSc5sus9Ux0HalmLni+ihzft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632353751, "uuid": "54af32bd-d11c-4d06-87e2-e6503e0a0dd5", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632353751, "uuid": "16570d7e-9dbf-43d2-a0e2-45da01af4f0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632353751, "uuid": "61890563-6085-46c5-a0c0-1fd51ad7a23e", "value": "EC08AE513FDF6245BB4F45C71EB532A887FA4702CBA53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3d707e-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316586, "uuid": "9203bbc5-8395-4d5f-a728-16ebb5bd7173", "comment": "Malware payload (Dridex)", "value": "4d78ffe568a8a7ebf0f0d49249b091e3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316586, "uuid": "a74061e7-60a7-4588-a67b-3ea390d009d3", "comment": "Malware payload (Dridex)", "value": "ec1a3db5dec9dd4c2db9cd464aa1f3c26ee7b00d0611fb22efc0302c54bc571a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316586, "uuid": "e2e3612e-f332-40bd-a3c3-3aac28adb613", "comment": "Malware payload (Dridex)", "value": "b33cabbb11bc1eeb3e48b9422ad6d8d018992985", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316586, "uuid": "99a70785-4caf-4214-b63d-3f0e8819fa36", "comment": "Malware payload (Dridex)", "value": "20e9e81a1ec9701c4de4dec2abc9159e54d7da343f1884424d04c69024eca76b842ccfc6921d88c9845d41e22f88fa82", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316586, "uuid": "2a15249f-5973-47f0-9592-e27911101f1f", "value": "T12BA5D020EE69E1E6C6B89F3ED408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316586, "uuid": "e90404f4-988a-498b-868a-1b7be18fb17d", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316586, "uuid": "467d7022-255b-4de9-b1eb-34fb713b4d1f", "value": "12288:yVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:vfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316586, "uuid": "bab5d96a-cfb1-42ef-9af4-1473284fb626", "value": 2162688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316586, "uuid": "79bb95dd-7961-4f8d-9bb1-48d6c97ea9cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316586, "uuid": "5a2a64c7-3168-4925-b6a3-946c3041eefb", "value": "ec1a3db5dec9dd4c2db9cd464aa1f3c26ee7b00d0611fb22efc0302c54bc571a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4db2eb-1b3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (YoungLotus)", "timestamp": 1632270772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270772, "uuid": "832ae335-f657-4feb-87bb-d461152a416a", "comment": "Malware payload (YoungLotus)", "value": "61a6445842bfd501f8e8c63a18e899cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270772, "uuid": "08e7ec7f-8aa9-48fe-8a07-1b4c572ba25a", "comment": "Malware payload (YoungLotus)", "value": "ec694d5b05f7aa43e3e701e40686039a38d6827e5e944ba73de07f31da18d608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270772, "uuid": "5698ad8b-1e72-468f-a90a-70e5d10d8ee5", "comment": "Malware payload (YoungLotus)", "value": "5c2c9e20f5607534128265bbbd03794be01e9e1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270772, "uuid": "7ad9b5ee-60ee-4377-8e1b-476bc57ceab6", "comment": "Malware payload (YoungLotus)", "value": "f3d0245c6974a7603bf427d1f31c51dc628f890509a1b5679ca5c010c969a1f569baac9401a839f562d4016ba9f0f4c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270772, "uuid": "f8231a9e-ade8-4490-bb86-5ba1250de52a", "value": "T114859D11AECC4CB2E2A73230455E777951ADF8606B3086C76394779DEC34BC16A3A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270772, "uuid": "a8d6e190-b40b-4138-a319-2a81321987e7", "value": "e2afc946bb1a7942e18b4d1a8f444ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270772, "uuid": "3b666017-82fd-4286-b351-c2a5b5e65a85", "value": "49152:ynIAkIbQy7h9Xk2rWL7jhzxpIa6Ed6kd8:QkIbBpsjzl6Ene", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632270772, "uuid": "68b041a4-0b01-42ea-be4c-1de324bf7d94", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632270772, "uuid": "ea0caa95-9b01-4781-9e6d-35e6674d903d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270772, "uuid": "467c7c9c-d067-4803-8ade-d23b6523fbf9", "value": "\u9a6c\u5c3c\u62c9\u516c\u5395\u788e\u5c38\u5973\u6559\u5e08\uff01\u53ea\u56e0\u4e0d\u613f\u505a\u6821\u957f\u60c5\u4eba.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce4e0fe-1b3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632270661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270661, "uuid": "38c877fe-5da5-41b5-b617-f86aa8cdafb8", "comment": "Malware payload", "value": "aea12105ae0917ce464b4ff6cf2f007e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270661, "uuid": "c9595fdb-ed8a-454c-a376-8d2d2f0004db", "comment": "Malware payload", "value": "ecdd62ad743bd013b2d0f7d5cb635698315c86f39591f156bf39ee72a09dd861", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270661, "uuid": "1bb99863-1820-4183-854a-8562d7649050", "comment": "Malware payload", "value": "dd19d6fcb1ef97f173da95d1bbf36026307cd343", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632270661, "uuid": "f1c971b2-f39e-48cc-a9c1-624c1b48a22d", "comment": "Malware payload", "value": "2b4506d3ea879527a8100fec5b763e746ff03aba8d2de90386a55b1b6f6105bb751b8344ea101dbd8d56a0ab3e31db96", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270661, "uuid": "a6c5d3b6-ca72-4b19-8c23-0267e045ec8b", "value": "T1403533D7CCA38CFED5F34AFD2680EDA6ED2635D0391C176419649BCF8A060EA9743246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270661, "uuid": "270f7fad-63e9-47f2-a1d4-17d7c2ac2102", "value": "24576:l2PcEEjO2nh9QtMG2CfI6DFNNLfqZMlcftjY9uUDenVJGBRhS:l2PXcOMG2CfI6DVm2cfNY9uUDkbIhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632270661, "uuid": "6c1636fb-51af-43b2-b83d-b9f5fa874a6a", "value": 1098438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632270661, "uuid": "bc22a0a3-3356-46cc-9b96-824bb2d86718", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632270661, "uuid": "75e77fc3-bc45-4c5b-acee-c86b87974915", "value": "\u201c\u6c5f\u897f\u201d\u83e0\u83dc\u5973\u5458\u5de5\u5728\u83f2\u5f8b\u5bbe\u906d\u90473\u540d\u5c0f\u9ed1\u8f6e\u5978\u3001\u7535\u51fb\u89c6\u9891\u66dd\u5149.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d191d4d-1b6c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632291357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291357, "uuid": "8b1c0ec2-e69f-4090-934e-fafb213f5528", "comment": "Malware payload (Loki)", "value": "23435288fa91ce5561bdc28531154c07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291357, "uuid": "696e42d5-a114-4262-a4e1-8e91edbc8532", "comment": "Malware payload (Loki)", "value": "ed354c01cf8f6b7b40708f768da51a0b81b0fd838d15982e497a16ee4cdc6145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291357, "uuid": "1df170fa-393a-45c9-a94f-f9dd476a4e60", "comment": "Malware payload (Loki)", "value": "d8ef8d41ca0380014a5f4b4bf844e6232af4e237", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291357, "uuid": "84b0e6bc-d373-4c70-a564-da9c5f49f9dc", "comment": "Malware payload (Loki)", "value": "4545d6a93e21c8d6a9d2d57bfb5a62f0b91eca537dab398884968dfcffcc9b19e2bec3c51e99d43634a367c7b0228723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291357, "uuid": "d58a5503-a62a-4b06-ad1e-6d4bc6a2ed95", "value": "T108B4DFAC765071DFC957CE76DA641C60EB20B4BB970BD243A41322ECAA4D68BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291357, "uuid": "8e634920-307d-48a5-8bfb-cc8b52150b61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291357, "uuid": "b543d856-1836-4221-b81f-f6ce3eace1c2", "value": "12288:E0ix2mtiK5oBylxYHt3qICgZ3/RA4P23g4Pc4ofLfnGSYCB/:xix2+FoBywN32gxO4P23dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291357, "uuid": "f1ac5e50-cd0f-490a-a56c-60152262c9f9", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291357, "uuid": "1ea22115-1484-4d4f-9ea0-ff9e7d5350b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291357, "uuid": "a9ec8189-0295-4f82-8ff1-b243369f9cc0", "value": "23435288fa91ce5561bdc28531154c07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a50bb7-1bc1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632327960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632327960, "uuid": "7da2c81c-823d-48b6-87bb-de81cbac5f74", "comment": "Malware payload (Formbook)", "value": "9204ace7a5758570dbd35a19530591c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632327960, "uuid": "cda4148c-76bf-4882-99e9-22a4bd447b68", "comment": "Malware payload (Formbook)", "value": "ed4ba3559a925d94bd2917dd5d4247d84e904b1e8423c21e40a0b9efc7b295d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632327960, "uuid": "d87cf445-a83b-498a-b3b1-7e74abb3ba53", "comment": "Malware payload (Formbook)", "value": "69e92bf2483d4224bc3d0d2f6abb0d37810774df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632327960, "uuid": "696c0175-b14a-4bec-963c-1f231c21115f", "comment": "Malware payload (Formbook)", "value": "ac5296d678477e06b0d1275653a44973044fa1a118238bd91da49a6db4712d28608c4356c082d330b207bda0aa2e0b9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632327960, "uuid": "9400503f-652f-4810-8100-2af09e94b6c8", "value": "T1EF255A298D2682F7C7DEC63CD05C4BDEDA62AC877AA15F1DC495BB83127B60BE04845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632327960, "uuid": "780afea9-7aec-4edd-af0a-5e44ebc15ef9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632327960, "uuid": "0f0116b0-8e2c-46f3-a911-bb982a18b504", "value": "12288:e8D2s0bYTA8U//nI+XofT8s1yGMYP7r9r/+ppppppppppppppppppppppppppppd:ersIoA80/nI0s8sb1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632327960, "uuid": "4aae3095-8025-40b0-9466-d46ff16a3175", "value": 1029632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632327960, "uuid": "0fe0858c-a97a-492b-b78b-1e114eb09dfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632327960, "uuid": "07eb1bf5-bc67-4b1f-816b-db9879874b74", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c051ff35-1b9c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632312059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312059, "uuid": "b4a46c6e-616b-432f-b1c1-5627fdc8a462", "comment": "Malware payload (GuLoader)", "value": "0ac603351c55ee27acb5638a9f399bc2", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312059, "uuid": "c4f61e5b-2ac7-4bb4-baff-9d9483ad97e7", "comment": "Malware payload (GuLoader)", "value": "ed83f2d85eab216cb4ef465af7cb4ba303a511a2db6298afdb15649709f9c5bf", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312059, "uuid": "695cee99-ea6e-4390-b8a2-f9d933ed6ad4", "comment": "Malware payload (GuLoader)", "value": "048f1a7cddf701c09a2d5b1cc8162f5bce03c784", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312059, "uuid": "335f4052-669b-4d28-9618-a1a0809cf6bf", "comment": "Malware payload (GuLoader)", "value": "92e7da727833a0993e0fa4602f27982dba4b74fb3faa7ff48ba71e2a494cd2acc60cfc5cd734694ea29477af7e2f692b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312059, "uuid": "73108de2-f84c-40f1-81a0-43f8da89f016", "value": "T1D0D4F10EA9F11A07D15F453C53DBA58100D8FE1A8E36C6EE439C7CB580B6BE97B3584A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312059, "uuid": "f7fc75bd-a0e5-4676-a388-53217a90f894", "value": "12288:ASmJcqRnc25MFzsAk8LMFyyp1WlBj9pWEFczgEFMHgAuNJr:6tFxMFQAeDp1Wl9PWEazoAzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312059, "uuid": "d7e816f3-4d24-4fa3-a3ab-dd6000ae266d", "value": 601720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312059, "uuid": "d75ca509-ba74-48f2-90ea-e08e08c8c4fb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312059, "uuid": "404307b3-1828-4b2e-a934-14062235b986", "value": "LIJST MET ARTIKELEN OA_016082021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc91244-1b3e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (YoungLotus)", "timestamp": 1632271788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271788, "uuid": "81710085-eaa6-443c-b31a-2c4c43bb24a1", "comment": "Malware payload (YoungLotus)", "value": "268551f31049d52efafa550bcc06e2a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271788, "uuid": "845fba86-2af8-4e8b-bb78-d816ed0e3116", "comment": "Malware payload (YoungLotus)", "value": "ed8c9ecf310800fb300299d62fe6610b59f6f761e0450b0e39bd21c3077683a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271788, "uuid": "462c5d72-2e83-496a-adfd-c0e4ff4bfc6f", "comment": "Malware payload (YoungLotus)", "value": "6e627da851706fa5f9dcd0afcb96a0061c61d8e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632271788, "uuid": "5528c9b5-a735-4628-b963-540ad38f1e32", "comment": "Malware payload (YoungLotus)", "value": "8093006ecce7bb6d82321fd5290048d37e0d73e47f162e7af95991c716725f57463be8df209f4afd5111a3c6ae93b742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271788, "uuid": "c7f5cfa7-2fe8-4069-b7c0-e6d6aa3f9a8a", "value": "T158B58D01BFC86A74F4B73534693176A510FDB9206B24D19F93D8BA6EA531B809D30BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271788, "uuid": "4307f60c-2934-41d3-a0d7-63642c55a174", "value": "e2afc946bb1a7942e18b4d1a8f444ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271788, "uuid": "f52e0fb0-d558-4c81-911d-7d74875afc11", "value": "49152:DnIAkILnIRitSSlWXkvKc6HjHRgkjzGVHMDueJI7SRTR61ZNXIQAwwYAwgQAfP/k:3kI0GSS0mkjzG37SRTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632271788, "uuid": "9099e93e-15bd-42a0-a9d1-bdadebe7ac2a", "value": 2359296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632271788, "uuid": "fba924e3-34ca-45f3-b8d2-2b5f30cb9781", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632271788, "uuid": "91263e81-3099-46da-ad75-311bdf5c996c", "value": "\u9707\u64bc\uff01\u4e2d\u56fd\u7559\u5b66\u751f\u6740\u6b7b\u5e76\u5f3a\u597828\u5c81\u5973\u5ba4\u53cb\uff0c\u73b0\u573a\u8840\u8165\u65e0\u6bd4.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e5d673-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632316360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316360, "uuid": "64ca8150-0828-47f2-8cf5-b8a7898abf04", "comment": "Malware payload (njrat)", "value": "9058175e129983f1fa26192b92963427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316360, "uuid": "79666a80-2416-4be5-bb77-040a393efdd6", "comment": "Malware payload (njrat)", "value": "edcf9ff78c1052de65460ccb3122af13229421ba933548e5de24cebd684d1aa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316360, "uuid": "1ee472df-dcd0-4470-9ad0-67cdc4b66ad1", "comment": "Malware payload (njrat)", "value": "884f78eed7337ca3305f175e4cdf30093465abc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316360, "uuid": "8fb7f646-2a45-4d42-89d5-7c7597493e44", "comment": "Malware payload (njrat)", "value": "c9ae326f9b17cdf08f4e8097fb0c6401ef5096c4291a6d034c879ca95e4732ae4942b615def11a53d481fef2777223a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316360, "uuid": "0688274c-9fa0-43d3-92ec-a7d868b8f834", "value": "T1D7E5331605CDFF13EC0A1732EFAEA00F6A22711F79DA05F911254BA7A79C6FB12C1A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316360, "uuid": "17b22b26-3120-427e-a7cd-7ea7fbbeda24", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316360, "uuid": "0aaf270a-93d5-47d0-8753-529d391eebec", "value": "49152:xh7FSWi4tvE3dMKUvlK00mL8lOiA+EAvhFe2r3UbTal/etmNnxz5Ki+:jxSoFE3bulbL8RA+EApFLr63tmbzQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316360, "uuid": "dad36723-f9a4-44e1-b107-3c9365b54cc6", "value": 3162112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316360, "uuid": "80fd48ad-d9c4-4dab-b979-2bf5cb710484", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316360, "uuid": "f6f12c8c-d9fc-4605-937c-24ba509560f2", "value": "edcf9ff78c1052de65460ccb3122af13229421ba933548e5de24cebd684d1aa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb6982c-1bd1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632334521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334521, "uuid": "7a472bcc-ed10-4579-ad20-c143e83e6400", "comment": "Malware payload (AgentTesla)", "value": "88bb493f91d20d39a8bb13cb98a9a037", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334521, "uuid": "b3a02b10-7f54-4b42-8928-a9a9dfd043a2", "comment": "Malware payload (AgentTesla)", "value": "eebbd31d3cda557d89b44726403b7870b534d3ebbed193aec9481f78f9e843a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334521, "uuid": "d708123d-03ea-4f90-9937-810cbcbd60ad", "comment": "Malware payload (AgentTesla)", "value": "c3a4615dbf70929aff201e237c1bbd8cbadbf2dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334521, "uuid": "793c2d18-1b5b-43f0-8ecc-6f91c175b23a", "comment": "Malware payload (AgentTesla)", "value": "3c1720f5a750513efba7dbde1da8b55c58cfe1cd2573d901b414192f14c5898dbf8349cefa79b23ad6f86a72f9d7fae9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334521, "uuid": "bb4c92f3-0eda-4d0d-8316-e334740ad4e7", "value": "T183059CC84D895603C3A54672DC5C660632692C5A7723879BCBE13DB73FFE283C12D9A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334521, "uuid": "4b9f46d7-9a3e-4115-82ee-1dd451871104", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334521, "uuid": "580f1a38-085b-4f9e-9ded-79fed48bb65c", "value": "12288:KJmtiK5ohhGQX9mZilyhzUu+S7i7pbABy5Czuak:G+FohhtX9m4GzUu+9uECzua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334521, "uuid": "6af72f86-1e4b-4b5a-9d8d-f6b168340dfd", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334521, "uuid": "a7f4acd0-b600-4077-bed8-bc27f8204498", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334521, "uuid": "f36c1c2f-aae2-41e1-be13-1dc9878df3a4", "value": "88bb493f91d20d39a8bb13cb98a9a037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067221ff-1b6d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632291561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291561, "uuid": "353cc0a4-3291-4033-ba0b-534149a6db94", "comment": "Malware payload", "value": "3082aeb62201681665eded4f0e195b52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291561, "uuid": "905de434-5d0a-44b0-94a0-1a18725f0e3c", "comment": "Malware payload", "value": "eec2a7d42b379d93b1e937314692f641b2ab1dbb1303568824170bd1a1ac21c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291561, "uuid": "f89bd743-c059-4f81-a2f8-8044ba25850e", "comment": "Malware payload", "value": "aafccd94721e21f879e54e1f1fe79160fdac3a85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291561, "uuid": "fa4395b4-4c15-475f-a0a3-b125ec0bcd96", "comment": "Malware payload", "value": "92f9267787e0eb562db50610f941b771a969d969fb98de283e60b996f3820371612912f2d6c4c15baa9e8518d411dee5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291561, "uuid": "340d1105-b5e9-407a-86c7-34dd9ae7ba77", "value": "T13F84D120AAD0C035E8B752F545BA83ACA93D7AB16F3090CF62D656FE22346E4DD30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291561, "uuid": "d899e0fb-0a72-45e9-91ff-eeeb7b5b712f", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291561, "uuid": "a22a799e-406d-4c01-b236-f5e5ce2f5c09", "value": "12288:4U3CERgLevgNTYsR9DDs3difI3DpviIL7PR:3CdLLTYsr0ifIzpBL7PR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291561, "uuid": "1d78559f-68e4-49b4-8998-69651b1a37f7", "value": 399334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291561, "uuid": "58e2ff79-7756-4b32-a962-d3d9412d85f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291561, "uuid": "f708324d-4a3a-410e-b356-d76860003ef4", "value": "3082aeb62201681665eded4f0e195b52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed658fe-1bfb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632352617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632352617, "uuid": "477aff42-eefb-41f2-8eab-903473f56edd", "comment": "Malware payload (Formbook)", "value": "b76aa61a1aa68c1c143e52bf6191e4a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632352617, "uuid": "a842ed94-1ba8-42c8-b247-eb3dc9f916e7", "comment": "Malware payload (Formbook)", "value": "ef4a9aba2afcd39bbfbce4fde4f5b14869115984d430c2e73353e89e214feaa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632352617, "uuid": "df50494a-8224-4bb0-8817-1748e4ed115a", "comment": "Malware payload (Formbook)", "value": "bfea883dcce9c7d6d64b8e194800b75890a36610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632352617, "uuid": "23b99edb-6a5d-4dfa-bade-81cdaddeabcd", "comment": "Malware payload (Formbook)", "value": "398bb49c8238fbe1c9f9a4e148f7b66f047f14d5266ca7e4f9b3634b5f1ad473fb79a738e4092ec50cbbd2c673aa512e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632352617, "uuid": "790bb874-d66a-4209-b2c5-5f2e3edb6a8c", "value": "T1D5F47AC56D889A13C3940632DC5D6205366C6C4A3723934BEBE53E7B3EFE2C7812D59A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632352617, "uuid": "f476a5e1-f1f4-4373-adf2-b39a37460ed8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632352617, "uuid": "3be1ab29-a016-433d-9f59-0a2a0ba0c1ee", "value": "12288:/oaqmtiK5oFRp4Nvh46azZU6ZfdvsrxI04ZPX9Kvrthak:zq+FoFReC60+6JdUrxlEXA5ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632352617, "uuid": "d7439a34-cf83-4212-ae99-98f4b1cc4fcd", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632352617, "uuid": "c7a1061a-9118-4256-89dd-bc1540d4420d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632352617, "uuid": "68917184-1fcd-4828-b786-95a36a707dfe", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1038d326-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632316488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316488, "uuid": "8a917583-7255-4c86-84cd-1405bf19759d", "comment": "Malware payload (Gafgyt)", "value": "68710c97863863f09ff5040579ff4604", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316488, "uuid": "cc359186-27f2-4b47-8647-ac9d744c395b", "comment": "Malware payload (Gafgyt)", "value": "efdc9e8ce38a65debb6e92f7b2332907919ce53868d26286876c52e519fe7425", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316488, "uuid": "331659bc-004b-44ea-97b8-fb25f4213fd6", "comment": "Malware payload (Gafgyt)", "value": "cbaf9816020fe22d1deab64936df43f20da7639e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316488, "uuid": "30df2a96-28c1-4401-b5e3-0f7415c9c580", "comment": "Malware payload (Gafgyt)", "value": "04b9d5ddf257174ef0e6c3d3c7b5e8ab36a6b3c8982628d4ed8daa3d8d87d4f96f1915484a96870aecb15cbece6ed8ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316488, "uuid": "79f0de2a-be0f-4095-b64d-f5bba7f2d7c2", "value": "T115931A45F9408B27C2D327BAE79F439D37356A6497DB330169297EB42FC27C92E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316488, "uuid": "f690d9d7-ad1d-4022-8f28-8bd25dcee713", "value": "1536:MSfNq5P0rPRAn08FOpSPYU9u0BODsvsOPwvfGJ5ryMg6tGXNyYgrEDGoew7Wefvh:c5CAOQuUsOPtyVvcmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316488, "uuid": "0699e3a1-bc8b-40ec-aeae-be4e77f9ee64", "value": 96946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316488, "uuid": "38dcd464-c82c-4979-ae42-a43bc708329c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316488, "uuid": "004defc9-cf84-46e7-a172-a4b8e6d11630", "value": "68710c97863863f09ff5040579ff4604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c625130-1bea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632345419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345419, "uuid": "42a9bd51-e485-4a98-ac16-7e7fd733098c", "comment": "Malware payload (RemcosRAT)", "value": "c05b57213197716f1f357f4b2cea6d9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345419, "uuid": "7e65f0f1-1380-421f-bfec-035558eb05e6", "comment": "Malware payload (RemcosRAT)", "value": "f005f5a029943fda1afb5d0c225bb3618253ae8a705a69c92d9f223bf8c38485", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345419, "uuid": "ff4e1593-569e-4f1d-8b54-152bf0cbbc50", "comment": "Malware payload (RemcosRAT)", "value": "36d50b3c3bcf105cbda2f72eb0b23543785a152b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632345419, "uuid": "d07f1755-6650-4a96-b428-d0cc16ec7b77", "comment": "Malware payload (RemcosRAT)", "value": "4f8a5c6dd320aca01ee3802c902e8ecd1dcffca043c4b00658e453a9f730e6ac993c0df5e99cf059a25faf4a08e9d041", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632345419, "uuid": "0e1f2c24-1c28-4f2a-9f81-380d75836674", "value": "T194255AE27384E8F1ED243A3ED949B2551715BBF52CD31C4C9DB83E8A6AB4690F94D083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632345419, "uuid": "7d1c1b71-a1d9-41a4-b808-b69e8cd19139", "value": "91a12f22e7f2305a107edddf42c40880", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632345419, "uuid": "5004551f-927a-4850-ab07-0de0d27bd222", "value": "12288:FYfGUHuv5bSkBsFkT5m3GpOAz1feoAdrL7i:FYOUUtBs2YqO8ArPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632345419, "uuid": "a23ee10d-472d-44ea-879c-04c9f4dacafc", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632345419, "uuid": "15c518aa-80c5-491b-834a-51ece0d26ee3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632345419, "uuid": "2ca114c9-c166-4703-8b87-063828481dd2", "value": "Attached Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1087c85-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FlawedAmmyy)", "timestamp": 1632316758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316758, "uuid": "541923bb-64d4-4767-a255-4759849cc005", "comment": "Malware payload (FlawedAmmyy)", "value": "be0d14f5918030c0eef55dce6209fff0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316758, "uuid": "4c1b18a4-9794-4f90-98ba-3c9a7e4bcdb0", "comment": "Malware payload (FlawedAmmyy)", "value": "f02eca433cdb78186c1614b914ff4aa8da47dd430e8288ad721bd1da610f32d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316758, "uuid": "85d07454-1289-40f1-bb91-59b028793a7b", "comment": "Malware payload (FlawedAmmyy)", "value": "7a8efd1c4fcb1374da6fbbc422839bc31e92e554", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316758, "uuid": "8bb4a463-2e01-4ea7-a7ab-a144fcf9f909", "comment": "Malware payload (FlawedAmmyy)", "value": "f3527dcdcae684f9165b81f045e8b8f4545d59ff5156b1f5acbbdd93a8470cfa6cd0b8121812df285cf3171756262415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316758, "uuid": "29dcc842-7e45-450a-b0a3-31767342c590", "value": "T14825C0267DC1807BD272067189EA67B2E9B5FE600E37890B5388AF2C5D76D01DB1277C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316758, "uuid": "9c1d8fe3-d2b9-43cb-b578-e939300a3807", "value": "a058756785ba9de3e6bdd1f326bba0dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316758, "uuid": "01466b5e-0322-4edc-9c00-23496e7c9c50", "value": "24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxE:dJ5gEKNikf3hBfUiWxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316758, "uuid": "63391266-8c23-4cae-8a4b-cc6d29b70811", "value": 963500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316758, "uuid": "c2958e12-b20a-4ef1-889f-85ed98f13477", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316758, "uuid": "dc71c9d2-b347-44ac-a36c-53c3fd6ec21e", "value": "f02eca433cdb78186c1614b914ff4aa8da47dd430e8288ad721bd1da610f32d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6e5e7b-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632312506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312506, "uuid": "b69e5915-e1e6-4e5b-a51d-685a3d3ebb12", "comment": "Malware payload (Formbook)", "value": "9eebb00c7038e89f5b8d2caca13d2ddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312506, "uuid": "c88a9f4b-063f-424f-8dee-69986b50b776", "comment": "Malware payload (Formbook)", "value": "f03c40561ba64d0797bcf79bfefd015c8d9ca010f1bd67b3d27ffab584a9911e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312506, "uuid": "85731a5d-5829-4a58-bdbe-76bd56e1c1d1", "comment": "Malware payload (Formbook)", "value": "6691440f800cef981aa94b739f70b9d7c87fe465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312506, "uuid": "01c99d81-ed04-4c3e-9662-5bddb7058329", "comment": "Malware payload (Formbook)", "value": "39a490c62b4acd52460aec9a65c982a298628fb5d21b4668b20da4842d70594a2d99bd8347601b5daf86952d0f0fe71f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312506, "uuid": "a764be17-4c7a-4031-b064-80bfd770516f", "value": "T1E5C42239E3AC8775CE784BBD11A101D44BB0B1C6BF07FA589B85B089ED1B7914026DEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312506, "uuid": "af17aa44-f5e5-4ac9-9a0c-7f7528d5cc2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312506, "uuid": "b9c2bbe9-7605-4b69-9f72-5a6351da5f51", "value": "12288:lgVpmtiK5oBzfhaOCv+ZWPhpWaB6cg/tpG7VdyQ:y+FoBzh0v+ZYL+DG7Hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312506, "uuid": "1c9117cc-e96b-4665-95d4-95b8888e694c", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312506, "uuid": "5b82db02-2fd9-48db-9aae-a61aec91bb4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312506, "uuid": "de06326c-6d15-4af0-ab19-367788274798", "value": "9eebb00c7038e89f5b8d2caca13d2ddf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24db0e6-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632316868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316868, "uuid": "2557d477-32c7-4b6e-ac79-aae87af07009", "comment": "Malware payload (ArkeiStealer)", "value": "ec6707a7b36ba6ac3b2a0c8361fbf84d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316868, "uuid": "8a314f04-af06-4698-b39b-e34f8cfa7489", "comment": "Malware payload (ArkeiStealer)", "value": "f040a5e3d2c865772e4f8b1fda5ff3437fb0a35924fd260fc76732398e262dde", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316868, "uuid": "5d1c21b2-0a54-485b-9af1-15c63ed69bb7", "comment": "Malware payload (ArkeiStealer)", "value": "f2f906efa140e49f2c13885bfdb27ddcb844f3dd", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316868, "uuid": "9aa34814-a51f-4976-b879-8ec119465d45", "comment": "Malware payload (ArkeiStealer)", "value": "86fb7861572bf6cf1dcd5424a21073529a38c6ddfbd01c1fb1465ec1e215783e85528e1e2b221c18dd6e9bf4ced23b5f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316868, "uuid": "45b1f762-bb00-4bd9-aff0-a4c0402848c5", "value": "T124F423213690CDBFDA56A4B044D1C6B0E62579631EE6A44733E547AF2FB13B0371A38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316868, "uuid": "2ca35a8c-63cc-4b8e-8c03-9a9df869e0df", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316868, "uuid": "c33f3295-f205-4860-84d9-f7e8422ff01b", "value": "12288:HAtpfKSsvh2NDgRwDzawGsK3tqVa6PSYJ67G2Kc5EcFl:HAtuvh29gyWwgDwSy2bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316868, "uuid": "48012e54-cd75-44c5-8168-2d523eb695c4", "value": 764544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316868, "uuid": "86bc78cb-b939-46ed-90d6-a2f1fdfe87a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316868, "uuid": "807f5023-3421-4617-86c8-6e8acdc82bb4", "value": "f040a5e3d2c865772e4f8b1fda5ff3437fb0a35924fd260fc76732398e262dde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083cba91-1b7a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632297147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297147, "uuid": "bfff124e-c5d6-49c9-80df-a3c1c3c40481", "comment": "Malware payload (Formbook)", "value": "fbe816d90066c5527c4649099c832c53", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297147, "uuid": "b734ec7b-ac56-4c05-aa15-c200ae34e399", "comment": "Malware payload (Formbook)", "value": "f087a1d9a91b678c1df6514b0bed5956d08117cdbd9a5843f2511626ab55c7f9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297147, "uuid": "6196336d-d072-48fb-8bfc-c058c6ed5a54", "comment": "Malware payload (Formbook)", "value": "66b54a0f2e71552213656632290c88865c542cd4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632297147, "uuid": "6305331a-6183-444c-a33f-408a7273c671", "comment": "Malware payload (Formbook)", "value": "25b263a8888fed201c071cd9aec5e0282d36fd3224c472b676bfd4e257d8124a92ebb820baf40e4c6b4ff30728a72bac", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632297147, "uuid": "aabf2590-e807-4dbc-9cc4-8d9b34f23915", "value": "T1CDB42385C757E7E40927FE98E034D737D2505E3BFDEE19C80C8A654F28520C6A5AC9A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632297147, "uuid": "d8a13d13-0e3c-41a9-b16b-c116b741bd92", "value": "12288:h8V69IzUkiTEn07w1Gip059RINSCeamHNS5X:h8g9zkuO1GNLSxzmHNSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632297147, "uuid": "c54ec2a2-5495-4805-a9fb-b845e71abf6e", "value": 500489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632297147, "uuid": "9358c886-2ca7-41b0-98e0-9a2e82de8323", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632297147, "uuid": "6dcaf372-0587-44ea-9c9c-11923d6c4ba5", "value": "IMG-009.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d12139-1b57-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632282344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632282344, "uuid": "ae6ffa63-4ab9-441c-a61f-194f19e12796", "comment": "Malware payload (RaccoonStealer)", "value": "fc977ef424743cc8bca61775a455342b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632282344, "uuid": "621231c7-dff7-4ad6-be29-c2e92b53b795", "comment": "Malware payload (RaccoonStealer)", "value": "f2d3836aef9771efe1fa4b1a3fad5488c2d3511cd536f5ee4cd29c8a3d2b5399", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632282344, "uuid": "dfeaa9d5-a526-4433-994d-e6a775e2ccf3", "comment": "Malware payload (RaccoonStealer)", "value": "e11d087be855674f2165da6dbe5afa5fc560700f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632282344, "uuid": "5c1387b8-7fcf-4fc3-8b3e-e85ed5eca7ad", "comment": "Malware payload (RaccoonStealer)", "value": "e55104a3a72a42d346c92a4e61b181faec4768166764625c6acbbc053546daf2ab9f43b4912582513b096eada031770a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632282344, "uuid": "327b4d11-d988-4090-8316-dc02cc49e0da", "value": "T1D3B4D0206EA0C032E5B796F949BA93A8E93D7DB16B3041CF61C526EF26342E4DD31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632282344, "uuid": "003441a0-b787-4c85-aa7b-06909bcabf4c", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632282344, "uuid": "0bc10e2c-bacd-4b19-b5b6-99533d3ddf3c", "value": "12288:4U3CERgLevgNTYsR9DDs3difI3DpviIL7PiyLogpz:3CdLLTYsr0ifIzpBL7Pibgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632282344, "uuid": "1b0c413e-66aa-4dbf-ad96-2f678d3ad4fb", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632282344, "uuid": "f7ba77c4-fcad-4ebb-b307-941f7e6baab5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632282344, "uuid": "7824604f-1518-41be-881a-b7f3bfe62b7a", "value": "f2d3836aef9771efe1fa4b1a3fad5488c2d3511cd536f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871c181b-1b9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632312393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312393, "uuid": "95365585-0f41-4055-8bab-4a5fdd568e46", "comment": "Malware payload (RedLineStealer)", "value": "fbde13ed0f4e3ff41c0be9cb5bb08df6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312393, "uuid": "b8f02e04-b5ea-4cdc-a577-5a61d100331d", "comment": "Malware payload (RedLineStealer)", "value": "f2dcef55206cf3f02557e31f850db63330d849374956cb581bd9b016803907d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312393, "uuid": "3b1dcc25-0642-4bea-981e-5913d967dd67", "comment": "Malware payload (RedLineStealer)", "value": "f51599f965632673400317bc1d557e3da14b6296", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312393, "uuid": "31a60510-7a37-45b1-8233-ba41f36b7871", "comment": "Malware payload (RedLineStealer)", "value": "10ae365601ee05d208767fdb3e693945922bdf4fb6b6963aac45b3b6ab6189464a73a1d2b64c8fa4001289acaa444cbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312393, "uuid": "f7b043f1-4c72-4212-8fd8-1f888e200980", "value": "T18A84BF30BAE0C039F1F712F885B9A768A93E7EB15B3451CB62D51AEA16346E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312393, "uuid": "107ecfc2-e07f-4699-bdd5-9b1316795911", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312393, "uuid": "1163648c-0ff5-49df-b0a5-99c14ea70bbb", "value": "6144:lj2qa32rIJX5waePF/VmJ2F2xFhiw2YxOlIB0psHkBt:Eqa32rI956POJ2it2YwUDEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312393, "uuid": "c735cc75-a9e2-4f2e-a748-a69e27230022", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312393, "uuid": "eabf2d0d-9c22-4c6f-8711-4d7ea725c530", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312393, "uuid": "4f534512-be82-4fe6-b646-2303fc250086", "value": "fbde13ed0f4e3ff41c0be9cb5bb08df6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83dcb8f1-1b6b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632290912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290912, "uuid": "8d08da6d-0e48-4ec0-bbc9-b1ff6e2eb806", "comment": "Malware payload (AveMariaRAT)", "value": "26912238679165eec67430c9739b5590", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290912, "uuid": "64551459-8498-4d4b-a0fe-9e4e41a27456", "comment": "Malware payload (AveMariaRAT)", "value": "f3cf6d2ae60dde6232e5e820cb6e6a2d9dbe53a5bea09e8985cb6c80ca6d51ad", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290912, "uuid": "233ef464-a783-4a8d-a54f-698a600f260b", "comment": "Malware payload (AveMariaRAT)", "value": "9601635800928f964d02b70d8312befc79e9a95e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632290912, "uuid": "c5a81b0f-0f2d-4e64-9337-534ab09bc1f0", "comment": "Malware payload (AveMariaRAT)", "value": "fc1a89d654d36ab2f59f142d5ef7ddad868168f8ae5f09c208c6bce8669fa6061db3598e858dff8724bf454c6e3886d3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290912, "uuid": "8b9a5371-2882-44cc-b7e6-75a861778d01", "value": "T116D4B27937A1E9AAF62F8F34835313001C6BFD5B0E5913A4E9CA3D457CB22009DB59E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290912, "uuid": "ff24b8c0-b55b-4796-9978-8ef2b626b0ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290912, "uuid": "296cb74c-1a02-49a7-91df-356caf5ca58c", "value": "6144:5bNcmjanS4wsKRt0s5V/C946bpKIbpcydvtJ04Cay0zwW6gghU4kX6cKlE:3c8anWGFG4CaPzQhU4kX6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632290912, "uuid": "21a3d763-890a-49cd-a486-c3f64701dc18", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632290912, "uuid": "d3454bcd-fd37-4d46-a82d-680fc60a1914", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632290912, "uuid": "17348abc-05fd-4720-9417-56009213e83c", "value": "26912238679165eec67430c9739b5590.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843f5321-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632317112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317112, "uuid": "db3bdc28-68c5-405f-8bfc-776f86781360", "comment": "Malware payload (Mirai)", "value": "f3a748b1e64e185d300a25510768bfaa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317112, "uuid": "24491746-a34c-4b04-afe3-8d6e830df175", "comment": "Malware payload (Mirai)", "value": "f3eb8eb8ec1f07b0a0b569cef5ffcb2c030f1071009f05b4d5f4544d09c960a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317112, "uuid": "f36fc57a-c8af-4cc6-ab23-be34f3e5ef59", "comment": "Malware payload (Mirai)", "value": "6053723534fd7179d96b87fe17170e587ffbc033", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317112, "uuid": "ff1f84b3-7774-4f1b-8487-31ca12b7101f", "comment": "Malware payload (Mirai)", "value": "8e406967709a46a4fc36c66175e2430f39718055773fd30ee537060e9804fbb923ed9cda305355e2771b00e847e239fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317112, "uuid": "f6be1897-02e7-49f7-94b2-65b988c86c7a", "value": "T13AC3E731E8044B1BC2D223F6E79A829E3F351E9797973311573879B02FF27991E29524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317112, "uuid": "17f5dd4c-6bb4-4519-b99b-e4d929f671d4", "value": "3072:FDcYVLWKlAQTv+mYTbpl2m7/L7QsvmGugiNb:WYVxlAk9YTbH2m7/L7QsvmGugiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317112, "uuid": "e2bd17f4-d298-43db-90c7-83d9cccb863f", "value": 125009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317112, "uuid": "ec060e29-b392-499f-a54f-2b2c02380cdf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317112, "uuid": "fde20224-fa72-43c9-8c90-e12c0fe469f7", "value": "f3a748b1e64e185d300a25510768bfaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc24ae5-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316670, "uuid": "a876e280-8a06-43a3-8ace-64c200739f6d", "comment": "Malware payload (Dridex)", "value": "b87dbddc1969f75818f3f1ff00f6a08d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316670, "uuid": "dd6b6029-3467-4962-a74e-db05a7d1bc60", "comment": "Malware payload (Dridex)", "value": "f52d1f955b459516fbd8cca7dc08a1d6cc12a36003c151ba04a25aae67bdc474", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316670, "uuid": "d7c34bf1-6436-481c-a2ff-a4ab951471a1", "comment": "Malware payload (Dridex)", "value": "81a630dd3823cce564c608c9e4fb515c03791c72", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316670, "uuid": "ba74162b-c2e5-44c1-b835-fb3e5285b2f0", "comment": "Malware payload (Dridex)", "value": "e16f473e73abc4dd2441dfa8b8b924dd426a78f8fffaf40d131b13eded4b58371b301f22b6915c3a141b6b7b6bfb3e8b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316670, "uuid": "48b9fc20-7382-4dc0-9b17-f40b3d680a08", "value": "T1A875E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316670, "uuid": "27ae78ea-3f51-4ba5-a43b-dd570b0d33c0", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316670, "uuid": "ba6c3785-1e4f-44ba-ae3c-3c26cdc66b48", "value": "12288:oVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:9fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316670, "uuid": "7c94bf70-d445-4af2-8f6c-e51534ad73f6", "value": 1576960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316670, "uuid": "6b585de7-6feb-4125-82a1-6e531068d7a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316670, "uuid": "d532ec1a-506c-4c3b-984c-6f76c1514725", "value": "f52d1f955b459516fbd8cca7dc08a1d6cc12a36003c151ba04a25aae67bdc474", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c219f7-1bb7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632323368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323368, "uuid": "7ada04e6-cd12-4215-a80a-db64e99aec8f", "comment": "Malware payload (NanoCore)", "value": "0bdec1c44b60cdbd470d686c099948e9", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323368, "uuid": "b0cc97de-2e6a-4c89-ae3b-70c3103ea9a7", "comment": "Malware payload (NanoCore)", "value": "f5628d59a7d425ac67703aa1e86869df06db3399a08aa58ac4d630bb17550e4f", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323368, "uuid": "11d969a4-0442-4598-860e-697118b4c901", "comment": "Malware payload (NanoCore)", "value": "1ee15e57d2e9d8be3fd772d46aa67833c2fe2dad", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323368, "uuid": "e4983359-66a2-4446-8c3d-2d02778d0479", "comment": "Malware payload (NanoCore)", "value": "ff9ff0cf9564b0085cdda7abc738c558fa6956bf4fd8b586ccca36123885efbc87a5ee3eafe8978116c83712cb8a3941", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632323368, "uuid": "616a415f-2573-40f2-ae0d-bdeb86291584", "value": "T13DD302CCAEF0FB89D551A3B8985BAB9DE1705C115C235CC42D437B1C267902A1B6B53F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632323368, "uuid": "058989b0-f716-4043-abbb-dd36db648c37", "value": "3072:uc++sibix8EtC03syBtYXC9eqtFdrICWTy:T+KexTnts2eqt7ICW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632323368, "uuid": "618004bd-7bdf-4c41-a9dc-9e102768b2ff", "value": 132568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632323368, "uuid": "ec71559e-eabe-41d8-9eeb-78574a8efdc0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632323368, "uuid": "f8d27176-267f-4418-b0a6-de244c43545c", "value": "New policy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c39214-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632316784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316784, "uuid": "38a2a52c-dee8-4326-9d41-268c132c8b86", "comment": "Malware payload (Gafgyt)", "value": "e26b1c7dd65e5e91b4063567ce208769", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316784, "uuid": "75102039-8c40-427c-a5d9-c569d348f3c5", "comment": "Malware payload (Gafgyt)", "value": "f63a9e73051430ecb2ea0dcd7be69d4b4facdcc20a278c476df6fd8cd0f39398", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316784, "uuid": "c4dd90e0-c8f4-406b-b19c-1ff83cff9794", "comment": "Malware payload (Gafgyt)", "value": "57b7eabd8d9144456a10d77441df2b3a6acd28f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316784, "uuid": "a9e901f0-754e-41ab-a18d-485050288cf6", "comment": "Malware payload (Gafgyt)", "value": "18574c5c3c1fadd5c90f001a676a85c1a6958f7ecb786883d8b05788b3c6d9d225117f9e48b4990dc6934334140a1b96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316784, "uuid": "e046a21f-e0d3-4d4d-a153-fceaf2b340d8", "value": "T163833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316784, "uuid": "af3c1859-7364-40f7-9235-c6cee1795e1c", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCpdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JmBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316784, "uuid": "f5723e65-c588-4098-bea2-797f787b63e0", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316784, "uuid": "2beaf22b-c137-41bb-9462-8d6644bb4677", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316784, "uuid": "0276d408-c1f8-46fe-a8e3-4385548be51a", "value": "e26b1c7dd65e5e91b4063567ce208769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda26524-1b4f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632279091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632279091, "uuid": "fa0c11f4-050f-4c64-b12a-a1a6ff2f1ac1", "comment": "Malware payload", "value": "56d1c19b408ed2f64bc539f2bb9a99b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632279091, "uuid": "55f229e7-50d0-4a3a-a037-0314a955b777", "comment": "Malware payload", "value": "f677df9bc2b31e6ed8d5351f3ef8f56439eb2d822b63d6a03663e5f932c122db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632279091, "uuid": "fee29dd1-3b47-4e91-a54f-0221b2be8e90", "comment": "Malware payload", "value": "e88a50c062d59ed63e8f85462ec52ca16f7b96ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632279091, "uuid": "25d96f7c-5566-447a-9f36-70101964e0f3", "comment": "Malware payload", "value": "f284fa59cccd6e0cd31cec51f839688bae57bcba93aac9babcfb42a75922b753f0eae4d894a3c8ebfb89f12a4c7e4121", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632279091, "uuid": "e13853e4-98a9-4be1-beeb-78c3e76565b5", "value": "T1DE52C05FADD39FA9D4614AB4074A8A347CFF9794EF1C18E568A13588476E80F543C3C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632279091, "uuid": "3d1fdeb3-af69-4760-822d-d1d93e6304f0", "value": "384:0Fin4W7Cg+A7DfnflQuAcBsA1jaxZ0hh9EA:win4W+m7jnflBAu/1ja/0tEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632279091, "uuid": "0fbe89ad-b4a6-4fe8-a436-c4a2432118c7", "value": 14000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632279091, "uuid": "b0bc30bc-9129-4351-b5f0-dd98e8a93f6c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632279091, "uuid": "ab2c39d7-374d-4c69-ba58-ece5f0331fc6", "value": "SecuriteInfo.com.Trojan.GenericKD.37566797.9434.7718", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afb66d1-1b82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632300695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300695, "uuid": "cfde3c74-c731-4d13-82f6-227a7f6fdc93", "comment": "Malware payload (Formbook)", "value": "0707f2a5e8d186bb4d0a86c2472926bd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300695, "uuid": "93b2468d-17f6-49c6-879f-664f6275f4b9", "comment": "Malware payload (Formbook)", "value": "f69748c70114afefbe07186dee1ceba2355b43b8830fde58e4f4ba56b7536d29", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300695, "uuid": "b1d0fe5b-e7a9-4af9-a024-1a5db7a231db", "comment": "Malware payload (Formbook)", "value": "7a0a048221945e7e62972dfe31c1ae2e22fae8d3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632300695, "uuid": "65be05f0-49c0-4aab-a786-52cd3a02eb77", "comment": "Malware payload (Formbook)", "value": "05b5bd2e09ce9ba6d4cdc60c2653e8574d2efd721439f9b1a46fcd2b7a948639c7659b739e812212a0d3ed2fdc819435", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300695, "uuid": "57dd98ae-10c3-4c4d-bea8-283f5e146412", "value": "T1D3D301375B1C2F57F8959D7AD83B60F825782C6D262ED1AF09B7F2CB87F0A621104168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300695, "uuid": "888ab015-9470-46b4-9d57-a50c9a89202c", "value": "3072:EgHgidEfz3ZVFvVkKKkjh85SHQPOpMn5FaPz8qHoD+BUhI:EGgCwBVwkjh0SHQPOW5UL8qfBsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632300695, "uuid": "db7e1bdf-a4f4-41f8-93d5-b357bcbc8bb6", "value": 132600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632300695, "uuid": "d2ddefa2-bd21-42db-b422-11b138db51d5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632300695, "uuid": "c48fcea4-cbfa-4eec-afd2-2a0c0c8600ac", "value": "PDA BGX00001A.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6298fc-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316618, "uuid": "48d291f4-587e-4b54-8828-a5941e3d1d95", "comment": "Malware payload (Dridex)", "value": "e97fbd849a8914684091237c5830c3d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316618, "uuid": "648076dd-1486-429e-96cf-70a5838e8035", "comment": "Malware payload (Dridex)", "value": "f6b79b4c3fd50259cdd04b509998aa39f312fb7a40ba77077f94b6bc684ec93d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316618, "uuid": "cbb040e5-15a8-463b-a2ee-cf3def61b496", "comment": "Malware payload (Dridex)", "value": "4656e5b2bf3b7b9d6ee482adcc9195228ee6e569", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316618, "uuid": "771d39e7-3293-4fde-83da-515d60a57848", "comment": "Malware payload (Dridex)", "value": "ea7e6fa1801e816adca03d061d83be0bf65a3175be22f1a1f63639398a4913e23ae220887f726e7af950836857842a25", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316618, "uuid": "b2d03e84-371a-4230-b52d-9437b7860192", "value": "T151A5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316618, "uuid": "308f03d2-1a95-4f37-bc85-060d957fa645", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316618, "uuid": "c64aef7d-4bd0-48a4-9500-2befc2b63e9f", "value": "12288:jVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:yfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316618, "uuid": "4d3ef034-4369-41bb-8e25-f351384065c1", "value": 2117632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316618, "uuid": "405fdb8f-ba41-410c-8289-79e30d4d1f12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316618, "uuid": "6401a928-3a9f-4861-8f45-b69df9608d77", "value": "f6b79b4c3fd50259cdd04b509998aa39f312fb7a40ba77077f94b6bc684ec93d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5359cb1-1bf1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632348655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632348655, "uuid": "a54476c8-9a9a-4eb2-91cb-aa3e1dbc9f17", "comment": "Malware payload (ArkeiStealer)", "value": "0b7a9ee32bf128cf26a7032ed9918dd0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632348655, "uuid": "d9a34470-33e3-4131-b496-87f794d90831", "comment": "Malware payload (ArkeiStealer)", "value": "f72e3a0623b194f7cb8134f6c13f08a4eb048b98a7a2aa34ff1a193ec1041822", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632348655, "uuid": "56e526c8-740a-4095-881a-a32d6731e984", "comment": "Malware payload (ArkeiStealer)", "value": "f4b6005523ee8a2c809228857c85a36fdbb829dd", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632348655, "uuid": "bd55cd5f-057f-49b4-9bb4-be27fada0221", "comment": "Malware payload (ArkeiStealer)", "value": "91c76e2f92050dfc500d1acc23631a9453db7da288c07cc8f3f4edc4182585d8857531b27c0319f9903f1af2297f3f58", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632348655, "uuid": "9ef69570-9f84-43fa-a38c-345e594e1007", "value": "T18FF4F11077F0C434F6F712B958B992B8793A7AB16B64C2CFA2D51AEA57686C4CC30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632348655, "uuid": "435e8c20-364a-4458-aca0-ee6de3069865", "value": "f74a0f3da1e112835a6ac32552c0a4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632348655, "uuid": "077a8666-76e7-4173-ae86-9fe172657069", "value": "12288:CuiEwoEC8Gb4dlLoPGMWZXSK8Mapc5rrMOVSrZ0XKxDnO/1NAmdhifcw2Wdzz+R3:QoEkbG7ZXBPwcZYl0XKhOPftGdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632348655, "uuid": "d5502cdd-56db-43c0-8426-02fedfd1c99d", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632348655, "uuid": "bcd9ac97-608f-40d3-bdeb-b197eac394b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632348655, "uuid": "e9adfc15-9b20-4a1b-9a47-b6ff47afbbea", "value": "0b7a9ee32bf128cf26a7032ed9918dd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63928a9c-1be7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344116, "uuid": "518a0177-e76e-4b3a-b882-62bdd8945720", "comment": "Malware payload", "value": "9a19ef0fdc18b904bdddb645fa3f3989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344116, "uuid": "46fde937-dca9-4ee9-8377-bb77763f9d0a", "comment": "Malware payload", "value": "f76ff3506a59dd4c5f5544dc5461532288f287ebaba2b9c5915364c7b7019b24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344116, "uuid": "b1712597-a1c2-47ff-bb3a-ed3d9f517b88", "comment": "Malware payload", "value": "1e68fc7211c79971e2643bbb173ee51098fd5638", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344116, "uuid": "12cd1566-5b3f-47e0-923e-410b3a2274e3", "comment": "Malware payload", "value": "8e6c3283ff4999b38ce929406f6286d8ec065137c49e19e4ff2032c88982e30499593ce1b0e53e34e753d13b798f5ac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344116, "uuid": "cc80c5df-0e23-4886-b6e6-502844e9909e", "value": "T1A045B620831E9394CCDA64EE2166BE5A077FBB3BC34F9A411048A6DCF473E55ADB1721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344116, "uuid": "425ece3c-d3ce-4d23-83d6-3e633c51eb4d", "value": "db3315223cc70e109e5b585fadee7609", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344116, "uuid": "f4366a78-18ce-4164-8844-5562ea8b2c99", "value": "12288:UtCPvS+XozVDhiHPF6Ca3+AQm/QjvOUZwgNJldQlN2Nu20lf3cklor3DP2+ThVyJ:oqKDhZ+jTjvOUZcxPlf3cfTe+ThVG1z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344116, "uuid": "aa46b074-56c7-4763-baf8-4a494151498f", "value": 1191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344116, "uuid": "ea3c9c26-dc93-4eed-9bc6-6204345e4f2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344116, "uuid": "dcb3f219-5fd3-4ecc-9502-800d53cf83bf", "value": "\u9ad8\u989c\u503c\u6781\u54c1\u840c\u59b9neko\u9732\u8138\u7c97\u5927\u9e21\u5df4\u641e\u51fa\u5927\u91cf\u767d\u6d46\u7279\u5199\u955c\u5934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5204eb0-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632316792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316792, "uuid": "958cbbbe-2c29-4dde-baac-c82354ef90db", "comment": "Malware payload (ArkeiStealer)", "value": "8ba561ab97db798380c1994c18061c80", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316792, "uuid": "0acc7b0a-cd9f-4dc5-9dce-f0502e75b246", "comment": "Malware payload (ArkeiStealer)", "value": "f7f86f44bb6a5957b2bf9170c2de4650e0a9c974055a3769d4993d0ee644338d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316792, "uuid": "cd321298-7a93-4c9c-b700-38a60eb5d77b", "comment": "Malware payload (ArkeiStealer)", "value": "947641d2c211a7114ed0b13ddccf6a4745af2c9c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316792, "uuid": "f06d88bd-5daf-45f7-bede-b268f993d1d1", "comment": "Malware payload (ArkeiStealer)", "value": "8f59ae89857c8016d2c75f6daeb2a6caf1f0ab5b8cab9d3dca5eeb204bf47bc3d29cc686e5f100b253e2ed8b2e73b05c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316792, "uuid": "e1f94c9e-4bd9-4443-bd6d-e71d6293eee8", "value": "T15D05F130AE90C435E1B361F057B583F8A62D7EB19B3452CBA3E16ADE66346E59C30743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316792, "uuid": "81749b43-eb8c-44d9-954d-91e78e06a625", "value": "1e2b710f415a093c1bd3178e445c86b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316792, "uuid": "1c43702f-417a-4303-9433-92927ef6bd5a", "value": "12288:hoIEqX6xCU00TIyUNynw1tFH6RxwDCFcMDPhrlGX/d1AZJ0/nh9nwHHEtp/bD3:hHELxCU0mnwT18KMBGXVkCpqEtp/b7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316792, "uuid": "610c6e41-0ce9-423d-8d35-5e48fbdbf75c", "value": 816192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316792, "uuid": "61d1b501-9fdc-465a-9c8f-f0c00f66feb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316792, "uuid": "e37659ff-650d-421c-bfa0-8a8af8c431db", "value": "f7f86f44bb6a5957b2bf9170c2de4650e0a9c974055a3769d4993d0ee644338d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e438353-1bae-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632319733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319733, "uuid": "42123263-8077-44dd-bb98-8edb26ceab86", "comment": "Malware payload (SnakeKeylogger)", "value": "ad311f9d64482f7f295c799036351aa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319733, "uuid": "c587ebe6-9822-433b-8ce9-4735ead24dee", "comment": "Malware payload (SnakeKeylogger)", "value": "f8401cd51a7275dd613c21982123c2d74f991e06d5f3dfb0d04228a70e959433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319733, "uuid": "435117dc-4b57-427a-a02e-34033601121f", "comment": "Malware payload (SnakeKeylogger)", "value": "7cf9a733efe16a6b7906b4984c82d4446ddf18e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319733, "uuid": "8f1ba00d-fb90-47d5-aff8-1d8183115098", "comment": "Malware payload (SnakeKeylogger)", "value": "986b217d44daaf7e2fe394671a2d9e5acc32dcf3b0f774be1d0a24a21dea20e206c23215632d181d256c2d97bd42bb61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319733, "uuid": "336cf179-25df-4ea9-81ec-8feb9215edbd", "value": "T175E479C85D894603D7A44672DC1D6246366D2C4A3723938BDBE13DB73EFE283C22D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319733, "uuid": "cebd64b4-7271-4a27-bb77-6cf969361c5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319733, "uuid": "ed31c571-a3af-463f-9e74-1115f371cf0c", "value": "12288:oemtiK5ozQsDWCZOE9tuELcSmOeJcKZu8klpvjK15Xk:r+FozzKiRt2S8Pkje9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632319733, "uuid": "6376d709-e095-43ee-8a87-448dcf0bfdab", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632319733, "uuid": "0bb02969-dc73-4d01-8e9b-8b7af69f2dea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319733, "uuid": "24a7069e-08f9-47b5-87c5-cca97fbfdc4a", "value": "ABONOF2201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6f485f-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632316863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316863, "uuid": "e188a1bb-a3b9-487e-9ea5-f5444415cbad", "comment": "Malware payload (Stop)", "value": "5e6416952139a16d85f106a32ce9b89a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316863, "uuid": "dbfa5108-bb5a-45e8-a060-f479d7ec906c", "comment": "Malware payload (Stop)", "value": "f8ad6344537c95c3421926b12bfe0de0931676b94c9f624744249343d84bf4de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316863, "uuid": "56c6150e-d7f9-4c8f-bf18-833f51ca32c4", "comment": "Malware payload (Stop)", "value": "aa73fafc5a2af3cc4885e38647107084498e1dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316863, "uuid": "b0ca7fab-597c-4784-8ef8-6b320e7dd77c", "comment": "Malware payload (Stop)", "value": "6dd0cd14a25aeb7ed6f855b8b1524215d0c3f3293582e08c5759053e2c62b776adb9633ea4c403a99f9ec0904f31e752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316863, "uuid": "956cbd79-d98e-4d2f-8f45-0f8f809fbb6c", "value": "T1EEF4120075508EB2E62B61315720E2B4DB2A7E6695B08BCF1317373EAF302917E7775A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316863, "uuid": "01274572-1fbf-4d01-ab26-206be56a91fb", "value": "b4a5f131bf57e0871ab3cda52113b279", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316863, "uuid": "beb75695-dc8f-43d5-a6a1-e761034743cf", "value": "12288:MZLKecTHkq4Ynm/FSaUQmg0yhwvSePUy1B2FSfRIX0k5XACdBai:MZLK9EzYm/H+gePU4z5IX9Qch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316863, "uuid": "f4c04002-d679-49b0-966d-c49fb080000c", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316863, "uuid": "caa648ed-b021-4032-bdff-4c438c86c311", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316863, "uuid": "e30e9a5d-c154-4755-b6eb-fc8c55bc1b7e", "value": "f8ad6344537c95c3421926b12bfe0de0931676b94c9f624744249343d84bf4de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2b2d62-1b6b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632291037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291037, "uuid": "e4f63e16-43ec-4f93-a6a5-de250299abe7", "comment": "Malware payload (RaccoonStealer)", "value": "863a8a21eb99b20d4220540da5bc05c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291037, "uuid": "9b5b116a-68e8-4200-a00a-e5d6b71bca6b", "comment": "Malware payload (RaccoonStealer)", "value": "f97dba49c60aecda455799132bacbfbca94c45e2eee2e9b01c11a485e53a4845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291037, "uuid": "90f1fa0a-437e-4565-991d-5d2d141d06e3", "comment": "Malware payload (RaccoonStealer)", "value": "8c6b6b2922f8e5855b209a89caa85fa5e7141e36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632291037, "uuid": "19758857-dc58-495d-a32c-b8d78453f21e", "comment": "Malware payload (RaccoonStealer)", "value": "0ef6c86715cae9a237a7842206002a4b60e898a62ef529be07d59729eab24debfc0d46818fb0195456d97cc0d1f0257a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291037, "uuid": "5b49d5e0-5b5d-4e5d-b7b1-721bff227322", "value": "T160C4E0307AE0C034F1F702F889BAA368B93D79B16B7451CB66D11AEA56346E49C31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291037, "uuid": "7c43eea2-c5da-4df6-bead-70dfa617a111", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291037, "uuid": "867f48af-0d8b-44a8-bd05-e4acd21b5f9d", "value": "12288:K3lp31Ii5vdLGpUGAO8oJCsuILunn7fFDSVCD9X7D7rJrs1+:q1Ii5jlocsu8cnDgVK9LD7ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632291037, "uuid": "9707729d-8940-4027-bfe6-e0c398741cc3", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632291037, "uuid": "3cb63666-ca76-44cc-86dd-e945a2a5656b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632291037, "uuid": "e08fc59c-1ba8-4bf0-b528-3e92651c25bc", "value": "863a8a21eb99b20d4220540da5bc05c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79440ab-1bb3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632322030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322030, "uuid": "fea15d95-7cc4-4e78-93cd-fd86a0ab4d4c", "comment": "Malware payload (AgentTesla)", "value": "04b038bcd154d89ee1e7758d734c0766", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322030, "uuid": "6534a313-2763-431c-87b4-0c0e55dfeabf", "comment": "Malware payload (AgentTesla)", "value": "f98725c30be4a2a4ed46717b9da9b888b38d5ec1c686d1285eb1852c99817275", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322030, "uuid": "8a389ea8-1f5b-4eb2-9127-ae6f10b1cbfe", "comment": "Malware payload (AgentTesla)", "value": "ff01ac0cda7f103f9c117cc41cb6827988a1f527", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322030, "uuid": "e2a4eaad-77d9-48e9-b6fd-d7e34bb2d30b", "comment": "Malware payload (AgentTesla)", "value": "1a9eb4be5293078f4ea90b2a6653f8c8b3c9308d8ebcaf4be54ea85e80beb340f07c39d4f150eeac6ab268abfddc0ecb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322030, "uuid": "9da370a5-dc92-4e8f-9c50-cf614091e19e", "value": "T19EC42274E6644639DA59CBFE50F086050BF0A28E7E17EAABDFC3B089FD1776140158B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322030, "uuid": "dc7c7bd5-e1c1-45a3-b126-b3b70b4fb4b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322030, "uuid": "bfc34cbf-26bc-4854-b775-599c56bf5638", "value": "12288:fYNAermtiK5oBfGW+p/vGOVSsGvwHsNV0Keaf6W8nWP2AU3/:nk+FoBf4G4XccWPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632322030, "uuid": "0cd5a31e-4d3a-4857-96fd-d2adca9d9e2a", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632322030, "uuid": "48cf40d6-9c9e-4670-8d9e-be6329f5b74a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322030, "uuid": "9def8a73-4f9b-4496-be7e-ff3552b57bb3", "value": "04b038bcd154d89ee1e7758d734c0766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050fe768-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632316899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316899, "uuid": "341ccccc-2add-4be3-af18-70576d0f0972", "comment": "Malware payload", "value": "b04c8ddc579d0b911cf743659b71c523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316899, "uuid": "768b29c7-2aef-4593-99a3-85f7598267e4", "comment": "Malware payload", "value": "f9a46fcfaed2269ac9851ebeeab0940535058ec9d0b78a51e121188011d78dfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316899, "uuid": "bee06841-54ea-46ef-845c-6c46937f1d8f", "comment": "Malware payload", "value": "6e1fa06785d05b35364ae8ab118f4f153f210b97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316899, "uuid": "1dc627f2-864c-4817-ab66-06ac2cc162b3", "comment": "Malware payload", "value": "fbc04a53a196048e871c9830ca5c86e91b17b676e949860b6cdcce1bf14596c784ee1d90ec3fef7e73665c8e698881db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316899, "uuid": "3f1d3d5a-0fe9-42b8-be2a-0c2ef93a754d", "value": "T1CDE474A7889BB5D3F814B47192F3F5A108B2D97A386344D1B80D2D7F0D92983175BB3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316899, "uuid": "296ec301-7ed0-467a-9391-d717a71b6eac", "value": "514c554c4eccf8b5d18d8453867113c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316899, "uuid": "d8cf585a-e2fd-4e47-8080-eb1cafcdd1d1", "value": "3072:cJ5EFKOO6OzSmxs8VHgXPc8XASOg17MTvuout0y66LxAxn:PFKiOzC8VEXAouuoSdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316899, "uuid": "886571c9-b20f-4999-8ef2-43f063d88d44", "value": 676263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316899, "uuid": "25b5d3e3-d494-4e58-a856-41bec58c89fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316899, "uuid": "00f3c25c-6714-4f5e-80d9-a8fdd2be0d12", "value": "f9a46fcfaed2269ac9851ebeeab0940535058ec9d0b78a51e121188011d78dfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715fc706-1ba6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632316222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316222, "uuid": "6175c9f3-2d24-4ab9-ae94-29500b199f26", "comment": "Malware payload (Gafgyt)", "value": "9e742569bc99ce698013e17f4f94319c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316222, "uuid": "96c6a8e6-6c92-4a39-8cc2-391b34c1d8a4", "comment": "Malware payload (Gafgyt)", "value": "fa04549bba3d9dde4c47997defd6758f8ccb4afe7a2875e9e206c6aeaee1a8a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316222, "uuid": "cff6a69f-07b7-4263-a42e-2191e77479e0", "comment": "Malware payload (Gafgyt)", "value": "844dee62775a8d840b36b30b585994dcabcf7f10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316222, "uuid": "e96a3f9a-1666-4a55-b91a-020d310a1bea", "comment": "Malware payload (Gafgyt)", "value": "a8d3c449797c13a285f7d5accd0d0f0e356c38a2ed5c67e3b43946c3bec93d11eec9c7b6fe2b8f3cf263b53289c1f03a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316222, "uuid": "20814b0f-f846-41fa-a0da-4ed0da1b9ca9", "value": "T172B3942A7E22EFFFE56886310BF35F708795229227919386F26CD6181F6128D1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316222, "uuid": "06701b57-5aaa-499e-aaa7-fb863a6696a3", "value": "1536:a7ju1Tmpq+XvY52rKdXesxek49Med8VX6RT/oYNEvUmkiSFxfC7xbXe:tE8hxek49eZ6loYNEvUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316222, "uuid": "6873ea37-b009-45d0-abde-1b9820a18e9a", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316222, "uuid": "28d47e27-4f63-43d1-8b83-285eb6d4a035", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316222, "uuid": "7742db88-401c-4725-aefc-8134c831fa91", "value": "9e742569bc99ce698013e17f4f94319c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079e5929-1b55-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632281255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632281255, "uuid": "80f9624e-d573-45a0-9e93-6d16d7bc4a92", "comment": "Malware payload (AgentTesla)", "value": "c9767e606f1625826fd6f612284bf62a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632281255, "uuid": "00102523-1058-4b39-be9f-f7ec84d465f2", "comment": "Malware payload (AgentTesla)", "value": "fa88b1167480e75e92229ac8be14090eb7bcd0c0e675343c9a0c27e15b58d3de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632281255, "uuid": "42ae7c2e-222c-4e6b-9052-1ff4dd05cf1e", "comment": "Malware payload (AgentTesla)", "value": "71d585a3b03037ccd4a35610fb84ec95a020ddb5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632281255, "uuid": "9e16c611-71e8-4461-ac08-909a63cb40aa", "comment": "Malware payload (AgentTesla)", "value": "f09c210cd537afbb623120a114062fd377640c4399e612f98369248eae8cd63f2b569617fdad61cbcb70206df3916027", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632281255, "uuid": "a5f8059e-8d87-4749-8642-6f38055e0f25", "value": "T1AD0516394D2682F747EEC66CD08C1FCEDEA6A4837B919F1AC496D7D2025B70BE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632281255, "uuid": "fd62102e-457c-498b-bffe-75512bdadb8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632281255, "uuid": "15b67168-f758-4a03-acbe-9ade0d32e631", "value": "12288:+7oHi+Qdf9ld1SG45z2Q6jC86402qQpJoSr:ri++ffSx5zV6jCE7Xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632281255, "uuid": "0ef0dd36-3864-46d4-b146-bfdfab8eee9d", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632281255, "uuid": "f3185b01-11a0-4b51-a876-2ba37a87a12a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632281255, "uuid": "cf773b6c-347d-45e2-9188-7a1d1c8722fc", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6ca259-1b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632289506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289506, "uuid": "cdbeff78-2c4e-4147-a223-acc5bdf83fe1", "comment": "Malware payload (SnakeKeylogger)", "value": "3da3ccb28050e4df36b319775cbe283e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289506, "uuid": "e76dec9c-80d1-4ca7-89a4-35fa5a0cf769", "comment": "Malware payload (SnakeKeylogger)", "value": "fb2fd5d1cd31c753b74ea5d3b372cf96e6e4f9c520c31dd2d14ef17bdf965d3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289506, "uuid": "e4a6368d-1bb3-433f-94d8-3b4d7cd45c5c", "comment": "Malware payload (SnakeKeylogger)", "value": "a459ce98c8dcb44f82ea1d7119900e007d00995e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632289506, "uuid": "b4900972-ee30-419e-9fab-0b29ec5b00be", "comment": "Malware payload (SnakeKeylogger)", "value": "4e49cb14ff380a236e22d4da488128bfca780f8c9d6b37c1ea5d66c39d562a6cd3ae4c5771be8be16e8522a19e4d58db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289506, "uuid": "0b6a4942-beca-4833-8dae-c352c4a9d442", "value": "T1E6B423D693539D73C5A5A7B002B3B7F9FBBDC3D2001494974FE09E386993A839905782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289506, "uuid": "63ba97fe-9e1f-4cee-806a-41efa2c76b4d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289506, "uuid": "6b49a7b2-4edc-477a-8235-d391dd0ebdd8", "value": "12288:lBSD0ty7vGYaj4Zs2ctfllgiJglkjuGxRwddb20MXzF5uwn3J:nSDd8gs2ggsgS/x6boJ5NJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632289506, "uuid": "31e25b3b-acf3-4d44-8698-b175ae5a1a93", "value": 529716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632289506, "uuid": "f050798c-09fb-4443-b3d5-7205a986fd94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632289506, "uuid": "453d73b3-0354-4a0e-bd7e-e54546a81786", "value": "3da3ccb28050e4df36b319775cbe283e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3f426f-1bae-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632319891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319891, "uuid": "2fc1ffbe-bfb9-4b24-895c-f4586d843107", "comment": "Malware payload (AgentTesla)", "value": "66293df9536b793ac461d92d678ae830", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319891, "uuid": "8b68d345-9361-4a32-9ec2-7355fb658598", "comment": "Malware payload (AgentTesla)", "value": "fb544a3b7a3f9bdf2b36abf7d2e8700ed832ce6857718124fed2e06605760219", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319891, "uuid": "8d40628c-2257-4721-8438-3e53b7b0e48c", "comment": "Malware payload (AgentTesla)", "value": "f87ea4b85e249776feca26fa1f1bdd322ae758f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632319891, "uuid": "f1d74c40-7cef-4425-9163-02d5f821041a", "comment": "Malware payload (AgentTesla)", "value": "f23b43aef68347d963182c49c2fbd2ffc01c6725166c504308df81f4dacf433b211f45a488299246b006259984b3994c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319891, "uuid": "e18054b8-6de9-4468-b1e6-1ca15b80f973", "value": "T1F0C41279D639E736CAAC97BE917100424FB0B28A7753FB1D6F9270CE7D06B404826879", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319891, "uuid": "38f847b2-0576-4403-98bb-5733a6f8c3fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319891, "uuid": "f7e8fd1b-3941-4487-9d80-aa89d9c4aa12", "value": "12288:DQl/mtiK5oBWO7rnukND6PJi7ueGzki+ulxiHFX6YGe0HFQ:y+FoBbjpYARGzki+uviXPyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632319891, "uuid": "12ee960a-b856-4bff-a9b5-2eb525b769f1", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632319891, "uuid": "dbfc480a-8e58-4a6e-9b52-0a02ca44821a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632319891, "uuid": "dc8ef6f6-df1e-40b9-92d5-3c8141cbc95c", "value": "INVOICE AWB 9782166...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae92d66a-1b93-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1632308164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632308164, "uuid": "9c66bf8d-da53-4fd2-bfd9-e6de44c9241b", "comment": "Malware payload (NetWire)", "value": "f29892ad06b79676decbacde55c4ce95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632308164, "uuid": "c2f5b8cf-42c7-4495-8b70-8396c469fe29", "comment": "Malware payload (NetWire)", "value": "fb55f300cbcea6d62e33eb76a196849d1a67ce91c46255d2180fcd6a2cdc43f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632308164, "uuid": "d82bb727-780a-41c8-b01c-c824326e16e7", "comment": "Malware payload (NetWire)", "value": "c755223473337ed4a21f4c11279e9762e2e76474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632308164, "uuid": "f9bd0ad6-f1cb-4f83-ba26-061d55f92615", "comment": "Malware payload (NetWire)", "value": "20df408013cb51bf93cbe61b2ae15b5a626ed7109b08549e2b583185b7d1bb3d80b484f0520f85c1bb42689a616d8b65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632308164, "uuid": "84b18086-75fe-4f17-b3c9-65ffcfd3c6b0", "value": "T13C254BDB7384E8EAFD24343ECA85B6556340BBF23D825C8C8D757E8A5AA4741F90D483", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632308164, "uuid": "88aca910-9071-4067-bf14-81454db4a165", "value": "91a12f22e7f2305a107edddf42c40880", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632308164, "uuid": "087e5a21-1858-4e90-b6cd-f1a504d636f3", "value": "12288:MYeqaTWvI8UhU0EIp3Cx4DtbeoAdrL7mSI:MYpa+qUH2y44rPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632308164, "uuid": "ac6b268f-2660-4ea3-abd9-545c066e1f31", "value": 1008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632308164, "uuid": "5f81263f-bc11-4e11-803d-50b9b4ab0360", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632308164, "uuid": "1ed4d2d1-2c8b-4c3d-ae5e-f3416b23460a", "value": "Ycuvnfrbtjzvmlyxaoewxrhiwgmfxkiudt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2096497d-1ba8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632316945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316945, "uuid": "c0418294-c749-455f-b4b9-f2ad6bcf044a", "comment": "Malware payload (AveMariaRAT)", "value": "4f6378a52cd2538a687f887bbf94ac3b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316945, "uuid": "0438bb6d-a0e1-4ef8-a7b7-a07f8e30a74e", "comment": "Malware payload (AveMariaRAT)", "value": "fb8a45429132e54b0476b2ccff05cd4fef2913dbfe6536902e4011e1b906c7f0", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316945, "uuid": "e5f379a9-61df-4b2d-859c-03f197763e78", "comment": "Malware payload (AveMariaRAT)", "value": "7f4fa799798c47e75a0cbb81d18fe2f9dc02c881", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316945, "uuid": "c2e67153-9d8e-4e56-bcc7-35aef5d1ade7", "comment": "Malware payload (AveMariaRAT)", "value": "3252d1644c62672925d4faabc0f45861a66490c1eaecbdd89846443a454cd94a724d689f79ce149432c961135488efab", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316945, "uuid": "fb5411fa-3ecc-4c43-99f1-bafcdb04e2b0", "value": "T1AFC4D7F9D7E257D3F8366B39C691023415B23EC9A1E5DDB16DC8B22C09711CE921BA2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316945, "uuid": "41ac1072-867b-41d8-93c3-6324839c2511", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316945, "uuid": "f0dece49-0a83-4851-810a-cbb4d0b63052", "value": "6144:wRpt3b9JieaB7jiR7YBEpXnvUVZMnCTQdP:qp9hQihOYvUVZzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316945, "uuid": "d5536a65-e0c9-4031-92e6-22b449fba7d4", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316945, "uuid": "cef32816-2d52-41a7-9c5a-56298f1b7b80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316945, "uuid": "4cd6775c-5961-4aea-b0a5-6c9220c21319", "value": "fb8a45429132e54b0476b2ccff05cd4fef2913dbfe6536902e4011e1b906c7f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff150d4-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632316890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316890, "uuid": "887dc129-c60b-49f3-ad0d-bb039acf42ed", "comment": "Malware payload (AsyncRAT)", "value": "4d5f50841ae2d1f19a30b2e345844c21", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316890, "uuid": "39be5ee7-f349-4f82-8170-c4e095ff60f9", "comment": "Malware payload (AsyncRAT)", "value": "fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316890, "uuid": "6fc0aece-1449-4f4a-b076-8e48959f66b4", "comment": "Malware payload (AsyncRAT)", "value": "17b5d2875f7e5ae18b192e0f99c26f8145f985ee", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316890, "uuid": "aae29e4c-9396-4746-9cc1-9f56a6c474de", "comment": "Malware payload (AsyncRAT)", "value": "7c7d70afaa7251a4625e1bc64659856243f391fa62ceb9d38943f1c66a260e2aead783da5eb2746d3fbc61964060e923", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316890, "uuid": "4f9f85d3-4b69-42b8-92e5-814208fbfa48", "value": "T11DE4BB8DBA881363EC7DDCB4A9040D1CBB553AD73780F567978A21E7A35F0523A83B64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316890, "uuid": "9cf1aec9-d805-4ae1-b312-843e0c9a6ebf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316890, "uuid": "b0ea8ed3-39dd-4766-b80b-fc976f720412", "value": "6144:8w8aW0/VaWlqilSM5rMHRt1bm8bunA6Zd9gGkPMtkbzshvAh1pyHaE1:Be0/wi4IrEvn6Zd9gNbzsqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316890, "uuid": "eb4f8a1c-7d97-492f-92f0-c736257ebe0c", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316890, "uuid": "36991e5b-ec99-43db-83fc-7e1ae2905fc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316890, "uuid": "58adfade-64b1-4a31-a57a-01b634383af1", "value": "fcd5fc495b4f81bf91491b52e1759cf93794bf135fed6469a5d1e0663dfb6c3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa73cc1a-1bb3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632322035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322035, "uuid": "4d005c0c-9f15-468e-b30f-7ef97c5f2e60", "comment": "Malware payload (Formbook)", "value": "e6d8645bd64a8fec8d36edfa3dccd6bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322035, "uuid": "3bc7c022-8db1-43d6-8fb6-ecac34150252", "comment": "Malware payload (Formbook)", "value": "fcd82e581d68847a1f240bcf0123de948a8bde781a05fbbb805d0033bf91ff43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322035, "uuid": "2778a05f-6507-45ce-85ba-532ece4f7f11", "comment": "Malware payload (Formbook)", "value": "c331f86d6b1f32e9d2ed3fd2a47f768763455dc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632322035, "uuid": "0f737188-ee2d-439d-a473-160812501f80", "comment": "Malware payload (Formbook)", "value": "9fb2d946fe8d1fa84e9c0aeac8f0bf0c0254cbf8cf5e4b907aa91158f6e7bfd4ac04faa191e2324681c1eb181add8799", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322035, "uuid": "b33b7f11-2788-4978-bde1-80101c675f68", "value": "T1C1F49BC85D884603D7945272DC6C664632692C1A3723938BCBE17DB73FFE683C22D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322035, "uuid": "060c34a2-4c79-4763-82b6-37670dd38f04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322035, "uuid": "f871082a-e1be-4825-b169-c8c764475be9", "value": "12288:zImtiK5oTH2mBI2KvnKQJvb7uGJp62yL4OArheeDdk:s+FouXfKQJvDZyBArN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632322035, "uuid": "6de35e40-2a29-4cdf-8de6-9216b7a48f10", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632322035, "uuid": "bb54b859-7c47-4d63-b90c-7adad9d4a7f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632322035, "uuid": "1eff8851-4487-4288-b161-c7739ce9169c", "value": "e6d8645bd64a8fec8d36edfa3dccd6bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7be062-1be7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632344243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344243, "uuid": "518f992a-9bb7-4290-9ab5-90a0d5ad44ae", "comment": "Malware payload", "value": "ff64906b11528c53152738a2bd6c9caf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344243, "uuid": "af47ddb0-0929-4404-9039-fad7c5ce595c", "comment": "Malware payload", "value": "fcf27e26346dcf0dc51de742d85f75ca0e56d89cba70932b90dd4d11311e38b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344243, "uuid": "d2f4f2e0-0a5b-4e43-8128-804bedc1402f", "comment": "Malware payload", "value": "fe4abda528c86c99d3216d4bc0148e59ab579dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632344243, "uuid": "a6f53c6f-2d2a-44b3-a837-ab2697b882c5", "comment": "Malware payload", "value": "7bd2ba7a8f43fb31225775a9730571f22a5753bad711dbb7a5897cef29ef369d81b0066cc1dc5a41580bef85cedef7a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344243, "uuid": "096b31f9-e4c2-4223-938d-34c426377d14", "value": "T15FA5A611F98EA9C8D2DF50704E0CD3BA5B7DF37556A80DE97162FC48B7A53C2E422682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344243, "uuid": "e48e8a56-6169-48d2-93df-7877f15b5e37", "value": "e2afc946bb1a7942e18b4d1a8f444ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344243, "uuid": "3a897bec-3c66-4dba-b220-5737a155e99f", "value": "24576:ufnAFlGkImrRhbXz0Jsz/4wBopV8/+YiwW:ynIAkI0zx16V8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632344243, "uuid": "d3b2d5ef-88b1-45bc-b1cc-7ee8abe2a3ee", "value": 2244608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632344243, "uuid": "b2f6ca33-c8dc-4508-b10f-265118089851", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632344243, "uuid": "caac1adf-aceb-432a-a1d6-94318ad08155", "value": "\u9707\u60ca\uff0120\u5c81\u7f8e\u5973\u5728\u201c\u67ec\u57d4\u5be8\u201d\u88ab2\u540d\u63a8\u5e7f\u7537\u8f6e\u5978\u5206\u5c38\u89c6\u9891.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f684f157-1b9c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632312150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312150, "uuid": "f44fcfdd-b4c8-4386-a451-aa873a8d4f87", "comment": "Malware payload (Loki)", "value": "9936cd4c679f2f4a38902c3ea2c7846c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312150, "uuid": "aed51198-cbac-4525-9726-93b99b44643e", "comment": "Malware payload (Loki)", "value": "fd23e7e0dd4b66d2111076fa6621b96db897bbcbf535207eb70bdfd2ce14304d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312150, "uuid": "afc00a3f-c5e6-4fc4-b0f8-8e75c0408884", "comment": "Malware payload (Loki)", "value": "2eef0bbccbbf1c9119a298dac8755d56f515f025", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632312150, "uuid": "73117a33-a9b1-470b-b1eb-27ef0d5e3600", "comment": "Malware payload (Loki)", "value": "291a6226da440753d17594b839d0212eb94ecaefc87f644c7c1b27b27068829f5e11e9b4d0e69270698fed7d0346d36b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312150, "uuid": "ddcee5f1-cbb8-4240-9254-ccdcc86444c4", "value": "T159D3016F65B38940ECB617BCED62A5436A6D6EC60FF20D016FD2739F577C6C22881280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312150, "uuid": "1044735f-0e13-4f74-a1a7-b219f516bb62", "value": "3072:LoKCyg0SDBKO6/1lV+jw9FRoy5tT9QmOwB26qZjF:LoHyuBK9dlV+jCRoy5tT9QdwB26qZjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632312150, "uuid": "2cbaa8b4-80e2-404c-887d-4e5d17e5af0b", "value": 132424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632312150, "uuid": "825925de-f3ae-4001-bbd3-540425238b63", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632312150, "uuid": "87f163a6-c593-4a42-8a3e-bc366241ad34", "value": "Srv#8871832.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa268e59-1bd0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1632334356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334356, "uuid": "8107c99a-ce0a-4dff-adf0-93051abc9550", "comment": "Malware payload (TrickBot)", "value": "0ceac8c2172cc3bd0b6d28b40deee16d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334356, "uuid": "79994d7e-e33f-4d09-bf36-a768fa91ad14", "comment": "Malware payload (TrickBot)", "value": "fd26c012af2d0325a5eb2397fa3b6b36b8480dc99a6f7b81b8a6423b029ca03b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334356, "uuid": "5d075c65-e852-4284-ab68-5702e7a8796e", "comment": "Malware payload (TrickBot)", "value": "654c6fe607e475fda57863c3cd87d70aa067dc8a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632334356, "uuid": "21bc55ba-cbb8-41ed-9787-9ea49a638591", "comment": "Malware payload (TrickBot)", "value": "0de2eead98c0e099306e83bf3ab57d98555c539bf3f4fbd7b9575b848bb5e280896b3536c3b7888dcf57616e4e90dfa9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334356, "uuid": "5b71e7b8-54f4-4bea-80a1-dd82ee4416d9", "value": "T168B4CF42B2C0C076E27F537149775B5A26AEFD248BF1A94BB744BE3D0F35291852EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334356, "uuid": "0c345254-ff3d-411f-a85e-7a5a8aa0e46a", "value": "5c9a9773c96ef9c47915be337e1489a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334356, "uuid": "4abe7f2d-f39f-4a37-b746-b40b4b82f15d", "value": "6144:tIl3f5on8R0CBtsabvb90iRugpw8mI3R5y4MAIJ+CczfBsx2X/HSpu9SiWaKMVe1:tk32q0CB59wq6cBsxsPUmYa1B3js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632334356, "uuid": "90929613-2f88-4dc0-94b6-1ead23418e4b", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632334356, "uuid": "4c7a6cea-17de-44c7-97f8-3b08055bba0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632334356, "uuid": "c0735bae-7a49-4e4a-ac69-2630726add3e", "value": "0ceac8c2172cc3bd0b6d28b40deee16d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a2e2d7-1ba7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632316628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316628, "uuid": "d1631259-d0fa-42f4-a5be-7cba135de006", "comment": "Malware payload (Dridex)", "value": "fef3e27764b2b781f80a256db0770532", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316628, "uuid": "296f1239-82e9-4aa6-8333-384a3229d06c", "comment": "Malware payload (Dridex)", "value": "fd99c72ff2f85f1e708e0b6931482b0201c088c0f5a0cf4d26f6c163e82082da", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316628, "uuid": "e7319a04-dddf-45f5-8473-e561517779e4", "comment": "Malware payload (Dridex)", "value": "0c655af972b2456da4db3b1b8b4e7b5e0c8d5f53", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632316628, "uuid": "ab68f008-9cc2-4779-8ec8-135036ca1915", "comment": "Malware payload (Dridex)", "value": "f4270e03f8309bd64eaf6b19abc294263617684ddd7dbc8725959a3d80e923cba09f43b1e7ac3cea74b0c32239845729", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316628, "uuid": "53f4a34a-6b62-41f9-bfb7-9ce5990817c8", "value": "T11695D020EE69E1E6C6B89F3E9408352727F93D75110D608CC396704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316628, "uuid": "79d0b0a5-5ee0-47ff-8f63-f85dc54a1ff6", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316628, "uuid": "98a81bc0-aacd-449e-a2ef-32c4f8cf0796", "value": "12288:DVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:SfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632316628, "uuid": "3faefd32-b525-4082-a1b9-dd3b47e81c5d", "value": 1916928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632316628, "uuid": "a1cdb1e4-bca8-40e7-8d10-4193db577113", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632316628, "uuid": "18b034db-023e-4c7a-86ea-82e8563a94ff", "value": "fd99c72ff2f85f1e708e0b6931482b0201c088c0f5a0cf4d26f6c163e82082da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc1970b-1ba9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632317474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317474, "uuid": "8f6aff26-66cd-4eab-8e92-c0631f01baec", "comment": "Malware payload (njrat)", "value": "e741074fedb4ec508e304ecb834d78aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317474, "uuid": "d2e52a2b-7599-40a2-8dc5-965565561ed8", "comment": "Malware payload (njrat)", "value": "fdd90c147010114bf0d334c72cfba5a164c26b1f8fdd1e04271901f1152765dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317474, "uuid": "1575bb3a-aa21-4414-91a7-f6af7948e2b1", "comment": "Malware payload (njrat)", "value": "2189c0ffa7ba0d2c64dd9dea2b00b967f4de2d93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632317474, "uuid": "967524ef-e9c2-4ea7-8f4f-6dd926630fd6", "comment": "Malware payload (njrat)", "value": "207727ef65704cfe3760e5982f1cf9b9bac9a11227149fe453ae6c81fdc415149d4f504cd812270922e5ee9ed9f8992c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317474, "uuid": "6592f782-1136-4021-802e-82773ff9ba05", "value": "T13B033A4D7FE18568C4FD067706B2D41207BAE04B6E23D90E8EF664AA37736C18B54AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317474, "uuid": "b1bfe344-bd13-4aea-ae8d-fbbbda75d55e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317474, "uuid": "28834bcf-57a4-46bd-a067-b726f44ce56c", "value": "384:K3UM1pCiMt3jBVbJsy8P3qbAoJXhvFQKaPQrAF+rMRTyN/0L+EcoinblneHQM3e+:VnbJP8P3yAG/da4rM+rMRa8NuyVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632317474, "uuid": "ab76b3af-93ad-4e2f-a742-2b74c567fed1", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632317474, "uuid": "1ad27898-b64e-4f84-a184-e755593feec6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632317474, "uuid": "9ca0cc66-ab44-4927-9454-915f9b776372", "value": "e741074fedb4ec508e304ecb834d78aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced3976d-1b7c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632298340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298340, "uuid": "16bc5c12-1c6d-4990-9207-d10e4895b988", "comment": "Malware payload (AgentTesla)", "value": "0470d6bbf638f3dda13d42fc205f24ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298340, "uuid": "2876cd0b-52fe-4c12-a9cf-3ae3c99cadda", "comment": "Malware payload (AgentTesla)", "value": "fec23e560f152140cf69f5988a899439e46b94024ff87aea078f12f66bdb1afb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298340, "uuid": "fef1045d-347c-454a-832b-9da51a2fb06a", "comment": "Malware payload (AgentTesla)", "value": "58ead0b87e15f845f01dda52117110a630e2db9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632298340, "uuid": "d3ca3613-f3c2-4e2b-be54-ce559a472fbb", "comment": "Malware payload (AgentTesla)", "value": "719bfd67db22afae5a73fc1f79e3331fe550f98425a579db5cbcba07395a1f7e64b4b58f37f67113491a39bb4f887af3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298340, "uuid": "54866ce0-5238-43ae-be94-4b3f86c704bc", "value": "T13C2419166714D560CB5F417FC016820831F1DB07A72AD39F5AA6D8FA2F812CEF92B9E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298340, "uuid": "bbb68c9d-1568-4497-9b1c-7c285989beeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298340, "uuid": "a601fab4-f6c9-4af1-b22f-552056cf0b9b", "value": "3072:xGWRmD1L7e1B0n8Vv3BUsd0iLwU+3koUVk6yuPlUKnzHSm2N2VmYL0NUgDQU64W:x71B0+RUmLL+0gQPlLn0Z9UU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632298340, "uuid": "5e52a50d-3a7a-4f8e-9719-ddcd2f83b81d", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632298340, "uuid": "2b52b6e9-0782-4e82-8dcd-7341790a83fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632298340, "uuid": "d216ae82-d031-4158-8c1d-0cb506999891", "value": "0470d6bbf638f3dda13d42fc205f24ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a3c92d-1bb7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632323416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323416, "uuid": "3225ce25-5659-4c02-b2ed-dd4bf6c03cf4", "comment": "Malware payload (AgentTesla)", "value": "89af24f0e1f60aeaf8f17ee6de881a8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323416, "uuid": "2a9faa23-c3f3-4cda-bf6c-66270373c4e2", "comment": "Malware payload (AgentTesla)", "value": "fef9eaeafecc3af9103ce073f0ee746f429b44d46973f464c19720a5b42a747b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323416, "uuid": "91933c24-6647-4d17-85c4-5eed43fd6cb3", "comment": "Malware payload (AgentTesla)", "value": "dd28ad733f9df2dcd3f8fb53d8f45054c96652e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632323416, "uuid": "9babda9d-e038-4023-9a38-b9fc3c5bd553", "comment": "Malware payload (AgentTesla)", "value": "bf74daa0295347ef244e7a3c61e77cba036b399975da9469dda495bf68f38a1ef172e78195ab432ae83865879ad5c1c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632323416, "uuid": "b209c33c-ea38-4db2-9dbc-182ce7df2721", "value": "T15D81C76528B81040CD576526A531FD2D42EEF5139DDA4EE5328DFB8107BA312CE57DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632323416, "uuid": "85e19399-d25a-4168-911c-b1ea455c5dd5", "value": "96:IA7arU9j7kwHFfMZ24nJlEHJgXDfuTc7B8mqHIqU:LaQV7kwHsJK6DfuTOHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632323416, "uuid": "ca4a8dcc-959d-4727-ba65-665c022b77d0", "value": 3915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632323416, "uuid": "debdcee9-9879-401d-b299-685eacbd8421", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632323416, "uuid": "54c2f9f9-97cf-4ada-aa4e-22ad1eee503d", "value": "Purchase Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }