{ "Event": { "published": true, "date": "2023-05-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-05-25", "timestamp": 1685059381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8080bca8-8a1f-46ae-be9e-128be751aeff", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d262af4-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996619, "uuid": "4c49665f-ddbb-429e-b86b-b221e3c457d1", "comment": "Malware payload (Quakbot)", "value": "869eb655f186beead43fe43b15b3f152", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996619, "uuid": "42bd9431-4771-4b5a-82ae-bca8e69c887f", "comment": "Malware payload (Quakbot)", "value": "0000025c5ee1d6707e6dddfe2816f92d9d8d8bb7c84371c44529e8083109b0e5", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996619, "uuid": "99382146-a4e5-47f6-98f7-f53fb5d7da64", "comment": "Malware payload (Quakbot)", "value": "4bc334824915515fb7ec8402bb06823f9db2100e", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996619, "uuid": "3cd552d7-9763-4733-83d6-f0e6cc103415", "comment": "Malware payload (Quakbot)", "value": "84bccee61112ca5b481c260a650b612b331c620da8626a22b01ce4fca23161c4c2fa5ffc8a0234eb5c5d85bbcefbd7bb", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996619, "uuid": "825cf1a8-149f-48ad-b94a-2777fb05b21f", "value": "T1B3632A5BD381037899220218658F56D1F7A588387B61DA68F48FD3ED33119B8C5FE6EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996619, "uuid": "fc23a969-8648-48b2-b317-dc2a692e2d92", "value": "1536:M5tQlbHHHgHoVHo/w1ZOViNmwSRmzSUrgOktSyj/tQla91Zcz:QtQhHHHgHyHv1ZOw+RxQbktSyj/tQ896", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996619, "uuid": "5d864f5d-ba12-4727-bb6b-858f7f195469", "value": 69941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996619, "uuid": "fbdb6427-ffe4-431b-8f76-e77a0ba79af4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996619, "uuid": "bfb84623-926a-4aee-876c-3bddd4a51cd8", "value": "Claim_A985.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8470529d-fb42-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685049862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685049862, "uuid": "4292e000-d32f-4ec4-9eb5-6122ff216a8c", "comment": "Malware payload", "value": "adbbe3b5fb02bb3b6eba57f019933412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685049862, "uuid": "50d72b85-e4c7-45cf-b7de-24be8f512ac4", "comment": "Malware payload", "value": "0025e7526b7d4806b3da2c0843994300c235863e603b299c86a2b32d6682bf18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685049862, "uuid": "37125ecb-87da-47c1-99ce-8465c51d16a4", "comment": "Malware payload", "value": "e541a4969eee255c101ab42783e97d0fa40a62de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685049862, "uuid": "fee7cb68-8d85-48a6-b9a5-4a3478ae729e", "comment": "Malware payload", "value": "8789858f9ad44342fae37493159c65ba56d475bd06acca5fb8dbfd845b7a80573adb20c638bc05caa83d3f5350385a43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685049862, "uuid": "b6515220-8000-4eef-8936-28c41bf51f9f", "value": "T103157E23B2D18437E1731A3C5D6BA3A4983BBE612E34694F37E41E8D5F396816C25393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685049862, "uuid": "77c01e33-4ef6-46f7-9285-9e29a5a1e302", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685049862, "uuid": "a693513b-5467-4c49-aa62-6ebaecf3552b", "value": "12288:yMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9au2Twxk3Soj:ynsJ39LyjbJkQFMhmC+6GD9UTwxgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685049862, "uuid": "971a7e2f-8f3c-48a1-9c9c-6cab2f9f6973", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685049862, "uuid": "30a1f6e4-6098-4ddb-ac5f-1c9cc79b77e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685049862, "uuid": "ec318395-42b9-4592-b435-006e46ec0926", "value": "0025e7526b7d4806b3da2c0843994300c235863e603b299c86a2b32d6682bf18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d87458-fae4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685009329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009329, "uuid": "95e83696-0dc1-44ce-842a-6d0948e3b973", "comment": "Malware payload (GCleaner)", "value": "00701362ae358a7a8330d621156da877", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009329, "uuid": "239b6f9d-b505-4aec-85e0-57aff373ec26", "comment": "Malware payload (GCleaner)", "value": "007a8bbc1d184d64d9dc0a360b135669f980e4c6131b05b34fb12b346bf4ac0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009329, "uuid": "d63c42e5-4a2a-45bd-bb3c-8edd7b71d026", "comment": "Malware payload (GCleaner)", "value": "2c91cc95060314064f60672b9723a1479306472d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009329, "uuid": "e64c5f26-7819-4f0f-b6c9-a52d61f42f32", "comment": "Malware payload (GCleaner)", "value": "ccf90553887398ecf86ff6e252eb57e8b7fd062080679090da3b6843c99fe2c3be88732e87c142fd9f7d0406e94c0662", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009329, "uuid": "97e0e9fb-9d74-47b3-b87f-510ca9bd2b73", "value": "T1CB74BE1232D0AC71E5166A358E2BC6B45B2EFCA18F242BD773947A2F4D702E1D672707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009329, "uuid": "05833870-5d2b-4498-9d69-e76c27966997", "value": "4dc3e52c058b03af2b7dec3a031b4e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009329, "uuid": "429b1786-f092-46d3-b15f-7924bcfe87f2", "value": "6144:zfg/tsWLUcGk8BL5kBgDIPUavQT18+LvFMIId91iOJcLV/0:SsWLUhJGBgPavQT18ATI31Mh/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685009329, "uuid": "3c6cc282-36e6-4297-88c4-72a3ec6d0c91", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685009329, "uuid": "87f5dcca-ca35-4906-9ad0-9f1721668406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009329, "uuid": "004a9aee-c912-4fe9-835f-8b2120a3afb3", "value": "00701362ae358a7a8330d621156da877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd532bd5-fb00-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685021665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021665, "uuid": "16ca59cb-b04d-4b14-8f6d-880c6277b90a", "comment": "Malware payload", "value": "d90024db0a7a6dcdf0a505aaa2568538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021665, "uuid": "cc0121b6-65f4-4866-b7ef-abdda0824b43", "comment": "Malware payload", "value": "009927cd5ad3e1195b3b9cf07e69cda1d641bb3d0252688cf67b554ded2d3902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021665, "uuid": "32b954b6-8e0d-4714-91d2-41135f1cf52d", "comment": "Malware payload", "value": "dc8ae2d6786ab74621e79f76861f660146deaf91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021665, "uuid": "e350d1bf-14e0-4f2a-89c7-89a09a702607", "comment": "Malware payload", "value": "eb8d5be03b22e692b2d61e67090108ad5b370ed68f883d637da302236a5af954ce8017672b49157979b96f90dce6d7ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021665, "uuid": "a7a43417-fc88-4bef-9f50-8158dc435a26", "value": "T1BD767B493AD508DCF8598FB29B9103A833DD33339BAC0DD6B6080518A76DDB94F5DB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021665, "uuid": "572bfcdb-45a2-445c-834f-6a990124e510", "value": "d14ac171253cf4e289cd276f47898b08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021665, "uuid": "568a3111-a267-46cf-9da7-e2f34a859647", "value": "98304:3KuAkQQevgaDjDN+7gOq7AvARa+2KB/8y5HNUlPQDO3JuxfMb:aOe4u+ewR0/dsVQDOZuxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685021665, "uuid": "556da9cc-c5ab-4337-915e-3ddabf52b335", "value": 7300608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685021665, "uuid": "4b6e8919-09ee-4818-bbfc-a8694ab5b12f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021665, "uuid": "ac340be8-c013-46b1-8ba2-2578c708a5a8", "value": "SecuriteInfo.com.Variant.Lazy.345052.1518.26003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75543683-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996579, "uuid": "68a34d93-9c7f-403d-93b7-bd8c797de43f", "comment": "Malware payload", "value": "dccbdd4b0b64d40d8942f1624094b8b1", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996579, "uuid": "884df718-c034-4a68-8859-1c3ff8a4d6a4", "comment": "Malware payload", "value": "009ab6b03727bd79b6a5d24d96c640cb7a23bd5a1a24ca2657fa35979c0564d5", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996579, "uuid": "8ebf68f8-084c-4ab9-b074-61a206de7574", "comment": "Malware payload", "value": "2754237fce08341a64915052187fe5a087d16b1d", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996579, "uuid": "a4564f6b-55a4-4144-83d8-aea658f74355", "comment": "Malware payload", "value": "6ca458d35b50c11f4aa550de7fd6b5efe7a5636cb6cdcd53c0f545843b4c390c2b1e44831527285f05b207dca8f7f736", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996579, "uuid": "475b2892-b06a-46a1-9c33-92eb7164cecc", "value": "T121731A1BA385033956220164560F67D1F7A489787B62DBA4A44FC2AD3342D78D2FFAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996579, "uuid": "db23934a-05ce-4480-bbf2-278e7da506f8", "value": "1536:llNwioz5S6S/1ZOvuzBmEceRPhpqW+3DbGc9lDhslm/S1ab:lzwbz5S3/1ZOvudPhSbG6lDylm/S1ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996579, "uuid": "6bad8e02-10d5-4e92-95b6-bb4047bbe7b7", "value": 78988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996579, "uuid": "0d3285b2-9147-4491-beeb-8a01c69538f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996579, "uuid": "e1166af1-f3a7-409f-8b98-c31f6475ac14", "value": "Claim_A321.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c5dec0-fac3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684995187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995187, "uuid": "2675fa68-44bd-456a-83fa-9bdc1bcd0770", "comment": "Malware payload (Loki)", "value": "1c57a9e41ca9b9e64fb33470facd087e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995187, "uuid": "b4bc0cdf-71a5-4410-8f81-9c653c146a27", "comment": "Malware payload (Loki)", "value": "00cf6e9a873007d1f11859d3e30c85bda6f137cfbc53cd0bc9a4ac77a6ad5b04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995187, "uuid": "5e2b0e14-16c0-4cfa-94df-4165f70cfc6c", "comment": "Malware payload (Loki)", "value": "1929dc10880f028c83ffaef8693b54fe383f0fb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995187, "uuid": "fff57de8-0709-4ee1-82a7-6459258f4005", "comment": "Malware payload (Loki)", "value": "9f60888691dfc906a0375ec42d1d79cf004a0ed497216644fc40e6b511cbbcd9d715a774e925a862826b3bd6b991c229", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995187, "uuid": "622d96ee-5eb8-456f-8bf1-eb7a71e6b816", "value": "T1ABD4237456252B21CABB0B71043066B20BBFEFEA7562E61B5C4BF6C8E715F470401A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995187, "uuid": "2ef2e178-f81d-4cf4-8ba3-b4d5f816b78d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995187, "uuid": "9e8d5dfd-652c-46fc-bea2-fde2fd149db1", "value": "12288:taWIm6lVvtzZBEP85VdbHPWF07ViMLRZOYKWnId5a/VAV9Cai2b:MTmIt9BEP8TdtUMLRZnKWnIdSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995187, "uuid": "4277479e-9398-4c84-9c0f-3f2fc808e13b", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995187, "uuid": "c1ac0c48-581d-40e5-8b53-07a2ff79bd25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995187, "uuid": "4bc99541-7916-4caf-becd-5ed3b2dfcc62", "value": "FedEx Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5378094-faaf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BlackNET)", "timestamp": 1684986915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986915, "uuid": "34b24515-c479-40e0-b971-43caffcf05d7", "comment": "Malware payload (BlackNET)", "value": "a1d2556073cf1dadf840627cedb4ee05", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986915, "uuid": "ddce8dc2-278c-4011-9723-4c0b8dcccdc2", "comment": "Malware payload (BlackNET)", "value": "00e6cd945214e899a23d2afba5c28b185037e0fc3286a78e5fb6f36668c2110b", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986915, "uuid": "eb4a4c52-a0a1-4567-a4f3-5f5ea8ea2ac0", "comment": "Malware payload (BlackNET)", "value": "0cfab6747c5d53238e3027347659a51709cf36b2", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986915, "uuid": "4da7528d-b9a1-4581-9daa-7d6c7ff873e2", "comment": "Malware payload (BlackNET)", "value": "f151b1a49312f444f14e7d541a224377ea97b462d55509161bb57ceceff2749dba36d789e7c092c0f9d22f4e15bd4690", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986915, "uuid": "ef1f50a4-5548-4429-8d4a-466d8ea9eb1a", "value": "T1B994CE2BF2BB5A41D1D9C97FEAF11080DE20B87D080ECB46D2441BAE5A5E39351B5E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986915, "uuid": "761c88a6-fec2-4b6b-a6e1-bfdadf732294", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986915, "uuid": "759f7c42-a907-4270-ae5d-60785c1ee3b0", "value": "12288:cUEUGtlUW0rjwfas//M4Zjvz4G9TDMn6fB:cU0tlh0KagvzDMn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684986915, "uuid": "3f47db53-5734-4773-b027-a04d07f2cabf", "value": 430592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684986915, "uuid": "605341a5-aa41-4ab8-ad25-8bdcec78fc4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986915, "uuid": "b49d13c2-05f2-4c4b-aeb5-9bee452bc448", "value": "TTUSD186.097,08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db06f4a-fafb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685019330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019330, "uuid": "0eec7f0d-ed41-4b07-8170-a7358c2d6e6b", "comment": "Malware payload (AgentTesla)", "value": "2afa5f8b900075c8275d482bd28d9f76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019330, "uuid": "8d55f7bd-8610-48d5-bed4-c0faa7fb3832", "comment": "Malware payload (AgentTesla)", "value": "015070adc48ca00eaa9fa61df9194059c1758c2502fdb0900bf686c8e3ddd6c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019330, "uuid": "a0c892ed-7fde-45c0-9b95-a1a910e6912c", "comment": "Malware payload (AgentTesla)", "value": "65ca143d36ccff4f1e1824b5f8e9f6c09d858dcf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019330, "uuid": "844d7586-f155-4e33-a238-04c526639e2b", "comment": "Malware payload (AgentTesla)", "value": "fa8526c90130282de65f548522fe473e4d6c430c486477b7406f13fb75134d83b137fec2d906834bbac548f881d7f2c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019330, "uuid": "0ea15f79-f43c-4cc3-9bb2-b1183e66afdb", "value": "T12AF31917BF008656E8580F3148F79BA62661FC445F520A0B3219F32DFEF17E49E2AAD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019330, "uuid": "d9937ca6-3daf-483e-8ff7-15aa0b7e8eac", "value": "3072:ifZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAM9Z6AFsTye:mZ+RwPONXoRjDhIcp0fDlavx+W26nAM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685019330, "uuid": "9d2eb619-953b-41d3-831c-904e9ebd7f2e", "value": 161280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685019330, "uuid": "58567202-78e1-4fb1-bf70-5549955340e7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019330, "uuid": "11b5e5bc-1c45-4886-acc0-996b06e475e3", "value": "PO.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c534ce-fb25-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685037308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685037308, "uuid": "e3f8a5fc-1055-4e71-8c52-5d1644b0c892", "comment": "Malware payload (Amadey)", "value": "547bae937be965d63f61d89e8eafb4a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685037308, "uuid": "e6bf1d1f-57e7-4a65-a526-19144d94fb58", "comment": "Malware payload (Amadey)", "value": "015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685037308, "uuid": "2c9143ef-5c5a-4455-bcea-09255be9ba55", "comment": "Malware payload (Amadey)", "value": "85466c95625bcbb7f68aa89a367149d35f80e1fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685037308, "uuid": "7c1cd88a-2c40-461b-a7af-1cff984a7c50", "comment": "Malware payload (Amadey)", "value": "2117998747b2aad62a49feca6448fc466cf182dc371a857035900a8c53273bf89b770d8398a80cbfce862d45c758b1c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685037308, "uuid": "1382bada-4c18-43ec-8081-fbb67054bc1e", "value": "T1FD936B1030D2C471D57E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685037308, "uuid": "0287f46c-ab8d-46ed-8e5e-9b1be5162859", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685037308, "uuid": "6569b1ec-4ed8-4491-a358-b1047a0ed32f", "value": "1536:Xo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUynTaB89p:XoUCWbBNpplToUs1uNhj25LJUUaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685037308, "uuid": "2a31b56c-a2f9-401b-82c3-e7ecfaa9dc5c", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685037308, "uuid": "b64c0069-0dbf-4c11-92a4-24d769f1e861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685037308, "uuid": "21980901-0232-4b72-a400-e8793627dd3e", "value": "547bae937be965d63f61d89e8eafb4a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1f07fc-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996753, "uuid": "8f709c61-96e3-4347-9115-845d96b79334", "comment": "Malware payload", "value": "054e36fa7abb7d48db6c927d12cd5b6d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996753, "uuid": "583bcd96-e709-4b38-8e74-cd795ec048c1", "comment": "Malware payload", "value": "0218d3c271805afeec8729a63f9c0432371e3460ad91ed92f61b206588dc7574", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996753, "uuid": "25251041-f83b-4aaf-84fa-035a1088d1f6", "comment": "Malware payload", "value": "1866799e7a90c3a1fdbb696093c5ec0c7d2f3c95", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996753, "uuid": "6d5aa5af-19da-43cf-973d-c3b55f1fd4cb", "comment": "Malware payload", "value": "48f54e1b09caf6bfcd6b8e85f09dd8194ffe2401649980e981adcbec40db741d4dfdfa6108ab3290bda6fec525974c81", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996753, "uuid": "4be3ffda-2897-45ea-b6cd-b017646eb550", "value": "T1C254A884472528A24B5B7F22A73064B5EBBE1EB9C2C4458BF46F7251FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996753, "uuid": "59d8f759-a7bb-46f2-870f-c7e283addd3e", "value": "6144:elbKk8nLHCfIYzlbgcAM9fE+/zhuCvAYMLIXTCaFZW5G+8uUq6j6vUu7fuTppq9M:eA9/QQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996753, "uuid": "bdb87802-2d27-41be-b1d9-45b365485a74", "value": 283759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996753, "uuid": "b65e9fb6-f20c-4fd2-a3e7-aff21e577728", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996753, "uuid": "8a195600-4f7a-4af7-8f8a-7f81dc39cf41", "value": "geocentrically.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee85b7f-facf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685000300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000300, "uuid": "c325b7d8-4114-46f2-811b-6f70324eef21", "comment": "Malware payload (RedLineStealer)", "value": "ded9c446b66d152a59e897c3a382d0d3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000300, "uuid": "d85925d9-62fd-4451-bde6-aa51a607595a", "comment": "Malware payload (RedLineStealer)", "value": "024ee2e42a0cb9a95b7e127b10c17fbe61dbfaf1250399f00255774a05fff26a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000300, "uuid": "2c0a0a23-5637-4a07-94ca-6a09a094bac4", "comment": "Malware payload (RedLineStealer)", "value": "9c9f3186eb258527e568b3f55507859ffd16dd09", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000300, "uuid": "61ffef9b-8266-4349-a8e1-6d66e2f83baa", "comment": "Malware payload (RedLineStealer)", "value": "c6b0ae96394b8eaac94b142cdb99d2be10313567cfe1f14666ccce9cebb7d1cc91dd0c9dce364911908533805f920b59", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000300, "uuid": "1258a6af-4a3b-4c50-a2f8-e437b784f1e8", "value": "T10B25234E86F481B3C8F61B3018F622C715767CB2CE68875B3745ED461CB2AE89826777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000300, "uuid": "fb71e6ba-b967-4354-8b6b-755359f17ef7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000300, "uuid": "1e41d474-1185-4f3c-bf84-618ee5a7c809", "value": "24576:2y85HLYyqQ8Q87qAinTGYbhfIkLFbkfKFnLJ:F6rYDhqrGghfXxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685000300, "uuid": "3a599b30-7cf3-472b-a439-41da437c9b24", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685000300, "uuid": "cd69857c-a165-4ef3-916b-a307a8c543d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000300, "uuid": "375a6d44-66a4-4d02-8a12-89d578320514", "value": "M7R53821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3dba92-fb46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685051785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051785, "uuid": "66c38451-5c7f-4417-aaac-f5cf73c328e5", "comment": "Malware payload (Mirai)", "value": "ebdf82fc8126ae2a984022fc30b5fb3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051785, "uuid": "58a89a9e-7e7a-4618-a8c3-f17a48323fcd", "comment": "Malware payload (Mirai)", "value": "033897e972c0644fbdd4a9d5e4b55232e757103c75e8eee80202490a7847afee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051785, "uuid": "cb02acab-5104-4427-9e95-40ac43ce40bd", "comment": "Malware payload (Mirai)", "value": "c9d3b05193d6ac2e2d147dc922d8455cf428caf4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051785, "uuid": "78564040-8114-4c4d-b6f6-67097c8e18f5", "comment": "Malware payload (Mirai)", "value": "93f3af64c0846190e36b080a09761d252b6205d61b5487443a6a6c6e5ab3a08b832b48be4307d7760d83b6dad23ef162", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051785, "uuid": "b8bbbfad-da65-4fb2-8eac-b3c719ec1f4f", "value": "T14A330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051785, "uuid": "eb2a8d89-0ae4-4f09-845c-c7ff2c6137c0", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGj:r/hqaJMDg9eqK806MHdkfQX6HuCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685051785, "uuid": "157aa498-8b5c-4dbe-9aeb-5d1618d31e4c", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685051785, "uuid": "41682b20-4553-4de7-8fd0-65623b1f0903", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051785, "uuid": "60c982cb-a0b4-4390-bf80-3c6a225772a5", "value": "ebdf82fc8126ae2a984022fc30b5fb3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f4b65b-faf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Sality)", "timestamp": 1685017225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017225, "uuid": "9f402333-2f2e-4011-a538-fc560a7bbea3", "comment": "Malware payload (Sality)", "value": "2dba832a5dd60f49e3f39083dc446ebf", "object_relation": "md5", "Tag": [ { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017225, "uuid": "e03e0769-ff4e-46e4-86bd-eb8412d34539", "comment": "Malware payload (Sality)", "value": "040f8a9fbdc49c0ae2c2e3872f1fabd8ed805bb8e0baaefd6e426d5facd2a173", "object_relation": "sha256", "Tag": [ { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017225, "uuid": "07aee308-1577-462c-b15d-58b22ff611f7", "comment": "Malware payload (Sality)", "value": "0fe0f4b9a2666e800a486ca918dff8b2e71d516e", "object_relation": "sha1", "Tag": [ { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017225, "uuid": "48a44646-cde3-4f9a-9b6d-1d85d50e8f32", "comment": "Malware payload (Sality)", "value": "9688ec1e63eeeae13d993b0bbdbbb00ab5a3e13e142e1e5ee25e88f7aff435fadd0ef2e36e30f5355d968ff557e4a8e8", "object_relation": "sha3-384", "Tag": [ { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017225, "uuid": "d55088dc-3749-4670-a98a-32f67b52f383", "value": "T154077B50E282C476D4F3A1BC6A67C677A85C3FB41255A083B3C5AF27A9703F1BB12953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017225, "uuid": "6661bb55-bae5-4ea6-9962-a0676bea3e24", "value": "5cfe66764421709541218d00cfd7cf0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017225, "uuid": "ca0a6a49-2cb9-4755-9fe4-7ec3aeacf829", "value": "6144:NHirLujRaRsU8gEE1A/2V4fOBvs/eU5UH0t:NHiujRaqgEjXeik0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685017225, "uuid": "1845d5b3-a730-4e05-95fa-d84546512a67", "value": 17421824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685017225, "uuid": "87502432-6090-42e7-8755-6c0f73e68ec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017225, "uuid": "4974d567-adba-4d0e-8a76-0886ec0f0eb8", "value": "006907199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761793e4-fae3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685009036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009036, "uuid": "6e746f62-f3b6-4daa-b020-f6e1c2f72a65", "comment": "Malware payload (AgentTesla)", "value": "dec2c782993c1e02836aac08ee02e8bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009036, "uuid": "c60f9db7-8b51-4688-996c-77903a4e9abb", "comment": "Malware payload (AgentTesla)", "value": "044e38c30a242bcd812ec149600d186cbd8bdc9673cc8d64fb10afbfc7f1509f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009036, "uuid": "efe89b35-8cee-4f29-8bb9-d68ab1de7fde", "comment": "Malware payload (AgentTesla)", "value": "5496f4aaa005e02f95ab4b7a7f306a54ee769976", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009036, "uuid": "3b746a2c-8e51-44d3-a307-5f49577e2475", "comment": "Malware payload (AgentTesla)", "value": "8897c1334fabc0d5abcb145ad6c7abef3c23533127d92b6047b303fe85b8ec7d844bb0d8e927ae8945493862d8c12ed1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009036, "uuid": "25c06ea3-11de-4446-89f5-ffff07628a6e", "value": "T151B4230AF1F28EEC58445D8E7D6A65AFAB55DC9487382AF011B47E00DBCCFE462C1E58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009036, "uuid": "4850e1b3-b8bc-4df5-b0aa-c92e5e7a8a1e", "value": "12288:ORKzwaM9Z5Tv+hh3Z0+hk5iydi1dYHbwHMx1yCC4du3/Mymy:9waM9rShC++9I6HbABvz3/M0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685009036, "uuid": "756f4684-15d4-48f5-bbcd-5e19e1a46d26", "value": 517730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685009036, "uuid": "fabb5292-4e80-4661-b5a8-54b6de7d3fb2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009036, "uuid": "8579dabc-6153-461d-bcd8-72fdd0e786e5", "value": "Proforma invoice-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bc0bbb-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999692, "uuid": "4aa5ccef-e375-46ec-b798-6de8afcdab5b", "comment": "Malware payload", "value": "b76c3c76361cce4cb135a2772c366553", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999692, "uuid": "06454118-f155-488f-bf74-5dd91256850e", "comment": "Malware payload", "value": "0489b7671cbd423e7efd84bedded72481d8314cce7d639a70f8f0afdcb44ae42", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999692, "uuid": "26d965da-54aa-4238-bdd3-ed6a5818e845", "comment": "Malware payload", "value": "dfa0ea2e368679ccfa1f4da2655c815bf6ef3749", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999692, "uuid": "59b60195-fd02-4c14-aa8d-45779a9aa788", "comment": "Malware payload", "value": "cfcdecfcc8321e3284ec8f5d739f098cc27358326ba376a7af9209e02537b2a29ce16b314a8cc3e8be9799c5a04a0835", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999692, "uuid": "dfa5d58a-d11a-467a-89d4-771851bfcf45", "value": "T1F45455844B5124B24B4B7E267B30A4A5DBBD1E75C2C8568BF45F3260FBDEA8CCCD1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999692, "uuid": "583bb9f8-7e57-40b4-a753-7281f331d52b", "value": "3072:vsa5dsTMUpjWHj2giYSjuDoIGZCypLEEVYqw6uSeyPzQAUNT:vxdmpo2gisDoP08EL6HeyPzQAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999692, "uuid": "c9d74b2c-5ee2-49e8-b84f-ca855b36db75", "value": 305392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999692, "uuid": "cfd4bdc8-c231-4a50-8a5b-6b91ce4bf1ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999692, "uuid": "29629415-b5f7-4fe7-9141-d4564e5c7f2c", "value": "dashierDemidoct.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927c98e5-fb00-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685021539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021539, "uuid": "a9097e4d-c88b-4837-b556-1b5ad6a91041", "comment": "Malware payload (Amadey)", "value": "8054ccfec4a284d89886571683fd63e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021539, "uuid": "f47c09ad-cdec-4450-ac69-ea35a402bfc7", "comment": "Malware payload (Amadey)", "value": "04c4edd1ed2be426f4c266cbaa6248853ec9f4a068f416b277a3afb815fe0974", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021539, "uuid": "5c3ea683-ae4b-41c6-bbb7-76ad0a0313ba", "comment": "Malware payload (Amadey)", "value": "9841fc123c63e8d088ac876bc270e2139640f65e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021539, "uuid": "134eb2b7-d60e-4368-b0d9-a6d7cf29bb75", "comment": "Malware payload (Amadey)", "value": "d9d7a0d7b89d25386405409eb2f12b268e69a452e8741212fe2c809d6f75f3f08a230fb5bcfc04c4a125a8661aefb56c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021539, "uuid": "3f1537bd-4e28-4945-93b5-15d840583fac", "value": "T13A352363A6E84022D9F56BB189B702E34B3DBEF10DB84B462315785E1D71AD0763732B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021539, "uuid": "3a08c01e-ae46-42b8-bf4a-222d01d2e65c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021539, "uuid": "693a7b00-0078-4709-bd58-cd6ff4d45b05", "value": "24576:KyMPLRe55FmCta6qKNqB2MLSIA8VZxC035+c0ifPeJ:RMzRe55FLt/ZOSIVD5+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685021539, "uuid": "f52b16bd-461f-4aa8-9f18-80bae0f82661", "value": 1070592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685021539, "uuid": "6c800936-edd9-4cb0-b524-ecb49e7a7787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021539, "uuid": "4897bdba-12ce-4701-a460-6baae2b9eac4", "value": "8054ccfec4a284d89886571683fd63e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d591e41-fa95-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684975359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975359, "uuid": "d9ba2417-dd9f-49fe-a88a-7e9bd21e958f", "comment": "Malware payload (RedLineStealer)", "value": "1ac3cb204c4f376e2ce01fa8cf12b0b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975359, "uuid": "cd279759-fd3b-4179-81cc-c824dc33ff48", "comment": "Malware payload (RedLineStealer)", "value": "054f28dc4701c7c415dd8e4aa4117825e4677738f980703fbb98d714100b9a18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975359, "uuid": "9c500aed-7480-4d0f-a188-c407b14b80e6", "comment": "Malware payload (RedLineStealer)", "value": "9c2b4f044eafef779258e7bb039ba632b5ee6030", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975359, "uuid": "624d9c1f-4426-4120-b480-b7917cc52cb6", "comment": "Malware payload (RedLineStealer)", "value": "79b6b37a36b7573690b67927973c77d9f19e8505d276ced6dcff3b4f9dd63c94f0c23978d8466a5b11d4ca684d0a743e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975359, "uuid": "d6de91fd-9774-42b8-9f54-b69620f06860", "value": "T126252343E3E98173D4F523B15CFA17831A3ABCF59E78475B7384A52A0CB268454723AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975359, "uuid": "89a24957-9fa6-4cb0-b9a1-e7bf23ccea94", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975359, "uuid": "21dde91f-6064-462a-8a01-d27f00b80dbd", "value": "24576:Qy1TxfXk3+k/PfOQ0nk0TGzvhl/1bMyBFQ:XlR2+k/Pf8nNGjhl/1wA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684975359, "uuid": "c314e56c-901d-4446-8863-e650068cba71", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684975359, "uuid": "8f632d10-bd17-485e-8c97-4e41e91f8054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975359, "uuid": "37f47143-7d6a-407b-bc46-ade688b34cba", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734bc369-facf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685000441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000441, "uuid": "2590994c-4421-4f12-8793-9f2859995a85", "comment": "Malware payload (SnakeKeylogger)", "value": "322515f9ba9bd3518dec81faffd472eb", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000441, "uuid": "afea9795-aa62-4cac-8bc7-98cdf78429ef", "comment": "Malware payload (SnakeKeylogger)", "value": "06045cf83f2510a653e35d63d4e77dcc1d2265050be035ef7ea00fc2b855da2f", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000441, "uuid": "5d4113a2-9f4f-405a-8ea6-0f4f1667f124", "comment": "Malware payload (SnakeKeylogger)", "value": "45ac88817480d186a3b281058ad1a9f3e4176e11", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000441, "uuid": "88a1c6eb-f147-4aad-acf5-bf3d57c33c4c", "comment": "Malware payload (SnakeKeylogger)", "value": "1abf444059a7384af4eb4a0a526a09a46eede7efb3efb77dde56b6487c62ba495a4001f89b478947f08bad8f068396e3", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000441, "uuid": "21f45254-99e2-43c5-a33b-4c1783fc0fd6", "value": "T181E422A4BA915729D96A0BB014147BF017BFCFE87876D4AB1C4BF5D8EB02B4A1410367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000441, "uuid": "af2e362d-b29d-4cc6-be78-b531ba7966ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000441, "uuid": "ea9208a2-849c-455d-8414-ac3a63dae4d1", "value": "12288:caWIm6lVvtzZBEP85djvZq92yjpN8YuMpH9zr7ELN9rXRg1LHNVQ:xTmIt9BEP8LRq92yN/H/zrurru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685000441, "uuid": "5e92f8c3-4444-43ee-8eb7-e88e179adb42", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685000441, "uuid": "9bad98a3-94cf-4bbb-96a4-ac156cbdc8ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000441, "uuid": "248493d1-66d2-4482-8844-72d84a871d5f", "value": "M7R81255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba146c93-fb1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685033631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033631, "uuid": "60b62a13-76cb-4a51-9673-0adeac7b24a7", "comment": "Malware payload (Gozi)", "value": "1948f937592d1037851d68b394bc35f1", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033631, "uuid": "1f12ac14-29c3-4615-b975-b486bb88f4f0", "comment": "Malware payload (Gozi)", "value": "06864a9cd9890f3c1aad6bdc5dfbfb799e68f5f90a99b6146ca70850d0a249a1", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033631, "uuid": "f1b5681a-f456-48c9-832f-52247fb6b0e1", "comment": "Malware payload (Gozi)", "value": "384ad1091f17650f149283a7003bde6aaebc9a6e", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033631, "uuid": "3820caea-b745-408e-a682-7c84e9bb3f60", "comment": "Malware payload (Gozi)", "value": "5f6b70ee5a484c7abae4f87f0ddbb8ae9819310ec56f6754464a9b75aa0940998165d9beceb8a9326df5ce30332477e2", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685033631, "uuid": "8bff8dee-315e-4697-b054-eae9fc41a35c", "value": "T19EE4BD00E65D8F32C2EA013C5869667A05AE6B2F837444C76368DFB9BC356ED0B35397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685033631, "uuid": "57da24be-bee7-4586-9278-678d71709228", "value": "85827d535df1600f010d49acac67148b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685033631, "uuid": "1010fcf1-72fd-4464-b3e8-828529ded77d", "value": "12288:tkAKewfuFjqAjaDY9Db/yy9vrkBxPRZ4ydCnXaCd:tLvak9DLyFxoI0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685033631, "uuid": "1b7cd260-e142-4da8-939d-1a0ca5fff062", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685033631, "uuid": "2288d05b-30be-483e-96ee-6a2be919ed7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685033631, "uuid": "efcb7c74-f383-4121-ae9c-08fa3194823a", "value": "646f92430a0e9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7d51a2-fafd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685020430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020430, "uuid": "047830aa-aa43-4e85-bb86-f6b7ba069d83", "comment": "Malware payload (RemcosRAT)", "value": "ab9b3d4a26d471f3cab30e7b5fb1ebdd", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020430, "uuid": "5a51108d-c730-4d26-b691-a5afbfd34045", "comment": "Malware payload (RemcosRAT)", "value": "0694f9298292cb06b0eae287f24b53d2ed824c16eec54bf73f775b9e8ad2a337", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020430, "uuid": "d15f8fef-6047-4ccc-a1d1-41b52feb557e", "comment": "Malware payload (RemcosRAT)", "value": "61b6ede9958ee0ae4a23e8c2f43da4b4c3eee69c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020430, "uuid": "680aa952-39fb-482d-bb72-50eb01120a04", "comment": "Malware payload (RemcosRAT)", "value": "69c6fedb22020745cd4dc658f592b3a09e20002022949a367092b5c6c1f4be07f6a45e05017efc7e79aeacd989debff7", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020430, "uuid": "4b72c891-9ed0-464f-b821-5dcdc47f99cd", "value": "T15B85C437798A070C3EB64335A3A16197EE5AC615EF513326ED89A3B930014A8FCF27D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020430, "uuid": "113dd348-f752-4dd6-a276-9ab4a6dad113", "value": "6144:Je05+M7U/Tk/aEaOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOM:gE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020430, "uuid": "eea956f8-a786-4a90-bc8e-c1514144444b", "value": 1720468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020430, "uuid": "9b9ee52c-57a1-4966-a759-ad25ae0fc980", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020430, "uuid": "e182ea44-af1f-4063-b902-7c71620d6332", "value": "002671299.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b6d3ab-fb38-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685045727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685045727, "uuid": "b2ce0482-7a82-4a07-b0ef-996a37a653a4", "comment": "Malware payload (RedLineStealer)", "value": "1c073a7cdec912cd8a3dd894964f50d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685045727, "uuid": "35d49f94-db2a-42c9-b7b1-473fdda444d7", "comment": "Malware payload (RedLineStealer)", "value": "090c3cb6e9d19fd8e45158d2764d4079944a91e046c16161b20ce069584b720d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685045727, "uuid": "12acfbb4-ad53-403a-9f33-81cfcc271d36", "comment": "Malware payload (RedLineStealer)", "value": "de8018ce906516a110c80c9d442e1d3ed9af7948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685045727, "uuid": "a65f6c1d-30d9-4698-a9a1-fd44068769a6", "comment": "Malware payload (RedLineStealer)", "value": "82c967e41f37cb741034de179e16fa3cd867b8270fa2bb178ea6477c7e2d2eee6391223c3faca5c10276ff1b5c86d71c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685045727, "uuid": "50fac125-f6dc-4838-8c78-107003dd5c17", "value": "T188F4125377EC8132E4B017704CF703D70B3AB926ADB557AA3686A84E1CB25E4A43572F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685045727, "uuid": "a73ec3b6-7125-4f6f-9745-d1f183c882ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685045727, "uuid": "35fff02b-03f1-4235-acb1-36f8bbe1b076", "value": "12288:GMrvy905O3PRBEYFQ7VP8Vsq3gKBFnYI1tmVzLUjDn0kBljnMLtIW+WESO:RyZ3PRSYKP8Vn3hNWBLC0kzjML1+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685045727, "uuid": "75327aa4-6894-42a4-bca9-9195c6ce4459", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685045727, "uuid": "054d101b-dd6f-4057-9b30-e8862da4c57c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685045727, "uuid": "e04f36c4-b52b-453f-89db-b45d7a8b5b38", "value": "1c073a7cdec912cd8a3dd894964f50d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14715b51-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685003718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003718, "uuid": "7d0f9dfa-ce02-4f49-ade4-dcea23e0c668", "comment": "Malware payload (SnakeKeylogger)", "value": "660de7d88a0b06e475c1c93037ea2e83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003718, "uuid": "c50b49dc-f0a9-4b61-9368-a3423b15a8bb", "comment": "Malware payload (SnakeKeylogger)", "value": "090e05970f682f525c780331e68c90206b3195c8e719d9e6fcfd0ddbe5b4f43f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003718, "uuid": "38982ac2-ad38-461e-b4e0-f452f86e6c78", "comment": "Malware payload (SnakeKeylogger)", "value": "9e63881953eaa97d4dec0a49fd68b49e12c5d74f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003718, "uuid": "898999d4-802a-4058-9dcf-2176e1e94c0a", "comment": "Malware payload (SnakeKeylogger)", "value": "ebd212a5a3b3343de3c45b28933191e048d04889064c7ac2a202ee92e6f48b017d8b3c94a2fb89dc9319fd7e6eb40958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003718, "uuid": "fca96160-979a-4ab5-ade9-d5e91120c6ad", "value": "T110E47B6633B57621F47D73BD0119638CCB39B04A2112E12A1F5A3AD546E37EB770A2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003718, "uuid": "321dd9e8-b48c-40d8-a051-10a73f954c4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003718, "uuid": "2ee6b5d5-6b3e-4bd8-8aba-7f9cb4c8b180", "value": "12288:OvV+s1bSQT6tjjdB45+7uQXRx3skdIuG8NquOShKty/v95ThaDnS1F7oac7iR:OtbSuQBx3sQIX+quOGBv7wriFTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003718, "uuid": "0d6a5c87-e3de-4a29-b2e5-467254a4ec50", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003718, "uuid": "71303dfc-83e6-44d1-b7d5-05e36f8765bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003718, "uuid": "80b3aca1-d20a-4330-a67f-10294e1ae49e", "value": "gJR4M7kp4fSWm9j.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e783a1-facf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685000308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000308, "uuid": "7467bff2-e8b9-4c30-bf49-18ae809d2308", "comment": "Malware payload (RemcosRAT)", "value": "6bf4305d2a9bdfe2372013639ea3a8ef", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000308, "uuid": "2650f4f4-6b81-47f2-a045-bd3b71f918cb", "comment": "Malware payload (RemcosRAT)", "value": "093211c83f13bdaa0ab037352beee293ce3d1e2c023d865c87bd86b61509f3f4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000308, "uuid": "1b871b76-7823-4fda-a8f3-b80adcbc5dfa", "comment": "Malware payload (RemcosRAT)", "value": "72a903d9427c3bc62aa37c77347c95c69f51b15b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000308, "uuid": "11bcba3a-4667-4b8b-96e4-ea7ec0199bf8", "comment": "Malware payload (RemcosRAT)", "value": "242fc71831f0066b4f74d46f322eba3c571965b517c85555bdc7787505f5d4f5332ccef24d180b40108889186c0d9195", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000308, "uuid": "bba35d8a-44a3-40fe-bd04-d838b9ea190e", "value": "T1A6A4BF01B9C1C072D57261300D2AF775DAB9BD212926497BB3DA1D9BFE30190B63A7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000308, "uuid": "0c7b818a-0737-4166-ba7c-6c63d81d66c8", "value": "3f3d4ba55ce3e8f736704310c56bf5aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000308, "uuid": "931e353b-7d32-483d-b8d1-a3544955a09e", "value": "6144:K1EwL0xQk9VdeLuVnQs8QLgt8cBvnkCX/3Rde+A+DdsAOZZiXXPcNy2OhX:K1EZT90uNQzYgScBvnn/XpTs/ZiuOhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685000308, "uuid": "4a3e573f-eca9-49be-bd4e-82da6b0de4d7", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685000308, "uuid": "58e54ca7-217b-4dc6-b730-91a3ed8ad176", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000308, "uuid": "80e5cea6-6a0e-4174-b076-be8c54975b70", "value": "M7R56195.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa14aea-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998091, "uuid": "e21be2d9-8905-4660-b745-81ae8706672d", "comment": "Malware payload", "value": "1a4c63dd28c2b993b5f44a00c570c87d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998091, "uuid": "6d100f9a-0c55-4c70-b4f5-b1c7a14baade", "comment": "Malware payload", "value": "09bab76ec037fff1f568b0924b420b2edb3ab885aa70c696eba24dc3f25d7129", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998091, "uuid": "6ba277d4-24a3-4754-8f9c-7c21393e43a0", "comment": "Malware payload", "value": "1e03de8c2d6b100d4d80575a80df00f1eb9d6941", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998091, "uuid": "c147a79c-fbaf-4e13-a38a-b2ef03db9b4c", "comment": "Malware payload", "value": "c0beb9bde86e211fc57d96710a5122bba23710fee61cb5a86df20fd3afcdfe88fca8342b1da9c918dd469a7ae1ccd263", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998091, "uuid": "7760b49b-334d-4d46-987a-fde995710f83", "value": "T158549880471528A64B4B7F36AB3094A5EBBE1EB8C2D4598BF45F7250FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998091, "uuid": "4935317b-d80b-41b2-898f-6e5becc05e0e", "value": "6144:hWldJ9QNNmikWTqK0ZWK7S2Ix+ldokyDfQ:hWu4g+t1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998091, "uuid": "a5134c5b-82fe-4f38-b0e7-43e88e786f1f", "value": 301112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998091, "uuid": "84733c8a-b93e-4faa-9d21-4e37f009fa16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998091, "uuid": "78c3d686-8ef8-4cdb-a733-50ccf7684ee3", "value": "Uneared.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5085bd84-fb27-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685038179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038179, "uuid": "70aceff5-ad27-453b-aee4-d1ce1bd1acbf", "comment": "Malware payload", "value": "acb34b5b2cc9d83217828fddbe4d8fec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038179, "uuid": "51a1cbc4-1b33-4034-9026-c95ea2f90010", "comment": "Malware payload", "value": "0a63e40cd81bea7af8b9ddda6ed05cdf1ca7a222274165e5ae8025e54f54524c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038179, "uuid": "f9aa887e-4f6a-4178-b1a2-f76bad043673", "comment": "Malware payload", "value": "41230179fdbf3291ed07e71fbe0a3233c2b02eb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038179, "uuid": "1f9ebd31-e253-4d5b-8461-8656e100c1cf", "comment": "Malware payload", "value": "98634601998f07d16cee1831009c6f05d64daa677d7b34365ee59908d5dded74636ad6eae89f02d1c28b10ba4f964940", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038179, "uuid": "5ef79aa2-6c74-4682-9e6c-4181c6edea4a", "value": "T13C947D03A3E07C65E9255B328E6FC6F8761EF9918F4D37E76268AA1F08711B1C172742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038179, "uuid": "646af03c-a536-48d5-b32f-b738cdf2f8a0", "value": "f7a21c5a25f4fbde0c4ce2c503f4a18f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038179, "uuid": "2f159a41-d79f-434f-8de7-1620659218df", "value": "6144:/MeAQdb5W70WLYQVS0uJ/fWBS8sJ7VKo5OHrNz0cNwbFbixC45:E2w70WLXc3EF2JKo8HrNCbap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685038179, "uuid": "f371885c-6f42-44df-9195-d5ee59c68fbe", "value": 418304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685038179, "uuid": "e4705b3c-92d0-4c0a-ba47-2499059af427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038179, "uuid": "d4c68224-e8ce-4148-b8db-0f609f655cbf", "value": "acb34b5b2cc9d83217828fddbe4d8fec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2564c9fc-faea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685011907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011907, "uuid": "6259cd9e-9c6c-4393-be26-02b402f8fb98", "comment": "Malware payload (Formbook)", "value": "e1cc389161be478f1ff7c5fb6237d5f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011907, "uuid": "7ffc439c-38a3-45ac-a604-e3b09c0d0d5f", "comment": "Malware payload (Formbook)", "value": "0a8c3887feb56461cbd1e6263d7729d49c2651ce928fc888345fd99e88aab189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011907, "uuid": "bd62f89d-e8bb-4c99-b6cb-79874639856d", "comment": "Malware payload (Formbook)", "value": "450010781502e5e6fd1355aa2cb5428877f78da8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011907, "uuid": "115cc47a-d7ce-4b10-88ce-aded2b80803a", "comment": "Malware payload (Formbook)", "value": "53bef794f450493df3003d88ba79bfc572778a1182f502013c54adc5092755ee2c3da9c69f2d3ebe53c60b46863759c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011907, "uuid": "3862f8bc-25ad-4d1b-a64d-9d9c099cf3bf", "value": "T111D423A4676E1B0AD0674BF500992B71033F8E7A7432E3075EDAF1CE6749F050B91A6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011907, "uuid": "8c3ebe5f-ac38-43d1-927f-fd257b73c7aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011907, "uuid": "b8711a87-6c95-4325-bbee-8d073800639c", "value": "12288:R2N8jiZ4zypIPrtPplTY6RhKuHIAIy+rSmGiG5p7EHaFRpCM3ndnWuLM5ej3Rwcp:R2N8jiZ4zypIPrJTDEMIBrPO+aFPCOiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685011907, "uuid": "ba96118a-5f67-4086-a465-44287c3e917a", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685011907, "uuid": "9f11bbd4-7638-4a09-af4f-6e4ba3bb46e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011907, "uuid": "58438ec9-43e3-417f-b914-80d6d540c88f", "value": "Specifications LIST9QsCkNSTnyQq0NL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03b09e4-faf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685018582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018582, "uuid": "f07af52e-a407-4ca4-add1-7930a8aa067b", "comment": "Malware payload (Quakbot)", "value": "0e17927615e4d96c64b11f6dff818c40", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018582, "uuid": "48928764-8745-4d11-914c-8fad80cc9871", "comment": "Malware payload (Quakbot)", "value": "0b153476ff89790999f4de56acfbe88f88f6e27984c39a03fc8c4115e12ca670", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018582, "uuid": "319b4041-7c84-4827-a419-916519242932", "comment": "Malware payload (Quakbot)", "value": "837f60c0fc18c69e90857d3ee48b897ad23076a3", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018582, "uuid": "71d002a3-d4a7-45e4-80b3-13bc96fef409", "comment": "Malware payload (Quakbot)", "value": "242637e2068434cfb3138b9d1f68f2a53b92965e07b91af10921ced32572175b03ad1dedcd2619dacb42d8436dcad627", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018582, "uuid": "dc9c0201-44b9-4185-84fb-9904c5ddf1eb", "value": "T17363181B9385037959220224574F4BD2A7B489783E62DB64E49FC2AC3351D78D2FFAEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018582, "uuid": "912455da-8f9a-428e-9df1-c33f53e2e51e", "value": "768:N5tqaaZV/nKpCY99WBm2Zk8tKBRAR4d49KWHVL/HPsQX1ZOWn1kdW9PqBwaDV:x1abSjmm2KNTop1ZOe1zPqBwiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018582, "uuid": "f1e56e49-3243-4a60-869c-0ba7f1a00182", "value": 68045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018582, "uuid": "1e7fefc0-228e-48d2-ac4c-4c8badfebac2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018582, "uuid": "d4dca8a7-7cd2-4f64-ae61-f3528840957e", "value": "Claim_B635.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ddfde6c-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994768, "uuid": "50855987-817f-40ef-9636-2627d2775657", "comment": "Malware payload (Quakbot)", "value": "0e54d42bc271caa8035a32af9c9f9030", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994768, "uuid": "58bb08bb-c0f4-485c-b7bd-f4e7200ba909", "comment": "Malware payload (Quakbot)", "value": "0b1d8c1e7515757d7ca8a4db2ee7952ce08b8a9b88ae1a36208cc6b2ed5ecf51", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994768, "uuid": "8bc70e3a-1dc8-4f40-aa47-a0ea46dfe2c4", "comment": "Malware payload (Quakbot)", "value": "de0b0f41f8c953091d08ee864f0cfced57c7e3e0", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994768, "uuid": "f5f68bb8-304a-43a1-99f4-4059ee14000c", "comment": "Malware payload (Quakbot)", "value": "0be90a89307fff17da5ec99ccce9878876dc396868348894377e922da65eebee4d0f3f4ae6a700abba7f2d88103a74ef", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994768, "uuid": "a89a4e98-e9b4-48ce-931c-617cd7ac1f9e", "value": "T1E363086BA381133A55120214654F6BD1E77488787A62E778E48EC3AD3341D78D3BFAEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994768, "uuid": "b9b03467-3f5b-4b31-bd11-504e44048611", "value": "1536:2kTScwZO4cPj/3Rgmo6A2C1c3jW3DbJeV8KC29lDhslm/Yr:5TSnZObj/3RS52C1czObEV8K1lDylm/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994768, "uuid": "beb2b3ad-5522-4282-8bc7-b88fb9944f64", "value": 66727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994768, "uuid": "257deb48-afd3-47e3-a6fd-5fd5ecffb3f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994768, "uuid": "70748cca-c78d-422b-b3eb-8d78bf6c92d1", "value": "Claim_F560.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1d8b01-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996888, "uuid": "a5c324a9-99d8-4a29-85ab-8a5dd6c80709", "comment": "Malware payload", "value": "e80a19ac1d8ddaacad9cc5e45d51d945", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996888, "uuid": "36a5f624-b944-473a-8ea5-c7c2bf29f4f9", "comment": "Malware payload", "value": "0bd92a2d9aef5ff6d64173fce5b8c44870ce6ec0e05b8312cc8929abf1f8d964", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996888, "uuid": "ef9fd702-7be5-4d60-a6ec-75d89db1c450", "comment": "Malware payload", "value": "ca9168c1ece1f1dad2a6edcd693ac13d276ef10c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996888, "uuid": "e9ba4ce2-6ab7-43c4-a68b-eab31d6982c2", "comment": "Malware payload", "value": "8877617dacf38de4fbfb0abbe378f81d0b9701a3a56a0111effdf9af4fd1fd01351e31986aa4442c2c7786ef4a5cdb75", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996888, "uuid": "727f1770-8b66-4fa3-a2d9-25f91c461c8e", "value": "T14674A880471519A24B4B2F36A73094B5EBBE1EB8C2D8598BF46F7251FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996888, "uuid": "9b5a035d-da90-4ca4-9e26-0598d6293cf0", "value": "6144:nYuMA3W5qnReIe+RMHrFiw5sKnruVXwNJlm/of:twqkp5sq78Qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996888, "uuid": "a4ee7cb4-eeb1-4b3b-8bc4-4e9aea448a86", "value": 359944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996888, "uuid": "3a5fdcff-843c-4575-bd9b-5dc289ff103a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996888, "uuid": "49dfe96f-99ae-40ca-901a-4d0a541d1e85", "value": "inexhaust.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287574bf-fb46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685051426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051426, "uuid": "835fcf38-c15a-4c68-b7a2-d5fc70043ccf", "comment": "Malware payload (RedLineStealer)", "value": "866e65416923137a857a7eec6aae44aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051426, "uuid": "2674c693-e289-421a-9526-0d0576cbb495", "comment": "Malware payload (RedLineStealer)", "value": "0c3796b91c67ff245355317692205b21058ba69dd47ffa329373f35c452f277f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051426, "uuid": "c9cf5a8d-e26e-48c0-a953-df2b7f7d35ca", "comment": "Malware payload (RedLineStealer)", "value": "6a63da4288b568fb1ac8014157be17e625588b52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051426, "uuid": "2f7b887e-425b-47d3-8edc-87a194d69d4c", "comment": "Malware payload (RedLineStealer)", "value": "91fccd631148a6c34beb18fa9d5c471ab9ea9643b9f5a552e89cbd5c2cd92187b72263021046e91f5af26c245f7c4a91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051426, "uuid": "ba8a2129-727a-4fb5-ad50-500ac8aa6929", "value": "T116F4224379C88072DCB117744DF6138B0736FDF19DB9D2AB1746AA8D2DB22A49431B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051426, "uuid": "d0fc4ccd-1683-4afc-9f3c-8823fd57af0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051426, "uuid": "31a0e235-5741-4fd5-862e-e6bde32e26c2", "value": "12288:MMrKy905RHZIlbO62jZPyx0jZ6s6+Ln8COr1S97m5iGsRsw76XXeVXvGkB7VnM88:OyUalbj2jZPy2jZLL9OrcX76neNukZVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685051426, "uuid": "7146726c-748f-463b-98d0-5f33dee812b0", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685051426, "uuid": "15a96a6e-ae34-47c3-b761-5b60ffa0b062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051426, "uuid": "4ac21583-7c31-47d4-aedf-aee5609061b0", "value": "866e65416923137a857a7eec6aae44aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff5bb1d-faa6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1684983014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684983014, "uuid": "cdb49004-e801-4776-82be-952e1ce60fe7", "comment": "Malware payload (AveMariaRAT)", "value": "00d1ab5309b9fa1fd4a03ee45cf68b7c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684983014, "uuid": "70c01fde-36da-4f3d-9ef7-25c8455b53c2", "comment": "Malware payload (AveMariaRAT)", "value": "0c79b94bb739d4770b3fc803a83dffeea129db0b293b4ff5ca923fc5597785a4", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684983014, "uuid": "2c909762-8274-4a29-afcd-75d9a05b9a1c", "comment": "Malware payload (AveMariaRAT)", "value": "a42e1cbb962f50e08d65bc4720d343da917324ce", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684983014, "uuid": "f4de26e6-a11c-4330-afa6-6ccb79ce6af9", "comment": "Malware payload (AveMariaRAT)", "value": "a6b8b4a1d1ec51b9f9b41e13e7ec8e7f328b3469cca55ed7f3b923ff6eefbb3ead08f83dbb83fb6861ee1c2a6c7ceea1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684983014, "uuid": "63739939-e081-4f02-a3e5-6186dc49d8bf", "value": "T181E302205769D6BBD5720B726F7E939F7BDAD62668A1974F233007943B31900CA0E372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684983014, "uuid": "87ba6d71-3211-430a-8479-f58d5c204b79", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684983014, "uuid": "72a503f8-0ae0-465e-923d-04b61bed004f", "value": "3072:3fY/TU9fE9PEtu6xbXI5XYXsjQeNYGGzzfbe1IKKbpSjfxCcY4e/75XBhsFJzb78:vYa6cIYXsjQeNYGGnbelcpOxCcLS9xhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684983014, "uuid": "b50f44f4-72d6-4f75-ba52-1fca66de96fb", "value": 154190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684983014, "uuid": "2dd54fb0-1a13-4601-b3d5-9dce50119686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684983014, "uuid": "eab6b925-06e0-4c04-b7c9-81b032919fec", "value": "00d1ab5309b9fa1fd4a03ee45cf68b7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c261ab-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994802, "uuid": "185a8315-e044-4033-833a-9da8373fc35f", "comment": "Malware payload (Quakbot)", "value": "f3b8c40382b385ea7b3ea93f720de958", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994802, "uuid": "ebb9b8d1-0beb-4652-96ca-ceaf8ddbfdb0", "comment": "Malware payload (Quakbot)", "value": "0cc1eb033e512a69085deaa66be8e5499313cda286687c08f417051a3dbb6750", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994802, "uuid": "4c38740a-24bf-43a0-b8de-ca69ef935693", "comment": "Malware payload (Quakbot)", "value": "9f2bab5a556fdd8fef4e83043e42870f52a8e34d", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994802, "uuid": "dc2e8da0-e569-454c-9bd6-bc8a80d9490c", "comment": "Malware payload (Quakbot)", "value": "fee3aaf242343443acad4f3070cb8955d7a95974ccacac917ab161212171458952f77f9779b8b9f7e1abea39b74b671f", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994802, "uuid": "a2d304a3-2809-490c-9e2c-dd6231ebef08", "value": "T146731A6FA38113396A210236654E57D1EBE148787A31DB34A84EC36D3321D78D6BE5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994802, "uuid": "1f2ef71a-fb13-4ef4-a8a5-d9551210a0b4", "value": "1536:eU8nC2AGFcMmWMqqpDFzXS5KZOVCW1ZOVq5wLoY:OC2LMrBU5KZO11ZOawMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994802, "uuid": "6551f48b-639f-48db-9b88-67473f964d63", "value": 77405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994802, "uuid": "32391c98-30b2-47b8-9502-8da9da81ff52", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994802, "uuid": "54f00eb1-f147-45b0-ae98-cd9d8625b5f5", "value": "Claim_A538.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4f8806-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997777, "uuid": "5f45928f-e0d3-43ff-aa2f-4604b6357b06", "comment": "Malware payload", "value": "09cc3692cb3e4a3451aeea5738541c53", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997777, "uuid": "503e7a1e-25f9-40b0-b801-da97863dee77", "comment": "Malware payload", "value": "0de34744451ce4c0fe4331a0b2b067bc69b4f161062120a72c615e919ed00535", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997777, "uuid": "5b259a84-ff0f-4baa-b79b-2e6f7e6d4f2c", "comment": "Malware payload", "value": "cdb9f921c459887517e053e7bb2c6430c37a40d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997777, "uuid": "0d72dd25-7101-443f-af5b-18ad43a47998", "comment": "Malware payload", "value": "42a8a0d6e148c319bac8c850548724ac275fe241a2d7127962bfdeb2f7a6df3e27dbb471534f6bcb811cc8ccbdacc15c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997777, "uuid": "3a0d9650-5f0d-42f8-8f3f-f5a9c897c3a9", "value": "T16654C784472228A24B4B2F36B72494B9EBAE1E79C2D4558FF45F7250FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997777, "uuid": "b586509d-dfd8-4881-b530-ebdc1201984f", "value": "6144:LCRsbKppwgKHnLIPeW1aHWzZBRAJ52SW1UfVTtTk+IcARhIyKCJPjyHC+61gaNEk:GaHY/RSc/hJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997777, "uuid": "964ab50c-c92b-4935-b5ea-41989ee37fb5", "value": 301358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997777, "uuid": "1224290a-2aae-476b-a248-1f7352735b37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997777, "uuid": "c8193211-0038-4617-a596-1d64e32f71fa", "value": "Prevalidity.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7a3ea5-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997046, "uuid": "754c68ea-6dab-4c88-b17c-4c1d05786d43", "comment": "Malware payload", "value": "8974b387b13d810b06617b7c8d2f7e21", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997046, "uuid": "09045768-957b-4d92-b407-dce9fd41f411", "comment": "Malware payload", "value": "0e273d366cbb6f7c28d59cb879322c4cf93d500369d0566dc024ce75a42dbcf0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997046, "uuid": "48dc50dd-45e8-4f17-a36b-60e87e488e00", "comment": "Malware payload", "value": "4c00bfd6c9963346db91a348d4383009e17c0160", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997046, "uuid": "55d3b840-e388-4c45-8825-972e6a2fe1ea", "comment": "Malware payload", "value": "9637c8ae59c29fb96884058e564a51e6156f7d68d07272ed9fc7cd4cc08f5d06cb6a3bc32f06d87a6ebac25cb6cd1fd9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997046, "uuid": "e9f61d2d-d954-4223-aa17-7b4cc4d501c5", "value": "T121648740472518A64B4B6F36A73054B1EBBE1EB9C2D8588BF46FB251FBDE54CC8D1322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997046, "uuid": "419bf36c-28d6-46f4-aa7c-76d4f406df7d", "value": "6144:THROOwpA8Z6GdaTpWZoPmvQXkgA6YdggumDH:Tb0iU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997046, "uuid": "723f2549-e21f-4509-8c39-396b8388f208", "value": 308612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997046, "uuid": "209b3bbb-615f-4fd4-9b7f-351ab65272df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997046, "uuid": "df2e6959-b8d6-4b6d-9404-8cfcbc36d360", "value": "nonobstetricall.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275b9db5-fb0f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685027802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027802, "uuid": "8e3e9dbb-a117-4490-bf9f-18c5cf942ef1", "comment": "Malware payload (AgentTesla)", "value": "3e7748c53adbbdc9737bc52cd96c8a66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027802, "uuid": "3f6cc301-cfd2-4152-adb3-2a9d4e32da43", "comment": "Malware payload (AgentTesla)", "value": "0e6633487cfd9697135ab20efdfa81fcafacef20596802e90360255ed226b5c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027802, "uuid": "5716cc29-9121-4673-80d6-ae704b5f05a0", "comment": "Malware payload (AgentTesla)", "value": "2beb8bfeea9e298266c9dc6859393d71cb295cb2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027802, "uuid": "cc3ac66d-ebec-4ebd-9343-9875416457fa", "comment": "Malware payload (AgentTesla)", "value": "b4a0d1ce4b1a5e06790ff9b97b02b7a08f07c245ddd52130b297b78627de2587df0be2e89114afc2cd91aefd3ffa3f8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027802, "uuid": "2b455c08-5633-4eff-988e-a25a163bd737", "value": "T13EE4E14757D49F94F93F62766AF038508AF2BCCE48B0CA2D4EA0B4F96D717801A85772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027802, "uuid": "084b6f23-0052-4b79-9372-71fb6e400ac8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027802, "uuid": "c43cdbd1-6095-4408-9198-a95e73a6f0e2", "value": "12288:5rjM5uxjcrWsUPEfIifqe8ES2FTL/Au1o+WWjQkwHntu:5r0w2IPEIbi1BXjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685027802, "uuid": "a4cf542f-5967-4e9c-b70a-135a57ab94b9", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685027802, "uuid": "e64cf5e0-922f-41f3-96a8-d0b91044fec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027802, "uuid": "bbf0b68e-4da8-4e9d-9ced-e5ffe71a729e", "value": "SA-282339442023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5285a163-facf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685000386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000386, "uuid": "96da6143-9252-4e0a-bb20-17dd57dbbd3d", "comment": "Malware payload (Smoke Loader)", "value": "8c90e327de7b8303f362152068cbf7d4", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000386, "uuid": "a2aa1314-4d2b-44a7-b111-93ea294be12e", "comment": "Malware payload (Smoke Loader)", "value": "0efc49b3bae8a8c4c6b6e66c074a7527f371adaeb4891fdffa1b6692971508ea", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000386, "uuid": "48d6e1f9-99e1-435e-8e2e-8b4a4a412f55", "comment": "Malware payload (Smoke Loader)", "value": "2952d25f3c1c36a4e7304adfd7916c27d72d8da9", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000386, "uuid": "6c98521a-ccfc-419f-9859-cbcd8b712363", "comment": "Malware payload (Smoke Loader)", "value": "f7e7631c53441d8861c00f19179d11e8cfa8283d9f0285b2dfff440b218bb30dc777a3110b9fedb7a80fd40cbbf91fb6", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000386, "uuid": "cf7f752c-881d-4e8d-91b2-67e0735ce4f5", "value": "T15444BD127291D072E1922A359971C7B54FB7FCF28B2196CB37943A3E5E346C08A78B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000386, "uuid": "8d819acc-0c5b-4bfc-8711-0ad510366f06", "value": "761a416c92dda0b5d3a5091999204e5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000386, "uuid": "224bc274-6ada-461c-971f-075bd148936f", "value": "3072:O2G9+ueF4U5zQY2kP5hZIok07G5FqPuOhshjhS7QBATILYeN8pCnd8:fGsIU5zD5hEEG5Fq2NzUOATkjNTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685000386, "uuid": "ce9cef2b-8dda-405d-bdbb-d5f8dcc6582e", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685000386, "uuid": "8987f9be-2589-4fed-b678-1b80c49476b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000386, "uuid": "5bbda304-4a1b-461a-b090-5d8c7423f855", "value": "M7R70022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea77a362-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997205, "uuid": "2ea6be40-3c6e-41b7-a5ca-4a5f3d7f5236", "comment": "Malware payload", "value": "732b60c675b7f4d6fb63a22e5b416839", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997205, "uuid": "077aeaef-d660-4684-871e-e94955a28407", "comment": "Malware payload", "value": "109afe0a6144e8136e7b0502fc477bfb2c64c9df3419b9953c968f0feb21e5b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997205, "uuid": "f9321714-2251-4233-83c7-4dd0dcd4477b", "comment": "Malware payload", "value": "c7ff9017d366b9021fcba93be4109d1612bbf708", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997205, "uuid": "f66dbefe-a819-4a69-9fc5-7e7a0f7e4a1d", "comment": "Malware payload", "value": "75f0f214345617f78e166fbd4429e5bf47df7ead67153df20e8bc0dda1ef8de5133dd1e4a0502d8b23e3922f8cfe4cb5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997205, "uuid": "a71c2a7d-b402-466a-bded-485ae53ad21d", "value": "T14D6477844B1118A64B5B7E32B720A4B9EBBE1E74C2D4468BF46F7260F7DF94CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997205, "uuid": "b293bd3f-3dba-46bb-a799-97d807748144", "value": "3072:ylDoQdMySclRdZ1a6LCanTqXMmh/McKJr/OG0ICLGzizYoAolO:ytofcndH1fTqcmh/Or/uIR6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997205, "uuid": "9acf1f5f-65ca-4563-bf49-eba95ff3cc24", "value": 333219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997205, "uuid": "2d320f3b-7e41-44e6-b6b9-a991f4adced3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997205, "uuid": "7b6cc01e-d9f6-425f-9385-8aba9029af04", "value": "lucific.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83bd965-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999698, "uuid": "bd058cbb-148b-428a-9c28-5057886765ac", "comment": "Malware payload", "value": "2854836e0a89b57ad564a6a94e535258", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999698, "uuid": "4b315fa4-02cc-483c-aefc-5ca7f2dbae3f", "comment": "Malware payload", "value": "10aec788152bd744d431e8e2ed97ebc2b589507f9002ddd2c3f0277be7b6203c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999698, "uuid": "2dc3533d-ad72-4bd3-b4b9-c345b962a36f", "comment": "Malware payload", "value": "fd20fc04323984d7bcc0176b4df5fe4cbdff19d2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999698, "uuid": "55374614-36a3-4775-b58a-a41aa5f52f1c", "comment": "Malware payload", "value": "ce561ad296cc661e7c7963a153add671fe7e1e7c26dce5200f05a85515edfbb6e2b1279467c79a41c7acc03b558d9cc8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999698, "uuid": "285ac8c4-3be3-4d20-85c3-e873f452f0db", "value": "T1BF549581475528B24B4B3F26A73094B5DABE1EB8C2C8598BF46F7250FBDE58CC8D1721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999698, "uuid": "26473057-61d4-4e02-b7aa-3360c6217559", "value": "6144:5ldgxb7uWBPPLMDhya94j1vlQeLYMjcmJ:TdgLtDxtus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999698, "uuid": "d8ed636f-e7f6-440b-828f-8e10d558c816", "value": 294814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999698, "uuid": "6565532f-d02c-42e7-bfee-901fbec884c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999698, "uuid": "9e6c60b6-650d-41e0-9e29-fc936dc594e3", "value": "deerskin.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21b05d7-fb01-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Pikabot)", "timestamp": 1685021995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021995, "uuid": "e03165a0-fc3b-4ee4-b95a-88b7d82a0ed4", "comment": "Malware payload (Pikabot)", "value": "446b0969676e89059e1c4890687e7901", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021995, "uuid": "c21afec1-31e8-4c7a-8909-0aa2692d9da1", "comment": "Malware payload (Pikabot)", "value": "10bd91ba36cabea0d4a6f09b7ca380681c62b73e5dc01ad02cfbacfb0a2a6eb7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021995, "uuid": "ca7479ef-1afd-4de2-8e98-0f84b62a91c3", "comment": "Malware payload (Pikabot)", "value": "6b28f558471f5ee4f305e2772742bfede49580eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021995, "uuid": "fe4250a3-f04b-4847-bc69-5872cbd8f038", "comment": "Malware payload (Pikabot)", "value": "74a6b6248dedcdeb7a96850077a2993d614e1a6d7d79d42a2662b6de58d5bd9518606aa0872c7184a839d125ff412ccb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021995, "uuid": "c6b6d4dd-affd-40ff-8215-466f39bdc0fd", "value": "T14C24C7804B6514724B577E2A6B30A4A6DBBE0E3582CD5A8BF45F7260F7DE68CCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021995, "uuid": "42dd338e-71f1-4b90-9307-603b0eb0acc5", "value": "3072:sXEVmrr4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:GEVRDqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685021995, "uuid": "24236b02-f6fa-4dc7-9b0c-f1530cfb50a5", "value": 209785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685021995, "uuid": "81493fe2-67e7-4e8b-905e-c6d9a45cdd95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021995, "uuid": "8c0f084a-6ba2-4621-8a54-419dd0914196", "value": "Uqrpron.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5f89d0-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1685003728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003728, "uuid": "4ef509c7-5212-4e86-994b-9f1a60538ea4", "comment": "Malware payload (GuLoader)", "value": "eac6a746b06bbf4734d031003e201e51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003728, "uuid": "ac264fe7-961e-4273-a2bc-e5fcd99d458c", "comment": "Malware payload (GuLoader)", "value": "10d9cfb99d393c5a42e499dbf19a65e4b8f696e9802a0da2d66fa20e84eb4b34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003728, "uuid": "8d4cf2b3-1320-4b37-80ed-c6dba5816500", "comment": "Malware payload (GuLoader)", "value": "300d3ef673d0047fc45035c73b2312ab6967466d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003728, "uuid": "ce2e3ea7-edf7-4056-b06b-088ed7065d36", "comment": "Malware payload (GuLoader)", "value": "d8625bb99eb420f43d531370dec8a795cb7714dae2ffefffed85802e2512ec81ab2d51ab4907e05cb10e01809091fa1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003728, "uuid": "b0084113-382f-4717-9af6-eb7671dbc05e", "value": "T1F6846BA238CA65AFDD2F4678035FEAB22B795CE07391496E5F40320D5C3654A80EEDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003728, "uuid": "863e15bb-5f1e-429d-a5fa-b556c45271a0", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003728, "uuid": "c21f069e-d581-4be8-9bd5-1021d9816cc8", "value": "6144:7hRbPZVheNA+ff0qQATqnqa09nc10KAxQvno5uZ:lBnhe2erv2uh5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003728, "uuid": "d6c2fdc2-9ce5-472c-b17a-cf678beec3e5", "value": 394963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003728, "uuid": "02bd6c3f-475c-4fa9-8d31-9c87f9cac5ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003728, "uuid": "2be7187d-4a97-4a5c-8a31-7f014d7541b9", "value": "Justificante_operacionpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179a487b-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685003723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003723, "uuid": "3348aa4b-05b4-41cb-a756-4232fd756941", "comment": "Malware payload", "value": "fc6483684671c32319b8f891b0afb86a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003723, "uuid": "6aa8991f-e993-4a97-ac1c-34bf7928e1a4", "comment": "Malware payload", "value": "11271eb070732c30480b841ccc2eb6a08fdfdd573f573072b9d9d148719694a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003723, "uuid": "d8fded27-a114-4ff1-8c48-8e134db88815", "comment": "Malware payload", "value": "c1d7d88e1f09d7e7889bf0c6440b9fff7340591f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003723, "uuid": "8041c1ac-99d7-4be9-847e-0d7ceaa4a009", "comment": "Malware payload", "value": "da640835602e9fcf1ae45f6439ad438d730697554d549d8ab1d53f2cf1037ca2fc39f6efbfeaab5761bbb2f0ab1c3dac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003723, "uuid": "e47cc69e-9ef4-426a-ab48-5644db5d7b93", "value": "T13122E821775CC973CB390BB6445392810336EA5A5062CBAD9C8D41BE8EE371546F27AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003723, "uuid": "f23bc694-785f-4b9e-b4b3-35e85691cff2", "value": "192:alu2Rquw1Kffff4YGJAlKpKpRKKyFSgiLnnMmUNKFXm5LRLyL7L8LW8WfnhPL:aN42ffff4YQFSgiLnnMZNMXm5LRLyL7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003723, "uuid": "ef136896-f4b7-4e14-9c61-fa589fa819f4", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003723, "uuid": "cda06e4e-a510-4c62-b144-1c2598c327d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003723, "uuid": "d4d9c3ad-50ce-49b4-936f-4eb695ed2c44", "value": "IMAGE 29837.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f96af34-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997912, "uuid": "937a5ea1-2e41-4fe1-9899-83b88b7158f3", "comment": "Malware payload", "value": "0a61b41fbcad2680d29eaf8783e05587", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997912, "uuid": "d61df053-35bc-4e63-a28e-f3bff335e661", "comment": "Malware payload", "value": "117a367b22c5441a902f3c12765bd4330bb60c336dd09c68d11be538aaa348a6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997912, "uuid": "7c896785-1313-4173-9943-d0588d33119e", "comment": "Malware payload", "value": "e053a2c3c4b2a302a3202109bc6da522a25a02e2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997912, "uuid": "94890e55-1380-4aa7-a0e1-669991ecce9c", "comment": "Malware payload", "value": "6b928e2bb72ba44ee6dfa9afcb78831ae0656aebf4434291d04187a6d6ca48653e1e9eeccff916df35d702628d89de0c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997912, "uuid": "cc1e1f50-bf64-4be4-83c6-f9eadb2bfda2", "value": "T11D54A880471528A24B5B2F26A73064B5EBBE1EB8C2D4598FF46F7250FBDF94CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997912, "uuid": "72326dda-0f0e-4f55-81a9-9f32a2ba0104", "value": "6144:UvV52cJLCMKxkfi5H8DXIzE1FcIoG/Hoi:wAqNj8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997912, "uuid": "56053292-750f-418b-8972-bc14b2e66d47", "value": 300006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997912, "uuid": "38365415-dd24-4594-b433-647ca829ae96", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997912, "uuid": "34fc8537-684e-43b2-9ae4-1275a4f447b1", "value": "SkyrocketAntipa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8e4f56-fae5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BlackNET)", "timestamp": 1685010015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010015, "uuid": "c1ae88b2-8413-452b-a9aa-e653fdb34a6f", "comment": "Malware payload (BlackNET)", "value": "964a8c4317b2449ce3b1ba42806e00ff", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010015, "uuid": "a167dc21-4d4a-4c24-9fff-e87a7e2a6b54", "comment": "Malware payload (BlackNET)", "value": "12acc28c683190195fccfea230f47491c084d01f5d5fa975ba82135e1d0c8fa7", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010015, "uuid": "8ed69137-380a-44f9-a03f-772c25d033cd", "comment": "Malware payload (BlackNET)", "value": "1bc9d7cc8dff6a6d3e9c46ff1c9966521e012b38", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010015, "uuid": "fc0b23aa-a235-4bd9-9aa8-a7fa776025f3", "comment": "Malware payload (BlackNET)", "value": "93935416c459ad251e49a6cf09699bbd67f36cf66f39e259aaed332c8c1d8709e7e9f0f7975ad1c6a8d2dc6b9f53dd39", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010015, "uuid": "2902c1c4-6f24-4646-bb84-513f02d04dff", "value": "T11384017A6B89AF16ED29433A00E165569FA1F166B52BD38F24C42C373D1F3C74E25883", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010015, "uuid": "e4ebe5b0-dd57-48dd-8fe0-966630fe2961", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010015, "uuid": "fefb15bd-1611-4032-97d1-a3948de65e99", "value": "12288:NozV+S8l6vJGRaIUyVVtERhJhY0YO60nz:Na+S3MMDJXeQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685010015, "uuid": "0cca7e62-1103-491e-bc4d-4fa8c431f392", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685010015, "uuid": "416d9f6a-90b9-4c27-b39c-d9580da7c59a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010015, "uuid": "cec333ae-5730-45b3-a316-ac4349b90f3f", "value": "dadsroots.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420751ad-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997782, "uuid": "e307a6a2-8326-44ce-a075-07fca92bc72b", "comment": "Malware payload", "value": "f9abc8f7a2c9b70558683a7f06ac596e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997782, "uuid": "62629c4f-1988-4a81-973a-3d5407bf8009", "comment": "Malware payload", "value": "12af8542e2ae46d2b8559906880940b95620cfdf8b2f0f00ad97e25cde4d6a77", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997782, "uuid": "5548ea12-158b-4d92-abbd-560dde5c9bd0", "comment": "Malware payload", "value": "db3d8d2e07bcb45d312400ec43e3f01e0e2b36f2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997782, "uuid": "5df51f9f-82f3-4c0d-94d3-edfb99a88edb", "comment": "Malware payload", "value": "a6c6aa21423cf94e8e6be9d6688acc5dbc02ebccec53be26077270ae7e8247c58bb8cdf3d79a6376abe5fe785033cd92", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997782, "uuid": "052138f4-e131-4415-84f2-0b474f7ea229", "value": "T1DD6476804B5528B64B4B7E267730A4A5EBBD1E74C2C85A8BF45F3261F7DE98CCCC1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997782, "uuid": "ce0592fa-9333-46ca-bfd3-121ac80c08a6", "value": "3072:wfIM25HexqDsqSmnxaM90RGvOGO4oBAxZ5qxUjX1DataSchFYuRwUJ+q:R5esDsqNnUy0RcOGO4dywXAtGhFYjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997782, "uuid": "e251eb64-4ce4-4d44-abf3-717c78964566", "value": 308650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997782, "uuid": "c3bf6a17-4b05-48a4-a27c-0e74a6dcb102", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997782, "uuid": "1c285ac5-9db8-4675-86ad-a5e5c73cf482", "value": "ProfanationColo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d9079c-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994760, "uuid": "50be68ef-4643-4b5e-bb1f-434fbbb7ea59", "comment": "Malware payload (Quakbot)", "value": "657e2a137d0f2f33660ac18218cd4b34", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994760, "uuid": "8782834d-8236-4228-8635-858d1d82fac6", "comment": "Malware payload (Quakbot)", "value": "132226d3deda816c4fb92c9809c817cd26f387369145f488e3f60da7ef5573ba", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994760, "uuid": "6facc8fa-6497-42d0-b865-d4a7a0b7b52f", "comment": "Malware payload (Quakbot)", "value": "9fbb3d2624b532fb8a1213a647b815c41b2bd025", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994760, "uuid": "92ef2ce3-c434-47ff-b7e5-a2417bf440a5", "comment": "Malware payload (Quakbot)", "value": "306e827666f3c6c8b8ff9ee8428f3efae3af1a82c8a742aa1cd06482289e261854dffb839b7a0a782f7535b8cd3e03e4", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994760, "uuid": "ad33fb80-cf85-48ad-ac40-0e0c6ade46fc", "value": "T17B63299FA3801338A9610265254F56D1F7A188387A61DF78B84EC7AC3311E79C6FE5EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994760, "uuid": "854d0c2f-07ae-45d5-b180-fe5becacac03", "value": "1536:xwijchj/tQlao/RHHHHHHoJvkd4mmOfqcD0uUnQYBltI:xw7j/tQ8yHHHHHHmkdhCi0dnRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994760, "uuid": "a26ec9e2-8b4e-40a4-8748-57189c836a00", "value": 68825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994760, "uuid": "a1047319-ff82-4bae-8c48-c340aa2b2e6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994760, "uuid": "3499955e-79ff-4430-aa72-6e77f47b42a1", "value": "Claim_F845.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d189a0f0-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998022, "uuid": "dbfb474e-aadb-43a1-8118-dbf919851ed6", "comment": "Malware payload", "value": "f8772a4701b04637fba5f1a004df84f4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998022, "uuid": "d9c3044a-51e5-4ab6-b592-389ef93563af", "comment": "Malware payload", "value": "13497a4f48b444ec59809b821b11bd87c3b306b90ed37600ea0d0daadd12a2c6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998022, "uuid": "b2532cf5-5a48-4866-a70a-4b18110a94c5", "comment": "Malware payload", "value": "5d578002e9c0df7ccc567e5e50d10adb80a32544", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998022, "uuid": "690c0f37-214f-4384-9567-c4a839c925c7", "comment": "Malware payload", "value": "34f06dd88cca78d414a13892145c49dd7c474a0a6e2e887297680cf0b268a1143c363c3fbc3441042512509bf2f5f7ad", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998022, "uuid": "7b7382d4-de6b-4872-88db-8bec39acf639", "value": "T1084498804B5114B64B5B7E266730A4A5EBBE1E74C2C8568BF46F3250FBDEA8CCCD1721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998022, "uuid": "b0da76e1-2b1b-45c4-b9a9-fa757b4ed730", "value": "3072:00rvMPmHgY80TtwN0yCyNNl7OQL1XkF3fyRB8bw:0gvFHgY80Tq0y9Nl7OhJymw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998022, "uuid": "2461ed5e-9a1d-44e1-b2ca-4f1084f2d08b", "value": 263016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998022, "uuid": "0a01d33a-4851-4285-8350-acd1f84bac6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998022, "uuid": "4d4824d8-486e-4e9c-a967-7eb484af61a9", "value": "TrepanningPrece.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef070ae-faf2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685015332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015332, "uuid": "25e29cb2-26e8-482c-ac60-ed247bdf1af1", "comment": "Malware payload (RedLineStealer)", "value": "67df70fc352474d6cd7c205c157b82b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015332, "uuid": "8083d322-60c6-46cb-abab-5e75dd3de3fe", "comment": "Malware payload (RedLineStealer)", "value": "135aebf6e9b04b84e7df28a37fcd1b7367be6e9d1f34e0b9fe6eac3e3ca6ebf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015332, "uuid": "bd6d6291-796a-4503-851e-4e46d6dcf02d", "comment": "Malware payload (RedLineStealer)", "value": "f34f9362a3814f6755fe061411f6732e0b897164", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015332, "uuid": "c92d9325-02b5-4377-ba76-fecec85b2a2d", "comment": "Malware payload (RedLineStealer)", "value": "36a9fedae7f021008ba6af4456114abc0662ac6bbc70d1f6d4e867f9bb54a6e1e60aaefbe1759afbca1046f38f514453", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015332, "uuid": "9a427d7d-6d47-4c54-9dae-a241abced246", "value": "T1F6352302EAEC4123CDB66BB46DFA13C71F3B7CD10EF447AB17489949ADA14C5683136A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015332, "uuid": "5a5eac61-2d6f-42f5-8731-0e5c30bd9ddd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015332, "uuid": "d88ee9f6-422d-4bf4-9161-f4154aa1359a", "value": "24576:6yroXHam/nR13MhvwECuNYIOgD59nf/V+qIt+0RfFA:BcXHainPchbgq9nhIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685015332, "uuid": "40eca617-c64c-4ff7-95a9-6da73005899c", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685015332, "uuid": "84b16512-e3db-47bb-a24f-56500148ade1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015332, "uuid": "c65db1aa-813f-4950-b4c0-ba7eeb26bd2c", "value": "67df70fc352474d6cd7c205c157b82b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a81674-fafe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685020543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020543, "uuid": "223cfecb-5a5a-411a-87ca-cb9f05724fe9", "comment": "Malware payload (Amadey)", "value": "2dd1b3b1cfdeccd32214c342b5b2cd65", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020543, "uuid": "d215d62a-9c6f-462a-b332-98c89568a5da", "comment": "Malware payload (Amadey)", "value": "1386768dbc8f1da26d835b6c104c2baf49fba33638e9bb1a0d493d8615af46d1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020543, "uuid": "4e6ac98d-b6a2-4d39-8833-d60a986c1ef3", "comment": "Malware payload (Amadey)", "value": "20f546224bd53947f0525c5ed05c0a22ed00e4d8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020543, "uuid": "771fac0b-d791-4f5d-ac3f-7e926d09e972", "comment": "Malware payload (Amadey)", "value": "238e2fe937ed70696435f4b5016e07da4ef3b3c79bff67a346ab09b49f9358ce870ebb6e0973437cac0c12fc9b65ef6a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020543, "uuid": "8fc9c9ae-d80a-4c7d-8364-90fcdd1248ee", "value": "T1A0548E1273E1AC70E5225A318E3AC6F96B2EFCA18F5566DB33446E2F0D701E1D672742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020543, "uuid": "9252e777-b5f6-4117-aab7-192b2233b576", "value": "8522dc5d9d6a2a97002c24ca5ed58b85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020543, "uuid": "f91c8103-cfac-4f05-b430-5a6f40fa0a5a", "value": "3072:f5dI7no9Tc6sySnMzab0TwAmIiMwKvK/PtAkcRzEVHQtffI0OhUFO:fnyeTc6saG4sAmIxwkymkNKI0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020543, "uuid": "36d282bc-59fc-4ee6-bb8e-afd9750ccefb", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020543, "uuid": "dc2c6dec-4b40-435c-aa54-38ea794b2dbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020543, "uuid": "13a6caf4-b02f-40ee-8c2a-a311e63f781a", "value": "01609399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b986ef2-fb14-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685030010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030010, "uuid": "3799355d-27e9-4f91-848d-e491bd55c414", "comment": "Malware payload (AgentTesla)", "value": "63122b18ce137173e64927ae799c6b4a", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030010, "uuid": "3615d8bb-4044-42a9-ae06-fedf184b0a08", "comment": "Malware payload (AgentTesla)", "value": "139108c63c1c7cddfa8ab353bfd2c9540349be90d4e8ec1f4c21249ed57ec109", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030010, "uuid": "7eff0ee7-ae55-4718-9c9e-f0aef8cbc08a", "comment": "Malware payload (AgentTesla)", "value": "2bc597e49eefd5bea9606aa357fa1325ac6be58e", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030010, "uuid": "729893c7-dea9-435a-acef-775e30e3815e", "comment": "Malware payload (AgentTesla)", "value": "8d4a0944799ede3a84d1595135e83fa15b42ffcfa843db0a69c93df5d0a84d44db3221da95c6940a9fe67d2a1c6fd6a1", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030010, "uuid": "2d3c0884-b033-4f70-9acc-27217b106edc", "value": "T1C715ADEC361075DFC91BCE76CA982C74AA20647BA30BD243942315DDAA0DA97DF142F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030010, "uuid": "c3d740af-75bf-4109-97f8-11da0329eefa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030010, "uuid": "bb09cf8b-6e88-4472-929d-3fb61328bab5", "value": "12288:6NZ1tGazZBEP85peQgLRa83AH6s94BRu/J4GVpUhJZ0S5kRUXR9LQoiIMv:Wl9BEP8qtF13AH6/vkUh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685030010, "uuid": "5582371d-e280-41be-89bf-912ecb0bb409", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685030010, "uuid": "8825e4e6-423e-4da2-a0f2-3e8cd0236ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030010, "uuid": "c0c18a2f-c353-48ab-8dd6-2d24b8b67969", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e174dee-faca-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998178, "uuid": "9a45a72e-8b31-4d9d-b386-b3d79ad14d43", "comment": "Malware payload", "value": "eb009249d1ed0c37e0217115b087cb5b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998178, "uuid": "e0265b51-c8dd-447c-84d6-61d2b6f6f9b7", "comment": "Malware payload", "value": "147bb3fb4ac46df534764505e6833f25ea60246ac98dbd6c16061ca2f0e26fc0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998178, "uuid": "b0c7bb3d-aaab-4a14-b9ee-4429b757ad75", "comment": "Malware payload", "value": "7c4b4e2ad59a6f047b8729fa2af1ad52ff0f98b1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998178, "uuid": "c0380736-0b67-4746-8950-a596ea796be5", "comment": "Malware payload", "value": "85b55d2021c3bd734b3d7bd61fed5cc5b97c61eac36a00022f344486d5476e735bed9b710886b90a6c95f31ff1ee9865", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998178, "uuid": "959e22e1-f190-4526-ae1b-0074c10953ce", "value": "T11E447580475118A24B5B3F32B730A4A5EBBE1E79C2C8598BF45F7261FBDE94CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998178, "uuid": "acd9322d-2297-4309-bed7-edd0d007b487", "value": "3072:LGtPpNrOyUUn4cZt1qguAWmBJyiyocdIlVhaiKQkdk7BN2EIC974txhE/1:L07i5U4Kqguv8Q4kiHS6T7I1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998178, "uuid": "39b3c41a-d70b-424d-8c63-334b3ec2233d", "value": 277688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998178, "uuid": "041dd29c-aa53-4e87-99f9-788e49fc6987", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998178, "uuid": "b24b1ac1-273c-4f28-af58-4b0163feb076", "value": "Unelapsed.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb090779-fb18-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685031915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031915, "uuid": "1facd34a-886f-4dc6-86b2-6b3d073fbe22", "comment": "Malware payload (RedLineStealer)", "value": "3c764f2678ac610eefb80c7c17a08d3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031915, "uuid": "c6a58bcb-f2d8-4e40-a013-adaba1b7bcae", "comment": "Malware payload (RedLineStealer)", "value": "1484d62d930b194a9c46779e4e6619b75118dec1aaa02eb9132aab31666ce562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031915, "uuid": "15f1c75a-9f57-4d29-81dd-bc474bcf691e", "comment": "Malware payload (RedLineStealer)", "value": "8ac189c11239a65e407245cc2f2f0d6965ecf4e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031915, "uuid": "6c464c47-9b0d-4c5b-bae4-7cbf728fc495", "comment": "Malware payload (RedLineStealer)", "value": "0e4c8506b9a691f9a369cb9d23a5e23db08c580d7a01bd03716f479b3859bae01385454f8021bc78af476295b58bac07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031915, "uuid": "f4cf343b-3d7e-48ba-a419-f0f9d843f3a9", "value": "T1D1F41253EAE48032ECB157B059F716C70A35BD509D75C2AB134AEE0F08B3598A97237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031915, "uuid": "5959fe6e-0111-4605-b75c-c24187eb907a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031915, "uuid": "ea1808ce-2fd9-4624-bc0c-cf9b9b636cfb", "value": "12288:LMrhy90NXG53PWWRqFg5f0dv0dZTlwTa0tcpI+ufmC9dj3+Q+fGav22bWGEvCM:6y5Cg5a0dZJ0epseIj3j+ez2bO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685031915, "uuid": "883012c0-c202-4f7e-bb8d-d98c4f04f1ef", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685031915, "uuid": "0b302e0b-42b9-4f7c-97b7-47c75f5e98b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031915, "uuid": "48274f0c-a215-4255-9af4-e81a6b575f8b", "value": "1484d62d930b194a9c46779e4e6619b75118dec1aaa02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2e49d7-facf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685000401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000401, "uuid": "19742d15-5642-430d-abf7-6b168da61f17", "comment": "Malware payload (RedLineStealer)", "value": "d51a629226d2584656691970f7fb9d7a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000401, "uuid": "37ff97a9-9ba1-42f1-b19d-b805bceff6f2", "comment": "Malware payload (RedLineStealer)", "value": "14d11c48dea8cd0214b6f25ed51b880a47ba32fc5d04f538b19521a858be1d48", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000401, "uuid": "8be71cf5-139c-4e2f-a0da-ae189bcea921", "comment": "Malware payload (RedLineStealer)", "value": "2410a6234bf775a11c55a7b4df2d65a263e984ee", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000401, "uuid": "8d909c69-a9f4-47da-a1c2-8b2a479636c3", "comment": "Malware payload (RedLineStealer)", "value": "421261f2fd0d87f1107d211f3325cad2a682313245c96c32ecfceadd1b78dd10f01d65e6a37f2c04e1075ab02590c149", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000401, "uuid": "9549909a-10fa-4432-af79-67c5802c960a", "value": "T1112523478FF8C632DCFA17F109FA4BC30A66BCA2893496562390E8521D739D46436B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000401, "uuid": "5ad62561-0043-4eb9-97dc-edc7feeec48c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000401, "uuid": "0cb171fd-6864-4bca-98f2-754ee65ade66", "value": "24576:Ryrkc38JwqMVSCNDcK0oo0cikFvb0TGklh5P4uvVoOo4Qv:EWJFMVSCND7xcsGIh5PloOoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685000401, "uuid": "7e24abec-9846-4618-9b03-022853d925bb", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685000401, "uuid": "141e27ed-5454-48ce-a299-f2771534ffeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000401, "uuid": "b329495c-b8c6-438c-bf95-ac5600b0bf81", "value": "M7R74776.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9096a1a9-fad0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685000920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000920, "uuid": "6b74d187-6dd0-4250-a539-b5ba083853ee", "comment": "Malware payload (GCleaner)", "value": "d5ef60239b93fe3d78574004e87c2c9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000920, "uuid": "5c7bce39-9cbb-4658-b5d1-85bacad8b734", "comment": "Malware payload (GCleaner)", "value": "1524a9059cf23a0f07f35d62b57e5e311d565594f8f3477089654945d07c4a00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000920, "uuid": "c2d7f5ba-7c09-4ba7-8f40-81411f732c5e", "comment": "Malware payload (GCleaner)", "value": "5b417bd6114ae1b4183d8a8c2d817de7e467e600", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000920, "uuid": "eac1d7bf-a104-4a2c-b509-0c88c3314c73", "comment": "Malware payload (GCleaner)", "value": "bd0b69fb22f8ff3fd8ec1de2df0366242e83c45fe81ec96900c3ba466757a6a86a54d9223eb38478c41371a3dfdd5b60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000920, "uuid": "1fecd875-6113-4717-8a72-cfa735a15a74", "value": "T1DC74CF12B3D1AC31E6162A358E6AC7B51A2FFCA14F1537DB23946A2F4D702E1C931747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000920, "uuid": "c8594f38-d368-49cb-a88d-a8fb050456b6", "value": "761a416c92dda0b5d3a5091999204e5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000920, "uuid": "0abe2a68-47d8-4448-9388-9fd6a4584c8b", "value": "6144:DGsz7XqG2LsSYWJSanEfOUGXnqSP/QitGXhPto9c8NA:DFXf2oSYJRfOUGXqSPnWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685000920, "uuid": "bf231539-5014-40f4-bf63-a7da1c46575c", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685000920, "uuid": "017d2d22-fccd-4e55-8beb-d8c0355e80c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000920, "uuid": "d6bf8b26-0c93-4682-8e4c-ab81fda3c411", "value": "d5ef60239b93fe3d78574004e87c2c9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c11db5-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003690, "uuid": "135e6f57-4c04-4a7f-9676-7729da4feab6", "comment": "Malware payload (AgentTesla)", "value": "63990536dc98c8307253f29833d8d1cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003690, "uuid": "d3f8cf00-37a4-46f6-8b08-f0caed4cfb46", "comment": "Malware payload (AgentTesla)", "value": "1622d5e0e729a71b7505a8db473ff66f827fd7905ec0958d907478f7697c0e75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003690, "uuid": "0b748b39-473a-4095-8c1a-8ffacb4f04e2", "comment": "Malware payload (AgentTesla)", "value": "de6ef3b708553ec571ccdfccf92dc1e2a0623311", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003690, "uuid": "8c8fec5a-6715-4eb6-bc66-8cdef1e38bc6", "comment": "Malware payload (AgentTesla)", "value": "3490b116906be35080b0383cbcaaf79ba2e7f44f4ad514141ee9612f3fbd3315f96462f39ad74f75ffc4328a75c4e849", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003690, "uuid": "da623020-e073-40c9-b1ea-270b47ff1436", "value": "T1A9F33AE992CA9ED6C32D4074D9B11154CBB2A3434617D7ED0DA1A9F63F463C3322E8B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003690, "uuid": "2385786d-bbc0-4c39-a1c0-776a5cffd0b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003690, "uuid": "de4974d3-60fe-4795-b9b4-674a5abdcafe", "value": "3072:6kJcAa0lnhihGRpR81m4gP27eR9gDv09tNjgKB6aM3VBF/RMdKx:6IhihGRT+m4gP2aREv2R7qJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003690, "uuid": "0a351bc1-b101-40a1-9824-24bd6dc392cb", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003690, "uuid": "c2d380ae-370a-4841-8915-c3b2406cfce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003690, "uuid": "9f2dfb94-027d-4ebf-8fcb-689b7f571c4e", "value": "1622d5e0e729a71b7505a8db473ff66f827fd7905ec0958d907478f7697c0e75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c13e0d-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998003, "uuid": "cf88aef4-f4c6-4a2f-bec1-aa654acf4b40", "comment": "Malware payload", "value": "2161e72945e34b487f1ebe83828555ec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998003, "uuid": "2166c5b5-efc2-4eef-a968-b50b579ee7c0", "comment": "Malware payload", "value": "16813604e02e25b40c341f431c75f5ff3a1a560bb08533bfc49a32d23e1c97b6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998003, "uuid": "d07c3174-2714-4c1c-b0bf-884c0361d2f0", "comment": "Malware payload", "value": "984740b4c6458e99eae1190f3bf4e47643b531eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998003, "uuid": "84ded3a5-baa2-409b-8331-7179adb35405", "comment": "Malware payload", "value": "d1acb5576afbaf99b574185f212d8474f2c8cc0452741f1630788c67dccc7ff1bf170a396addad226d9031c83aa5c77a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998003, "uuid": "028ebf63-208f-4a63-b44a-2a4f3f4f06c5", "value": "T1A25485844B1128B24B5B7E26A730A4B5EBBE1E74C2D4558BF45F7261FBDF98CC8C1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998003, "uuid": "162e9252-8262-46b1-b15c-23cc1d7269a9", "value": "3072:vg0zt0Wd8uTdXm+DgCY2og/ZyEAPUsuHPsAPStfzTeB0E3k3WycIpwvF:v56uRXmB2owZyEgUlHP9wHeB4eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998003, "uuid": "5e2c19fa-a7c4-4a8e-b710-dc0d7e8c5a0f", "value": 306019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998003, "uuid": "0996113c-939c-4bb8-bd94-740ec92852ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998003, "uuid": "cdab33ed-496d-4c41-9635-ba8339075373", "value": "Threefoldly.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2998687d-fade-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Havoc)", "timestamp": 1685006760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685006760, "uuid": "e36956b7-9fb0-437f-8ce9-4b8bbba05883", "comment": "Malware payload (Havoc)", "value": "93a647aacd232e6f86c8b93cb342632f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685006760, "uuid": "a3bff983-7e46-4c72-a778-749f5290330b", "comment": "Malware payload (Havoc)", "value": "16aadf7a8fc02449d088670dd9b22aa9bff08c936822f84c02cb3b49f913a9cb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685006760, "uuid": "dfcf55d9-b1cf-4754-99b6-feacefe8dfd0", "comment": "Malware payload (Havoc)", "value": "b2da5d61dc5a5a48a7998ac1470c5391efc1c1d4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685006760, "uuid": "5b829a67-9aca-4aa6-8764-247ab15af05c", "comment": "Malware payload (Havoc)", "value": "d7727f8276b482671509ddb70c4c63e067dc65087d89f3a3cb4e0b62b422d685cf5f156ab06c7671b747910c506bd52c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685006760, "uuid": "6e02607c-6e40-4634-9521-4033ff5aaebd", "value": "T156355B8B7C9091B6D0699231CDA692D17B31BC981B3253D33B01B6F92F72BD45E39368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685006760, "uuid": "10902ecd-bb0b-44d5-9875-96f178f8f258", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685006760, "uuid": "8d738ab2-23f7-4ecf-b090-9c118822c971", "value": "12288:aYzP/N6Ld1DyLnnL3OqsS2/LaA+B4+Sfzk14yxNcANt64xT9kcsNJMsp3vde3VIn:rN6r0nL7S47HJKjpg9rP/d9a1rPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685006760, "uuid": "d6dabcd1-ab7f-4963-af82-4d4d2f8de3cc", "value": 1157400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685006760, "uuid": "299784cd-14e1-4fb8-b085-080e8ef1a69f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685006760, "uuid": "d8c0d8b7-4ca7-4d24-a10f-606573ab66ee", "value": "93a647aacd232e6f86c8b93cb342632f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6c03e1-fac5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684996215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996215, "uuid": "d6aa9485-4207-449a-866b-0c4c7768d6a7", "comment": "Malware payload (AgentTesla)", "value": "35b9124a72b939bddecd642532c56d4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996215, "uuid": "89a91b64-8e16-44ea-a671-133cdb41febe", "comment": "Malware payload (AgentTesla)", "value": "16cb75f304ead30d5c624f026272b3c6a3b533f087197c240fa92b1b69646045", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996215, "uuid": "736ff89e-aa3c-4be9-87e0-8950a6bc1f69", "comment": "Malware payload (AgentTesla)", "value": "f9e9180f483a4b98a060f68a7df2ec38c7cb930a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996215, "uuid": "f1bf0b7b-f871-450f-82f1-524d00820497", "comment": "Malware payload (AgentTesla)", "value": "7a9ce9ce42f04bcfc5c42a4c2598c0738c9f6b25f74464d057c38784024d7ae8dbb9c8c74d8ab4e41e2104c5c000fb1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996215, "uuid": "f4f45653-c9a1-4c30-b395-35e68bdb8877", "value": "T19AD4DF572A6A8F26D17043F95625E2B953B62FA83137D3269CE3BCE3F039B435901147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996215, "uuid": "557e4806-0c29-4b97-9df7-d9159de91218", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996215, "uuid": "8f50c439-1246-409b-a759-a491b602f842", "value": "12288:x2iN/I3c8Vrao5qrEUt8R9XIBbAaz2a1P9mnwK7t8hXZ:x1hIFao5qrIRpIBx1DKGhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996215, "uuid": "9a56d3d3-e2c8-4937-8821-8c48ce7b29bb", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996215, "uuid": "66dd7341-87b7-4c72-8fe8-7ddcb9f1e73b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996215, "uuid": "0d89a9e4-ef6a-4841-9a49-05bae322351c", "value": "35b9124a72b939bddecd642532c56d4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466cc316-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994783, "uuid": "633fb4c2-b5dd-46bd-8deb-f05dea676f93", "comment": "Malware payload (Quakbot)", "value": "48f43edfcce3a682e2aa9147bbdfe2de", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994783, "uuid": "6f7bdb69-a806-431f-a0ce-f24eef4490f6", "comment": "Malware payload (Quakbot)", "value": "172bbbaf5107ff883192724a0e24c8759d86107e5c74d32a16803b9876681807", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994783, "uuid": "194becd1-4085-4650-8498-677e31c65ba9", "comment": "Malware payload (Quakbot)", "value": "cdf0aece829bb6af2634764e89604d7345b33393", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994783, "uuid": "9b69276c-b38d-4eb8-82b1-1e7031129458", "comment": "Malware payload (Quakbot)", "value": "08b8b09129259cb50e393069385318ca982b8c5a432242a2d2cef983fd351934fabce20207a8d29e5fdf9a41b91d876d", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994783, "uuid": "58e6091d-ec49-48a6-a09f-590654541b49", "value": "T11C63195FA38003396A220235650E5AD5E7E484786E76DB78E48EC2693351C38D6FF6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994783, "uuid": "6e994938-0476-48d2-b0c4-f648eb0cef02", "value": "1536:dGw3NlDCxRMFO5eil6mby8QhjEH8Jl0pcfAmM7D:Qw3NlDC2OKVjBt/MX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994783, "uuid": "659650ea-ae58-4375-b671-050a360071cd", "value": 67781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994783, "uuid": "b6b025ae-d7b3-4bdd-a7e8-1e93bfbb945b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994783, "uuid": "87d209d0-5fa8-4787-ab93-caed01017b80", "value": "Claim_D152.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9678d6-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996699, "uuid": "0dc26dd6-1ddb-4e80-87f6-989c370e1d58", "comment": "Malware payload (Quakbot)", "value": "fe9ea4b3abcb0c806245f096158d582f", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996699, "uuid": "19e32c92-c986-4329-adea-c7c1e3e3dbfa", "comment": "Malware payload (Quakbot)", "value": "17cca85b2e4b92a2e04fb62b9a4bf7c4182e6b8d19cbe4aae7b5ace0d447dfb5", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996699, "uuid": "dc0810a1-4566-4e90-8871-fa9b51496f74", "comment": "Malware payload (Quakbot)", "value": "accb20ef50e9b76a4b8ae2e40b61ad3d47567613", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996699, "uuid": "cd3dc772-89ff-471d-b653-24952863ea31", "comment": "Malware payload (Quakbot)", "value": "8669297c64b729f648bf7663b8129550010ecae31f7e5f2be8c1b6e58283615c986d0faccc42214b74050ca8e87edc1b", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996699, "uuid": "5ac229bb-3297-4615-9f19-cdb450d5bcbf", "value": "T198731A5FA381133C6A614236204E66E4F7D24538AA32DB74A85DC72E3321D39D9BE5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996699, "uuid": "c54cd386-143d-45aa-ba11-d20d43ece7a5", "value": "768:IMyrDfnlbURAJInTtwjA+cAhnBtwjA+W6lv9Bm6jI3c0Lda+0QKWSh5Q6MysbURT:IMUdZc8neZW6Nmyea33M7aBaKsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996699, "uuid": "5b12f4b1-a174-4a3e-ad91-1d7a91c0f011", "value": 77346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996699, "uuid": "d377ee16-993a-49b7-81fb-463abea26212", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996699, "uuid": "b807937c-4b13-4e2f-90d0-0569dcee85c4", "value": "Claim_E269.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3b4126-fb18-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685031652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031652, "uuid": "27ed00e0-2fb8-403b-8a2a-e5b609e77ced", "comment": "Malware payload (RedLineStealer)", "value": "d48554211d2b87b71d6fea03d8520c3e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031652, "uuid": "22e7b4c7-dd63-49c1-b53b-fdc338d0f69c", "comment": "Malware payload (RedLineStealer)", "value": "1834db2a405c78564f9928d0f0047fce383d0e5d4d1d98aafbc3c2d7d453aec2", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031652, "uuid": "65508e56-ef85-4a77-865d-d1cbff553796", "comment": "Malware payload (RedLineStealer)", "value": "ea4db83f4d5d486fa4a6e88ad6d8f19a84402a46", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031652, "uuid": "1dfd994e-abf0-4425-82b1-6a906a634022", "comment": "Malware payload (RedLineStealer)", "value": "494b7b63a48cc51b3b8f1e8230787f6d3a83f948ea4efefeef1cc46014d9932994b2bc5d11fcc1bd783920ad9746619c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031652, "uuid": "a267b296-da6b-4cc0-91fe-7ed16050f6b2", "value": "T1CCF41203B6D58473E8B43BB049F717831F727D959EB98727238A5A4A1CB21D0A93473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031652, "uuid": "4331726e-951d-490a-b74b-4b95f7ed675c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031652, "uuid": "57877a4b-20c9-4613-919e-b28e47a02e9a", "value": "12288:PMrDy90JuVZfxa28D0lBBCy22Tj8wxVed6VbDZMIj2Ov8stfiS+Q+fbavj2bWxEZ:8ymubfQ0DB+IHxVI82Ov8wXj+zQ2b17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685031652, "uuid": "ecdc9815-91c1-4bb6-b023-a93c57c70fc2", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685031652, "uuid": "52d99f7a-1665-4255-8683-0f0b46e4f9aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031652, "uuid": "31db7943-eb88-47c4-bc91-793c29a22bad", "value": "04684699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752d7f2c-fae3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685009034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009034, "uuid": "f2f1c4eb-a607-4d57-9ff6-a40fdd956226", "comment": "Malware payload (AgentTesla)", "value": "a908e77b40a3ad811bba2674fb6109df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009034, "uuid": "30553be5-6559-4da3-b0af-a6f132fa0034", "comment": "Malware payload (AgentTesla)", "value": "18865070f9e9f47ac6f423496d02c85ef8f6d32ef045f838c427f8b2bd4a4fb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009034, "uuid": "811a9afd-3fde-4d2b-94a5-b8057a557e7b", "comment": "Malware payload (AgentTesla)", "value": "3004f7b428990dded78084e87165985266d821a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009034, "uuid": "fb0c227d-e6ea-49b1-9790-e98202899a7e", "comment": "Malware payload (AgentTesla)", "value": "5bba16cf047ef06dba6391abb8329eae5d2afcef98eeb9888df9332106624479cf71cc22277c6cb929daca7b1dd3d200", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009034, "uuid": "9d7e5c12-ac0a-4f08-9bea-7af50be3e749", "value": "T178B423C2DB8DC70FFEC9CAF9E6636D665E8BA1092289570D210A56160CCFF857781B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009034, "uuid": "d0674d4e-458e-472d-b87d-99fb1bfe85cf", "value": "12288:i0/xV4pEkFjYm0DH401VtHwQaZliP7KjNz7IckF1:tT4pdYm0rFZwJzk7ANItF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685009034, "uuid": "11380d10-e67f-47e0-81fd-8c93716542b9", "value": 537496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685009034, "uuid": "99cd6b1e-5deb-45fb-87b0-5c23a69e48ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009034, "uuid": "5e0c3d3f-0a1f-4686-b821-05ad5d3d526e", "value": "Proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6604c45-fac5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684996259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996259, "uuid": "00263cfb-30a2-447a-b9a0-512e650d5c5d", "comment": "Malware payload (AgentTesla)", "value": "120e91ae6684668a9c1443c3d38260b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996259, "uuid": "014885ba-5876-4a3b-b4a6-00c517ef24ab", "comment": "Malware payload (AgentTesla)", "value": "19b36c4993d5767c52507537eb984804e5c0aba02483993ed6dcf6fc92120888", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996259, "uuid": "d7dc6f7c-6bca-49ca-b3c5-a35babe4787c", "comment": "Malware payload (AgentTesla)", "value": "b0c9bbc2f2fc0de0be67a06a422457d2a440a09a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996259, "uuid": "e3108606-448e-478d-b9fe-aad47172699b", "comment": "Malware payload (AgentTesla)", "value": "e9fd8c22b38cbe5755b61c6fdf1ca50165da49531b4a9e0f01f6f45ba43277e917fef94bb257b628b42c90223cf789d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996259, "uuid": "467a61c4-c1dc-452b-83ee-e0e837f5df71", "value": "T19BF3386DB2DA5D51C33D00B4C9B111081AB2D1BB925FE76E1DB19CFA3A327C3362AC65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996259, "uuid": "2599d0fb-d260-421a-9213-6e88d979b9cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996259, "uuid": "19e628c1-3033-4663-9827-d24d0c513730", "value": "3072:8B7kyouv6K1wmic2aSlpOU6WD/kjfmknautfSEVN4wjlHvS8:oqAic2vb6WD/k6kztfSEnlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996259, "uuid": "3b12f7a6-3f6d-4063-b8cc-4a0666ef8437", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996259, "uuid": "89a50e7c-c65d-4d2f-a300-e8600f27d9e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996259, "uuid": "dc99f255-a4ac-4d16-9c03-eea855a1d130", "value": "16849962577c73803940719eb1cd6fa3e1c68488bf48fed7a1d8c7430d229f0a746c4229d8549.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b409cb-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999662, "uuid": "8007d0f7-e632-46e8-85ea-492f0c376ab4", "comment": "Malware payload", "value": "674fb4db3e3a1b3d41c93b581d1eb037", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999662, "uuid": "a9c3b58f-7727-45a9-8396-b33aca1ce73e", "comment": "Malware payload", "value": "1a6cc93f6be5748d6a08bc364d487699c05a0d264c33d59b133c5b5f591d1ff5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999662, "uuid": "ac90665c-79e8-4ce8-ab51-86e7e373e7b0", "comment": "Malware payload", "value": "12f5191a57cbb5b4532c021b8f9be423956d1268", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999662, "uuid": "cb113cbc-698f-4500-929c-11f4e8e3754f", "comment": "Malware payload", "value": "4deda46c513af2cfc192250adc7123e4ddd7d8c82e6b84bfb54d314282e3025c1a20fb308a138c863c1aed60de0fcabb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999662, "uuid": "72002364-41e0-4df9-9190-4d0a425a47b8", "value": "T1AA547781465524B24B5B7E26A73094A5DB7E1E74C2CC5A8BF4AE7250FBDEACCC8C1331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999662, "uuid": "bc7c4dc9-ed34-4d72-99b9-930031945aa1", "value": "3072:ONoRj7LWf9sgi+Gi4R3bipXbL2HeRYrMBqhHDr1RjjykWP6UBQ+:xj7aJ/MpipXPceRpS/3mkWP6Uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999662, "uuid": "69b602a2-eb9d-46a7-8ae7-e86b6fae8a86", "value": 284169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999662, "uuid": "762fe586-bc14-479b-aee0-3e7465ba5d46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999662, "uuid": "0301804c-c95d-498a-9f9a-03d3f71082c4", "value": "conveyorizingCh.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3149c102-fac3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684995177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995177, "uuid": "3526c30c-71f7-433f-8096-319aea9fddcf", "comment": "Malware payload (GuLoader)", "value": "27f658dec92836eb849bf2d468a730d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995177, "uuid": "2f3be65d-ef88-44f8-893b-3c042f535360", "comment": "Malware payload (GuLoader)", "value": "1accf59781721d1e1af5b6f1a0abbf4463cb74026232da445d22ba0561c3c677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995177, "uuid": "e6ab7a74-daee-47ff-a650-9f59dcb61b24", "comment": "Malware payload (GuLoader)", "value": "02a383aec73c4e9df80183ac66083dac7c68c94c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995177, "uuid": "df652c6b-919e-4c03-8117-53bb4cb0f433", "comment": "Malware payload (GuLoader)", "value": "e208c715ca7c97a4bc560804c6705263779dd95e92b0bd21bdeed4d6f83a4f8544afc09754c92a0da779bc1e357328e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995177, "uuid": "ab82f49a-4fcd-4fdb-ba91-4880ca94cbde", "value": "T1D1B4F180DA8848B6DC50077228770C274637BD2A46B8AD5F8748B5276F7B692772F12F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995177, "uuid": "eeeef9ef-6f79-463d-bd42-960c7ceef1ab", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995177, "uuid": "89c6411f-422f-4a42-8fee-a417fcc261af", "value": "12288:7iq2TDbJgttJTqOEY3+FoPruxPZTHLGOSU6OxG:7iq1NqqSRLGOSCxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995177, "uuid": "b479207c-89d4-4e6f-bd73-96282808bce9", "value": 494019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995177, "uuid": "e226eff6-164b-4900-b8e7-181914de1ccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995177, "uuid": "06ece73c-fc26-4e35-ad73-158d58171c91", "value": "Elmo- 05230342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beccf020-fb52-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685056832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685056832, "uuid": "9faae5f9-b6be-47e8-9bf1-571c5595ca09", "comment": "Malware payload (RedLineStealer)", "value": "ccf47c03c296ed14f8a8980528e19ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685056832, "uuid": "8434d1de-0177-4e93-8b08-1283e89ad973", "comment": "Malware payload (RedLineStealer)", "value": "1ae2e424e1282b10f90ccd73cbc05f519db9e48aaff02925e82ef23b9d1550fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685056832, "uuid": "725788f3-7181-419f-b3fe-909b2e47955f", "comment": "Malware payload (RedLineStealer)", "value": "516cd72cdc40722e8d1947520ae341c4884d7382", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685056832, "uuid": "49542870-2761-484f-bee6-0e8c30532bcb", "comment": "Malware payload (RedLineStealer)", "value": "210164c966b3fad4f9547a9720f4e5fe9f5ffd70314b0bb80220503e85ed011fd6b9b31d7049a2b70dc8ea59d101369e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685056832, "uuid": "20339c86-aac0-44f2-a2f2-7836e307d2c1", "value": "T1E3F4121297DCD471DCB13BB108F613871E35FCA1AE2447AB1306A94E69B3AD8A57133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685056832, "uuid": "8c408263-e408-4564-958b-9bfe06a3428b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685056832, "uuid": "6bbbf313-58f3-414b-9ea7-2b758ccd8d72", "value": "24576:fyrppyOL8tXWeIYQy0KNV1dkr6MM1+aBg:qtpGtXWeMAr1e6MM1+aB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685056832, "uuid": "08c3d694-cf3f-4366-b59e-4ed390736f75", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685056832, "uuid": "1eb90305-ba17-46f9-bcde-2d1bdd1b92be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685056832, "uuid": "d8924f1c-a139-4c17-845b-b9ed946926f8", "value": "ccf47c03c296ed14f8a8980528e19ba6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068d9548-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996823, "uuid": "34f9087c-a397-4a97-bbf0-9e8e8064369a", "comment": "Malware payload", "value": "466cbb5fb1bb1d256063f4221aac9cc9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996823, "uuid": "66466571-33f7-444e-8471-22a6d2f8ac87", "comment": "Malware payload", "value": "1b8a4da0b846907fcae660b54cc4d74663810be01f1a6b94f4f2a46954d18689", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996823, "uuid": "a462e6b9-86a6-43fd-9b17-fb841778bcfc", "comment": "Malware payload", "value": "2198bd162696ccaa1ffab81d15d15c0d99993bd5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996823, "uuid": "30362335-6b1b-40a7-a101-4831230425c3", "comment": "Malware payload", "value": "4cba7882452e7206e18b4033f8ae4bbeedfc60a3ff291dadf0e39158ae06dcba737b1d4ee32e0800da7f8f5570803b75", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996823, "uuid": "5b0960f0-be71-46c8-af14-3a9aee43cde4", "value": "T1706455844B6514B24B5B7E26673094A5EBBE1E74C2C85A8BF45F3260FBDE98CC8D1331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996823, "uuid": "dbad80e0-fc78-490f-9174-a32442e0aaaa", "value": "6144:94TQ363xAIijfQuRJUB1UrN713UrB5lTx9ezE:9Lqiwj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996823, "uuid": "304ef9f6-3a49-4e8f-8b34-811d86a04850", "value": 307082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996823, "uuid": "340ded73-a92c-4e12-b6d3-644d00adea6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996823, "uuid": "aa5cd456-467c-456c-84c7-373e2cbc70f1", "value": "inanitionNeathm.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cd6d91-fae1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685008118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685008118, "uuid": "378c0b47-ddae-47b9-9237-22c6f11d170c", "comment": "Malware payload (Amadey)", "value": "b48a064c304256a7abce8e4aac3507de", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685008118, "uuid": "b8df94dd-3c38-43ba-bc22-a664220bbc7a", "comment": "Malware payload (Amadey)", "value": "1b9f15cf0064c8374ac589ce666ad47aabdb9562f694d344559c819da49216d8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685008118, "uuid": "e56db489-9cbe-4d2d-aa71-e2bfe4b6693b", "comment": "Malware payload (Amadey)", "value": "b17fba6b0b04be8b21005a1075952ffa2e22b619", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685008118, "uuid": "a8f567ec-5353-4768-b99b-23caa2c25e88", "comment": "Malware payload (Amadey)", "value": "347aa23eba973a8312f95ac0507580b8965c26f1fbb1fbf0f3c5d384db95658efdc23bf749df065e05e169ad6d318d59", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685008118, "uuid": "2cc31ef2-9b34-4003-9068-bdce9eb8e2a1", "value": "T1F3352302E5EC5866F9B527710CFB02934E3A7DE1C9B143672349692E1CB3784A532B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685008118, "uuid": "d034984e-5621-47ea-be71-bdc7c359b8d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685008118, "uuid": "2ad55fad-9611-442e-837a-5aac577116ec", "value": "24576:Uy6a54bGRnhB3inlJ50bHCEIs2RK2pM5c0ZfQuQ:j6a5VBy5Zs2RK22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685008118, "uuid": "83cd2fc6-7e94-487d-b997-d287e90d3521", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685008118, "uuid": "b24c1ebf-dbe4-4b00-a2f6-e3331f5f5db5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685008118, "uuid": "32d4f19a-c912-4dcc-9fea-18e00e502da1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243580e5-faf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685017059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017059, "uuid": "b2635693-e4a3-4481-9e16-967097182381", "comment": "Malware payload", "value": "2da9030686664c12762383d362753d53", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017059, "uuid": "dc98279a-d857-4c36-a27b-9665f68c5be8", "comment": "Malware payload", "value": "1bd720521636f9d731f72ab81b6b542b4531f44b46dac19ac287c50b21218b56", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017059, "uuid": "5e9e1560-a226-4e9c-8af1-9516d5e3aa20", "comment": "Malware payload", "value": "2a15163ddc639867ab8cccf327ca0eaf6b31f2a7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017059, "uuid": "018fc4fb-3517-4812-81b3-4ea15e91e1f0", "comment": "Malware payload", "value": "46b5804923f94627960c26d920f4bddc5be77b651ba4b04a19e95c6557115631bc92faf553a2926dfa8ecf9ba4626f6a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017059, "uuid": "1ce8a73d-8eb6-4311-9011-b44ddec1c5cd", "value": "T13D140A067E06F462CA04173A708081D4139CAC41FFE91993A56EFFEBC6395A5E63B53B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017059, "uuid": "4738f597-da0b-43fc-b2de-6d4856508d80", "value": "1536:9H5XdJ3ApNm8ndlZ3Pe3slCqrJCdp1l2qpAfNgzt:9HjJwpNmAdlZ3Peck4JIpAFgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685017059, "uuid": "c3741da9-79b5-49dd-854c-e5f8e91f5872", "value": 195464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685017059, "uuid": "0c30272d-dfd2-4d29-884e-b7c7f0d4abb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017059, "uuid": "be13fab2-3cf9-4be0-bee1-66636e62a1fd", "value": "002308099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7303e1f3-fae3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685009031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009031, "uuid": "0edc64d1-00ce-4c98-be2a-550287512eeb", "comment": "Malware payload (Formbook)", "value": "dc3e0fedd5d71f89bdfc4db60e21874a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009031, "uuid": "6ac05675-4c82-4baa-a65b-7ea447d5323a", "comment": "Malware payload (Formbook)", "value": "1bdb8590762f40393359ab5a12face2f6affce13834fb427d800e4eb2fdb0e63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009031, "uuid": "033647b0-b463-486f-8b8c-a2c2a3882f5c", "comment": "Malware payload (Formbook)", "value": "c5c553fac7c60d1f55de6e9718bfc2c95cc07ea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009031, "uuid": "4af8f593-0ab7-4e8a-a141-9e6baf436cc3", "comment": "Malware payload (Formbook)", "value": "18a51ba738f3c835b1895aff5b3ae26ae16f43fbc0518f3c70157c0df2a61ed69a7f288bbe3e65da56b5d6bc1c54adb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009031, "uuid": "b91d804d-21f4-4522-81b1-cfe86dd89477", "value": "T159F423E4249A9329ECA90774087563F002BFDF967972E2572C87F1C8E713B1D8162B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009031, "uuid": "e987f900-6d8c-446b-8ece-b497bafe1661", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009031, "uuid": "39bf4393-5dc3-485d-86a9-f0a1447bce23", "value": "12288:8aWIm6lVvtzZBEP85VXHx14LlGyhsbsCe0FAQAW58aEcqW3obeO6+H3Xy:RTmIt9BEP8bXx8GOsIfGAQ55PL46On", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685009031, "uuid": "7375edc2-65d1-46d1-8776-976456a56eea", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685009031, "uuid": "50dd0b56-3bf5-4f3c-bb78-d0747c53c9a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009031, "uuid": "c20d664e-abd0-433f-baee-13d30eda63b8", "value": "PRICE ENQUIRY, ENQ REF-LPRN- 20231096_PDF________________________________..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d002d52-fafa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685018845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018845, "uuid": "3d5ea26f-6ac3-4831-9186-1ef0aead30b9", "comment": "Malware payload (Quakbot)", "value": "1ac54c43b046e78d6a9f770867aa8e72", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018845, "uuid": "3c610d66-5c00-4994-8860-b7d4898860dc", "comment": "Malware payload (Quakbot)", "value": "1c3f8e5b7f1d33089ff88a36c8560c282eb14e06f502e8cba50b414db49e0c7d", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018845, "uuid": "0da0a3a1-1c8f-493a-9beb-85ff0ed145dd", "comment": "Malware payload (Quakbot)", "value": "6d7b463df2c67a825144ad01eb56cc8dad473c0d", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018845, "uuid": "2b8e0afe-e159-4b4f-9e83-d6ab8f5e934e", "comment": "Malware payload (Quakbot)", "value": "17e51388eb6d80ee426dccf64e4ac3b8631e73bf9307df6173790f305f31e94421dbd53bb75e036ac773dadf5dff1b01", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018845, "uuid": "e1c9c4f9-0720-4213-9f9e-106a0b32ad25", "value": "T19B831A6BE380037956220264524F62D1F7A584387761DBA4E84FC3AC33519ADC6BEAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018845, "uuid": "8d084ade-0363-4a8f-8861-ca95d98e70fc", "value": "1536:yVzTW1ZOPbwiuQEHDEmKBfZm0M0c9wJirpjDcQlZOVNwitj/tQ4:yVzK1ZOPbw6EHD8jc9wJ+pjPZOjw4j/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018845, "uuid": "8e171a78-76af-404c-beff-e83383a712b6", "value": 85827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018845, "uuid": "4128e25e-2e58-46d8-ba28-67cedc1bf947", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018845, "uuid": "cad1b151-6698-48fb-bd0c-5ed9d3d8ee85", "value": "Claim_C901.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcad918-fafb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685019300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019300, "uuid": "085f08be-7ee4-4638-9b7d-4622a00e0a53", "comment": "Malware payload (Loki)", "value": "c0cd3ed58902fe2a55454b8f550745b3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019300, "uuid": "3b0b6d64-e5c6-42aa-8fa2-2e9599b2f8ef", "comment": "Malware payload (Loki)", "value": "1c67159406e3a096d7745b83d5a1021a3bfba7295a96a8cc695b10cc2fc21751", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019300, "uuid": "effbaeee-c12a-42dc-90aa-69a5fa57c537", "comment": "Malware payload (Loki)", "value": "0db0841fcc2e3ac51eafe0c113955f0c58c6da15", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019300, "uuid": "26dfa859-4a10-4280-8123-b8e63f6d456a", "comment": "Malware payload (Loki)", "value": "39f6a8408271ad9c705ab07b30f298c7c1148f1f9b2d1eb45e68336eb6eea18f187da0bdde726ca3968db4b4b90bc63b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019300, "uuid": "a5be1959-81d6-4eff-b936-1d364964aac8", "value": "T1DDE2D64AE79B02658F5113B7531B1A89AABDB23EF35054B1746C833433EDC3D42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019300, "uuid": "fa5c5531-ee4a-4ada-9977-9ec00086fe61", "value": "768:cFx0XaIsnPRIa4fwJMe+7HOdL5Si1G5fB9hAxf5eylXqE:cf0Xvx3EM77HOzScG559hAxf5eUqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685019300, "uuid": "8dcbc962-f739-42a7-8fce-fc3f724bbe53", "value": 34053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685019300, "uuid": "0d23e04d-aafb-447a-bca2-88ad48a99da5", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019300, "uuid": "66b43eb7-badb-475a-95fe-086692006ed6", "value": "Shipment Document BL,INV and packing list.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41dd8aed-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994775, "uuid": "b9446920-d8fc-4acc-86e0-7fd98a292ebc", "comment": "Malware payload (Quakbot)", "value": "f82f04f8200779fd4a6ebc531e56aa0e", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994775, "uuid": "c5a497ad-39d5-41f8-aa31-c64cd2377852", "comment": "Malware payload (Quakbot)", "value": "1d1a9cce7125daaf25f06ed0d88144327f14048f79533591bc01cc61fc18032c", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994775, "uuid": "e9ccb1bb-8b35-480f-8a75-dd7ff7aa18c7", "comment": "Malware payload (Quakbot)", "value": "f692416922ba8380678fc33b550142f3d3ddf9ed", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994775, "uuid": "28000b97-05cd-4c31-b529-c1523e681b68", "comment": "Malware payload (Quakbot)", "value": "2fafd74107f2c65bd28b6ef855d6f841c66b95b55d2b9fe46129c1df5c05b77b2affd566cffbcf735283603c8b7fdfbd", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994775, "uuid": "a00fd4bd-da8a-4aa3-97b7-2a72b3b730ff", "value": "T1E663F95FA380133DAA504136240E5AE5F7A148386B76DB3CE81DC72A3361D39D5BE5EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994775, "uuid": "8ddf3235-e85f-4546-bc64-d7c7dfabc723", "value": "768:yyrDfnlbUrdShHQbp61Sh1JU+1W8vVB/KBmMyeluh1+ZzPzPmQbhwKWbIxIcMyrN:yUQ6AM+1W8vYmihP7dbhqbyMUaBpsB/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994775, "uuid": "90c317ab-c7ef-4c1f-970a-94c57d9095ba", "value": 70980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994775, "uuid": "72f92ea2-065c-493a-baa1-008a7079bdb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994775, "uuid": "c1a27174-ff34-48e8-b7c7-de7d05b94c98", "value": "Claim_E314.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39fec0e-fae6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685010535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010535, "uuid": "7d5925bc-487a-47c4-b63f-b732d93b9f28", "comment": "Malware payload (RedLineStealer)", "value": "fc254d4b8ee0f8e3bf4d5083dedc5e81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010535, "uuid": "30095308-150b-43fc-a56b-f35f1ca69840", "comment": "Malware payload (RedLineStealer)", "value": "1d2da0d07a2033aae775dedb53c8d35439a61172d9810114bffccb07a99f1149", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010535, "uuid": "c7794ad2-4929-4f1d-940c-4a65cc12d7aa", "comment": "Malware payload (RedLineStealer)", "value": "6dd82afca507eeb773af98af5bd692af168ded88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010535, "uuid": "70e12509-c176-4aa2-bc75-7d16c7f776f0", "comment": "Malware payload (RedLineStealer)", "value": "aa2a0524d7869ec1add1be21e5c5646801b3f518446d8f985b27d6cb065630b3cbc67247d950887930e7c734e363ac3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010535, "uuid": "92823711-240d-4c10-86d4-7d767a9d008b", "value": "T15E64D0113348C536F86B24B188E99A71AAB8B431176F95D7B3D4162D4F213E2BB3178B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010535, "uuid": "9c6d2130-d751-47c8-ba4d-b389286c585c", "value": "c431c66e4e6df6a5b1ef02878d31af4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010535, "uuid": "d14e4f32-3b89-49b5-b7b3-190a9db9b484", "value": "6144:oR4lI1UhNRNrh5scf63W6q2zu9cD4I4bZ8x8:JW1U/RNrwjW654cDy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685010535, "uuid": "9d5d56bd-fb4c-4678-a18b-1202d9c938ca", "value": 328696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685010535, "uuid": "c8a75a5c-0adb-492c-899e-9d7f9f3ef43c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010535, "uuid": "2e80e77b-9ca4-409b-a852-b6b4deb56693", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc98e5a7-faa1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1684980915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684980915, "uuid": "3afb06d9-ae4d-4e84-852d-9916772e5ae9", "comment": "Malware payload (QuasarRAT)", "value": "0e5f58c142e4037cf39c31e45da26e59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684980915, "uuid": "57645688-a6d9-41fd-91ce-4033aaa6ce5f", "comment": "Malware payload (QuasarRAT)", "value": "1d70a9562b8cc030ff8817065870b3a1a000e4de46f52409191af270b55c0582", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684980915, "uuid": "aabf7de4-da6f-4458-8afe-58bd1c0fcff9", "comment": "Malware payload (QuasarRAT)", "value": "253ac7de85908e89a55711e3ca13ca4821c73672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684980915, "uuid": "60d0bea6-d4ab-4484-9c82-39a2124ce0a5", "comment": "Malware payload (QuasarRAT)", "value": "004fc674c58ceb469a80ddf6667d645b13b4b4da945615f056eed59217d0ba1a1edc8dc96123112881d9eba5c9bc3329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684980915, "uuid": "53d02768-d81d-4eac-a695-8ccef3a535df", "value": "T12F06E029F3C4F9CFDC997B3230AA261BB3B11E90158ECD07AE6672CC2D7168265D7158", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684980915, "uuid": "43c3f592-7018-4262-9a79-447ffdf69875", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684980915, "uuid": "80c485ad-afd4-49b3-be40-3d4c447fe470", "value": "98304:5q/TGUkFncoFVfcgpNuE7LGvFdvK7kSPan7:55FVfcgpQE7LGPK1an7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684980915, "uuid": "064ac482-bfd3-483b-9c58-68f21eacb954", "value": 3726848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684980915, "uuid": "c0475542-1477-410c-ac29-6b3ca6b342c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684980915, "uuid": "331202c5-38cd-49ab-9904-6c3f6df0e8e1", "value": "0e5f58c142e4037cf39c31e45da26e59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0baf1018-fa90-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684973209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684973209, "uuid": "0ef75a38-6f95-4440-a82f-8046fedc9cfc", "comment": "Malware payload (RedLineStealer)", "value": "7fe98688c2a2d8ac11b67f107f5391a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684973209, "uuid": "1e77e059-c495-4139-bde1-ad36bd372ba9", "comment": "Malware payload (RedLineStealer)", "value": "1f82b797702e5de8029c0cc02d4361614b8e391b783a6be13b5a5e83653493ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684973209, "uuid": "7bcea5d5-5c4e-4866-850d-bac518816d62", "comment": "Malware payload (RedLineStealer)", "value": "98e151c122743e540cecb1246b2360bd30fba4a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684973209, "uuid": "467378ba-9008-435f-a83e-034d5725c8e6", "comment": "Malware payload (RedLineStealer)", "value": "9de8b537686998fcdc8291bced27fd6b16fcf303a28d42ce12defde4e33a5b7b2bf1a6040060f39402ef22f14cd24996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684973209, "uuid": "3cbd2a4d-918e-4c09-be7c-c3f308b2b72d", "value": "T1B6649F233686CCFEF41F14729BEEAA704655743803BF27FFA784066D0B217D1692661A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684973209, "uuid": "e2fff616-2798-419a-9d89-780e26cea38b", "value": "4471786e05fb13e777dde9c491d1e164", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684973209, "uuid": "828cec86-1f8e-4c73-a765-a79fa6a3e575", "value": "6144:68VfoL2Xilu6zYbG6ytEoU3L7TTE1bcg218:DoL2S/zYbG6Bd77E1bXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684973209, "uuid": "ea47f5b9-2dab-4d83-9f00-a582efe62cfe", "value": 327160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684973209, "uuid": "7f4d0f3f-4146-4a82-9a0b-12a70753b5ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684973209, "uuid": "f41dfd0e-3a20-4830-8014-86f81ad47e47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7a1fbf-fae4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685009555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009555, "uuid": "b8af970d-8704-4cd6-be4d-6e1688d95bad", "comment": "Malware payload (Quakbot)", "value": "92c0f80305adfa4554451bb5f1b59d91", "object_relation": "md5", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009555, "uuid": "b0117797-3166-4bf4-b685-cba05a74a492", "comment": "Malware payload (Quakbot)", "value": "2032c8ab05b8e11c62316db5a893af0166e40057e8579cd2223dae401398c64d", "object_relation": "sha256", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009555, "uuid": "8c5a9992-cdd1-4ee0-9327-0bc8d6236e33", "comment": "Malware payload (Quakbot)", "value": "7ba95d838db09f25288ef725090f0e52a44e7e5e", "object_relation": "sha1", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009555, "uuid": "635b9772-9d04-4255-82c9-0b505a78b921", "comment": "Malware payload (Quakbot)", "value": "2ea44ae7b2dbf5c2845bb5a97fb07fd1d5f920c84a3ed0bbea31f2ecd446dc8753711d3daf9efc1ab640500965260818", "object_relation": "sha3-384", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009555, "uuid": "6b9d0536-ffc1-4714-83f2-be86965fce77", "value": "T11144C784472519A64B4B6F36B72454B9EBAE0FB9C2D0588BF46F7250FBDF90CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009555, "uuid": "3d2e033a-25d8-4446-917c-2cf3027e4d10", "value": "3072:+rTOdz8tDS5QzBK3vV6Lfz4KnpmfdXf6PHdhBwRpkGmeiU:+rCdz8tDkQzBKfVqK+ORpjmed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685009555, "uuid": "bb7b5ad7-ae6e-48ef-a308-bba3ae1f6c2a", "value": 270428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685009555, "uuid": "fcc48b97-62e4-4b99-a450-d543385aa7ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009555, "uuid": "6a775448-7be8-4b59-a3fa-528ad9fff04f", "value": "fanteaguePlumbe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3895c83-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684997220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997220, "uuid": "aee12f87-7293-40cb-ae30-d7c2ee552cd5", "comment": "Malware payload (Quakbot)", "value": "7840916e33290395bbc864aaa2ad3bd6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997220, "uuid": "9fb8b12a-82df-4787-9166-1b0421856821", "comment": "Malware payload (Quakbot)", "value": "20423afb0a5fce5946e241bf6725005ea9e8ac27ee9c8536000385a1f517a8b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997220, "uuid": "711c4dd7-fc8e-40a8-850a-de490edc4831", "comment": "Malware payload (Quakbot)", "value": "a6218b9cb8a3dc98bb9cb6b16a3a55922cf2f770", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997220, "uuid": "50ef3f79-50d9-4bd4-8030-52e32d6243c4", "comment": "Malware payload (Quakbot)", "value": "4b695c95827c38c9da5c79c2c6fbdf5f7ada64aa09f0178fa7656be06077e3f0db7d8076bc82ba7ef1f21541afed305d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997220, "uuid": "1a49b611-090f-47b3-a027-24c054fcf64e", "value": "T1DE5487844B1129B64B5B6E227730A4B9EBBD1E74C2C8468BF45F3261F7DF98CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997220, "uuid": "f150b2c3-37f7-4369-ab95-1490f104ad26", "value": "6144:bIHamjmwHesfCadsAxqNqJp9np3ZahV1Nx3iYFObibf:bTFk3Z81+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997220, "uuid": "bbabd6d1-02e0-46e5-ab8b-43b6ce2ea909", "value": 297460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997220, "uuid": "e9aa306c-0dbe-45be-b23d-bca07a5204e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997220, "uuid": "70487bfe-4c01-4708-845b-ae6aa2c412fc", "value": "leiotrichy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f6363b-fac3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1684995230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995230, "uuid": "aac59d6a-bc50-4cf5-be63-d5313180c889", "comment": "Malware payload (STRRAT)", "value": "c9228ebd79456c68204136e4915ba670", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995230, "uuid": "63d8e548-755a-43b6-8b87-d41e230ae5bb", "comment": "Malware payload (STRRAT)", "value": "20a3415d0a8d1f3bbffd11907927826848e726de293dea34044ef855394f08c6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995230, "uuid": "f0108b1b-10ce-425a-8473-e59bb02e9c97", "comment": "Malware payload (STRRAT)", "value": "12aa8e4b1df41ac9e8708ae8efb145f08cf395ca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995230, "uuid": "5f37713f-4606-4cda-98a6-2b887e73b700", "comment": "Malware payload (STRRAT)", "value": "141702932679eae996f13e10eac3d0018bb30e4cdcb448f7fc01eb727e63f4006d4a6506c17b0d6d330f9c12e2a573a3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995230, "uuid": "0cfca9d7-fd05-48bb-b0c4-27913d105bfa", "value": "T127749D9A6996432CFB74720475E5732F49F88E5ED331C82AEC269F0D9FE125DD08928C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995230, "uuid": "f56ecb6e-213c-4253-96ea-c228c41c0448", "value": "6144:2zuGPAciKUXpvtPScPXpmgY6g4QkKTTvy2O2+47Eo5jeVsi05OJUTym:JGPAcVSv1xmgYR4QkOI2+46si05mWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995230, "uuid": "6785bca2-faab-4b98-80b3-51d20e26b88b", "value": 354020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995230, "uuid": "35b6d9ef-b6b2-4bed-b245-241763e412e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995230, "uuid": "dfdb45bf-c765-4a6e-9611-9d97d2a28bc3", "value": "Purchase Order No. 024052023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38b0c2e-fb03-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685022910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022910, "uuid": "69809adc-5252-417d-bdd5-98cd718fb20d", "comment": "Malware payload (Formbook)", "value": "669c5119b5ed2502aede9c8337158ed0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022910, "uuid": "9b7971d4-59b5-4b37-9fd1-867773393938", "comment": "Malware payload (Formbook)", "value": "22515e24bf09d7d7b9ed02436f05853d5174aac248eb79c2b32a82096c8b30a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022910, "uuid": "25fe66f9-46ca-4a0e-b624-baae28bdddc9", "comment": "Malware payload (Formbook)", "value": "9a4942435c471689f5a3bc3d6885ae3993d43c99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022910, "uuid": "1c24c677-1f58-4bde-a815-c87631cd4325", "comment": "Malware payload (Formbook)", "value": "3a668fdc1f7c55287feb8975608c243d27a2ce0a199f1134aeb23ba51651b7d0aae50441730236aa67b7025a86ad55a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685022910, "uuid": "c2c01f7d-744d-4a15-9f8a-aa7322078920", "value": "T10C155F7D15AAC9AFDA30C7788FE0F16FF225972375494E2640C6136F090A926B7C252F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685022910, "uuid": "826663ec-8906-4e04-b5d9-590e236e5f6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685022910, "uuid": "bbc9e24a-fbb7-41f6-88ad-d40c9db79c91", "value": "12288:1UJ/KCbLPEFTaiTB2QwuyhDH2L+Vd/6VEnixXIAk8jgmld5:iFDPQfOpH2L+VgvIAk87lH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685022910, "uuid": "5f2504c0-c849-4d67-aaab-d2eb3ea7cf50", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685022910, "uuid": "f167b8a8-f38c-4583-9167-cbb402ada3bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685022910, "uuid": "39fae492-b467-47bd-9090-731f08672432", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7546a3d7-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997868, "uuid": "f2753a87-4cd2-4bfb-856c-a1af0c04ccf9", "comment": "Malware payload", "value": "7f98e42af38d6574e7279e165daf63d4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997868, "uuid": "d76d7851-56a9-4a68-8432-16e0aec8e2af", "comment": "Malware payload", "value": "2261435210404393dcfb8dfa5ead471d0045a2ee9ffdc0166919b53b7754c8ab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997868, "uuid": "0e8195f2-76d6-4e2e-ab0f-89d931289c8b", "comment": "Malware payload", "value": "c5702eddd90120339d48e5b09385a44841a70275", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997868, "uuid": "6d92414d-2af9-4d18-a2c5-6521f46f23be", "comment": "Malware payload", "value": "453a4b31ce951248a8fa1f01d673ece10bfb3c3e98ce8bb80235c2f753b2c24da3dc8a510674a50657a91f8948c02661", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997868, "uuid": "e0e6b220-8e19-4285-b8c1-c243ee37b490", "value": "T1C744B784475129B24B5B7E366730A4A5EBBE1E75C2C8568BF49F3250FBDF98CC8C1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997868, "uuid": "62095b8f-c7f5-4f1d-95c6-79d8f62b1167", "value": "3072:4UJp/6FoErckVKdymALdSZsc71k2QU9XsoldNFq5l8gTikR/A:4UJp/ioErdVKVEdRc7623+8gTiu/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997868, "uuid": "03858f63-c9c9-48f5-bcb0-ebb57f6e0a4c", "value": 254094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997868, "uuid": "81cdbf92-b977-4d47-82b3-a8acfd51bbd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997868, "uuid": "30f4b8a8-b07a-40d6-924d-f31a0f752a3b", "value": "Sailsman.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba043c5-fb11-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685028748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028748, "uuid": "e66678a2-d946-4296-a4b7-d2efd53b27eb", "comment": "Malware payload", "value": "f0e885fd2ccdf96dd69353ec28136f11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028748, "uuid": "d98ab09b-9290-4d5d-93d3-9b1de144d44b", "comment": "Malware payload", "value": "2299d295a8b8dd467be869a5009dab65138c0e2699d919cb4674b706ad05db15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028748, "uuid": "21ec2b41-4d1a-4562-b4e4-a31d4894c5bb", "comment": "Malware payload", "value": "5f749c903972e635de431aa184aecc474bc3cf7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028748, "uuid": "ba149e9b-7e3c-4d00-9d1c-10c854d7a5c0", "comment": "Malware payload", "value": "b4b2a0e1038fdb48dfa9082514f36a75914bbf6917548f159df7a1b42f2038d12f6b63a04c0682ad81d8185860d5d662", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028748, "uuid": "34646e95-0a6d-46db-9566-b3adfe70014f", "value": "T15772AE76AF19CCFEE5C834B0075A07015A379DB91036C34362F1482E297E939AE5AB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028748, "uuid": "89b6e912-43b2-45d6-b283-6b51379aa976", "value": "b1571b158c9d7c0146c468582b1a1669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028748, "uuid": "07ecbcb3-daa6-4b35-ae12-aa61ed2c136e", "value": "384:Yx6/zOgap8qH+GIgQGmkQsfjP5xftYAxDr6+S9Pfu7n5dwOi9:Y5gaGGIg4kQA5Tx6deVdwOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028748, "uuid": "97a18602-67d1-447b-9abe-b091cbb17128", "value": 15982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028748, "uuid": "9c915386-154a-4e2e-b28f-61b053bb9529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028748, "uuid": "1d8a13d2-2a37-4b85-a280-c710a4d80507", "value": "SecuriteInfo.com.FileRepMalware.8747.14832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94880a9-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997230, "uuid": "8c8348b9-b7a9-48d9-9c47-ce0bd1337d68", "comment": "Malware payload", "value": "25d187921f438c228ca722fc4f86e34f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997230, "uuid": "cedf0282-0e4a-4f85-b651-bcf663fb7597", "comment": "Malware payload", "value": "22b365c6ea81c15a5fc2849bb513a6557c25e921f834960d9c3eedfcbcfd97f7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997230, "uuid": "eb1d7750-3372-44dd-91ed-ca94112eb174", "comment": "Malware payload", "value": "87d0a21dddfe26faf0f5359492943310cffa3e9f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997230, "uuid": "bf826b09-4905-4746-863b-a44679f4caab", "comment": "Malware payload", "value": "9b282d48b50de5d72ffc3cfc8cbee447b9af67cade8bb17663df0ba7f638ffd783daed5005ab1efe99bf76d200641f7e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997230, "uuid": "0034ee83-cad7-4ee5-a9ba-3f66a7f8ac05", "value": "T127646480475124B64B4B7E26A73094A5DBBE1E74C2C85A8FF46F7251FBCEA8CC8D1721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997230, "uuid": "0f493986-d55a-41c8-996c-50a330928864", "value": "3072:OCoKq/2g5S6ku7ZAlER1wrAOEj9DNiFuWkhPcSa8qSa8GwuOoQ3wVSUWOv8uA:JM2gB/7ZCERSrAhJpioW0rYOd3wVdvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997230, "uuid": "4af9bf09-540f-43e7-8224-4ff8f48cbc5e", "value": 310211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997230, "uuid": "bb81fc5e-db0d-424d-9644-561722986f88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997230, "uuid": "6ef6e09b-aa52-41be-99a8-77d4b81180ea", "value": "lampadephore.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49df33f3-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994788, "uuid": "5d7cec9f-77fe-4215-a1c6-84f8686fd46b", "comment": "Malware payload (Quakbot)", "value": "ba7674b458f956711a54ac00754453a9", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994788, "uuid": "b0bd8423-07d3-4a64-a3c9-568da3a62b67", "comment": "Malware payload (Quakbot)", "value": "230f9745aeb5c286883bb97a44dee7a849bd224874f2ef24681beb404530c5e7", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994788, "uuid": "87791452-3d55-4d22-a64c-46d8ceb92afc", "comment": "Malware payload (Quakbot)", "value": "4cb6d280125c6061216d7ed825c01b1a5e953ed3", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994788, "uuid": "bb5c255f-900b-433c-95f2-8e899f6a87ea", "comment": "Malware payload (Quakbot)", "value": "dfe9baae28060a666d9c420e3cedc748435b2da61f705433379bcf5cffcee28221fda8fed656f423ba3ceaca426afce7", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994788, "uuid": "f0c2e5f0-3a77-41eb-91de-2adb193d5af7", "value": "T127733B5FE38013396A620125624E66D1F7A248387B65DB78B84EC36D3311CADC6BE5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994788, "uuid": "028eac6f-4c14-4abb-8c94-96a9fd136852", "value": "1536:v7fwi6kwivcLjW9WEmMdMWqrND9jYzQQQilj96:v7fw3kwvj/qudrNRYzQQQuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994788, "uuid": "8ee57117-c9da-4462-801a-4fef997d4424", "value": 78083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994788, "uuid": "90ab45cd-252c-449e-90a8-fd1828471f72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994788, "uuid": "5f2b42af-9e73-41b3-8989-f1fce41189ca", "value": "Claim_C659.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de95e169-facc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684999333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999333, "uuid": "9540365c-f449-4726-9384-634e74f79792", "comment": "Malware payload (AgentTesla)", "value": "fa4446b6943af18f93d2781f6483456b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999333, "uuid": "4fec8dd6-825e-4dea-a2bd-62837929cb41", "comment": "Malware payload (AgentTesla)", "value": "23790142b08cf28a63d035582127794c1c3dcadb7319a93a65280953f9155499", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999333, "uuid": "aae130c8-6e8e-4342-a060-fbcbe09eb3a9", "comment": "Malware payload (AgentTesla)", "value": "6fe38fd92e36dba16a45200de8e3bd13089e1bb3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999333, "uuid": "54fc17e1-8719-4eb1-b77c-a6436a99216a", "comment": "Malware payload (AgentTesla)", "value": "be636a5b57e9a0092984c1d4e65eac38a529309010493b006ee6da56fb5b453e14619c1d95fbd5da1c78b063e427ca05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999333, "uuid": "39540bd1-e0e9-486f-808b-62f84909d93c", "value": "T115E4BEC90903DACECA3385266FA23E593CE2C7E8CF69D319949807792E155A6CF3714D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999333, "uuid": "a0224079-a282-4713-8542-085f16a4131e", "value": "12288:/ql+tdvMsmeN/ECtY+MtyEMLVqYR3dkb3hnc:Z/vMsmeN/YvtylqYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999333, "uuid": "17cb690a-2eeb-4abc-9574-1f164c8d953e", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999333, "uuid": "214cee6e-b9dd-4780-be0b-3380cab6f7db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999333, "uuid": "48cc9f0b-a128-4a87-bb0e-fc8742fec57e", "value": "QUOTATION 17729.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20549b2-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997191, "uuid": "ee4f1850-0327-4885-bfe2-a713e5a7adcc", "comment": "Malware payload", "value": "e236f44e121b8cdf595f86b297d81eb6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997191, "uuid": "5dad70dc-730c-4ee8-910b-fb30d2911ad3", "comment": "Malware payload", "value": "23d1aa73ac67b5924f3d7914701d5b29ceaed6a5b7e67042f6ca6f009c82ec3f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997191, "uuid": "5f8c0db8-cd8d-4a87-b4dd-94b0e9b3b944", "comment": "Malware payload", "value": "d3f4d9dde5d16644e83dd4c9536091fc2478b1e5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997191, "uuid": "6189d7e2-728b-4669-8401-e5618e25026b", "comment": "Malware payload", "value": "6d5118692ea30f352184f6bbe7aed1fdb1fc78238dadcde8577bd7a7cbdc73e3f2162e75db9afe872721c1f3d34396ca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997191, "uuid": "d3ad72d3-c51d-4519-809c-7aa6977006a8", "value": "T12644C880471529A24B5B6F32A73494B5EBBE0E79C2C8558BF46F7250FBDF98CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997191, "uuid": "c4ae5b4e-9429-4b25-ae1d-0172d6fcb673", "value": "3072:XVCR9n8qrKy8948Tco5sfNWWG/uzi5hPdzmoC8e/Ih7pwRk:wR+ZyD8Io5sfNWW/i5Pqog/ipf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997191, "uuid": "98ce0bc3-0b02-409b-80d2-d2495067cd20", "value": 259282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997191, "uuid": "5f9cd1cd-8185-4e13-8277-d33502c32576", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997191, "uuid": "63c61a7f-8de3-4276-ae99-8400aaf4e5f6", "value": "marlpit.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b177ee-faea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685012198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012198, "uuid": "44bed09b-e26a-40ed-8832-84f5faa5b53b", "comment": "Malware payload (Smoke Loader)", "value": "8ab83aee1a16e2dd020d221bb5cf27a6", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012198, "uuid": "80dd9623-56e8-41a5-a7de-91577744091c", "comment": "Malware payload (Smoke Loader)", "value": "240e33c28d618ba23fc7489c03dcc40e3e3d2c84ef959db800321d1946d3dbcf", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012198, "uuid": "79f7238d-c4ef-4d9d-aa9d-826eec93c48c", "comment": "Malware payload (Smoke Loader)", "value": "75764f336ce6c844db3c6f7a3183c5acfb654182", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012198, "uuid": "33074627-317e-4a5d-8e39-a0dbce29d6d3", "comment": "Malware payload (Smoke Loader)", "value": "96def5a2ffd91082dde35a5763a993f4e6b80aafbddb7f01fd9261dfcde9cf1eb32a430ea862478bcb7417265117c148", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012198, "uuid": "b77a9480-7bc8-4247-b5cc-f16355711ea9", "value": "T1C5447C1352E17C61F9374A728F2ED6F8761EF6A28F59675E22285A3B04701F2C66330D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012198, "uuid": "68d7bc29-73a5-4cef-b73a-b8eb23a18a92", "value": "700f6a74c2c5bda1263d9a00d5e9b301", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012198, "uuid": "61a7ab1b-15d5-4942-8d24-bf5fff0cda93", "value": "3072:HIf9WlvUFigo/2iM7zWf0dKBer3C2K1KT83bW0NVCSH8H/HWiO5ILFQIKAM:wPYgoOiM/vdKBK3OKCzCSHIpLOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685012198, "uuid": "a266d9e7-96aa-4879-9dd9-f5826ebcaf25", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685012198, "uuid": "ddabb0e5-c943-42f6-819b-8238b57e7b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012198, "uuid": "3eb003b3-e0b6-4e97-99b7-adb27e85b637", "value": "09445899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c2ca4bd-fb10-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685028427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028427, "uuid": "f9a34a06-9c7e-4c24-9fe5-da9f952392b3", "comment": "Malware payload (AgentTesla)", "value": "73f1b726febd788d14097398b3ae2074", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028427, "uuid": "42d2e3f3-83e2-4595-bb8a-62ef8c51c6c7", "comment": "Malware payload (AgentTesla)", "value": "251982ac02a87c546ef1872b1beae28856af968d01bc0783f1034cdd73bba752", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028427, "uuid": "f82b274f-bcc8-41f5-aa50-c9b17b4b2976", "comment": "Malware payload (AgentTesla)", "value": "dc059421e22f3b69118f13249bbbeffa9018ecdd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028427, "uuid": "dc21ab7d-d372-4ea5-a74c-8952b32d0e33", "comment": "Malware payload (AgentTesla)", "value": "b0b1b84abf3148edb52a99da22a3cdcd50f39dae1de43309378dad17f5e09830ffe4d561e76f2440ff2daa1c4dc78e31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028427, "uuid": "964b24ba-92cd-449c-8e7b-7910bc10dac2", "value": "T18BF3286892999F12C33D0078C5B1111B1BB2D172922BE7AD1DB19CFB3E16FC3362AD65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028427, "uuid": "eef9bdee-2056-4bcb-abbf-3ecc91100158", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028427, "uuid": "df0099a2-11a4-46cd-ab5b-06d5468c4424", "value": "3072:zG4DbA1mu3OfK2bp8c8VLR7J6j0AN9jCHGqgc0nM4j/Vbf:i4Qmu3N2bp8c8VTgNS0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028427, "uuid": "904437d6-056e-416d-9623-7ac35cc1f977", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028427, "uuid": "21fb0a8b-8c4a-4f5e-a604-51b54ee3382b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028427, "uuid": "5c122c1b-bc6e-4884-bd50-7a86713525db", "value": "16850284269c0721943f1e372f5b7b8ecf4860f882535508343d841a3b803e43397d4fcdfa413.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac4273f-fa95-11ed-b3cf-42010a9c0076", "comment": "Malware payload (OrcusRAT)", "timestamp": 1684975650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975650, "uuid": "46e7c93c-794c-4bf3-83cb-ebc22c13a046", "comment": "Malware payload (OrcusRAT)", "value": "24a436959ca3954b751b99afa8094715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975650, "uuid": "78d155a8-7b68-47ce-ab93-b8eb6e52a164", "comment": "Malware payload (OrcusRAT)", "value": "253f16266ec2972bb94377eb6b26cb59d1705d3ddcea8c1c3a6164b46b6a1b93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975650, "uuid": "d9ed2d6f-a06c-4dfe-a6d6-caf69432a9b5", "comment": "Malware payload (OrcusRAT)", "value": "e2bda8ad165600176974c8de7b316fe1e43c78d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975650, "uuid": "0ce4eb04-a71e-4255-80ae-58912b785979", "comment": "Malware payload (OrcusRAT)", "value": "472e25adec2caad9a16a38bf119610e12f0e29379b3177d8390335ead2b55780be95e6c176eb238fb62bf895d262b4cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975650, "uuid": "88c0a651-9f36-464d-b131-73d0b21afdec", "value": "T16E15BF013FACBD07C1BE6A78B6731AC90FB8E8066452FB4F085861AD1DAB741BD15367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975650, "uuid": "e6d20ec5-50d3-4b8c-b5ec-22455d1c2185", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975650, "uuid": "ce5c1320-16fa-462f-a5a4-0388479277fe", "value": "24576:Rqd4MROxnFD3yEsYxrZlI0AilFEvxHi9o:RqqMiJLrZlI0AilFEvxHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684975650, "uuid": "07656bd9-9940-4f1e-8402-4848efaf02f5", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684975650, "uuid": "fe76edc1-1686-4c4d-a890-8e2fcb629284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975650, "uuid": "3f1e66aa-1b5c-41fc-a655-126169d67bc4", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4814003-fac8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684997544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997544, "uuid": "c10ae17e-6004-4171-a61c-cc54af6cd607", "comment": "Malware payload (RemcosRAT)", "value": "1c963374f3c33e9136fb1bafc156938f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997544, "uuid": "52b72f07-cdc5-42c1-a6cb-d6167a49c3f7", "comment": "Malware payload (RemcosRAT)", "value": "25f7dafe9c2733f96e4015ff4ee3cd63ac7716611b87c6d50b37d00df620ab20", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997544, "uuid": "97ac1f55-24ea-446e-a837-b6b70b13d4ff", "comment": "Malware payload (RemcosRAT)", "value": "a014b8afa92f6cbd9db87817d27800b47a0576f1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997544, "uuid": "7b6ddc05-75f7-4f0e-bd30-8b3368bc8421", "comment": "Malware payload (RemcosRAT)", "value": "675ccaf5532833ec1fe99f37bf7c084efc078932645d9642baee79aca04af8bb421a48a390acdd6509dc658bb07cbd4e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997544, "uuid": "527335c8-8936-44c7-8ec9-fbcfae40cecf", "value": "T1BFB2F7565B8C4C61F369E8BB425DA00E58BCF23A35C255E4BD9CE6703B7D10E0B6B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997544, "uuid": "46b2e1dc-4591-4afc-97ad-904652bf6338", "value": "768:ATGvDGdLeXXe64sL/OZMN4/1vHBuGzH77gC9Ek9Xan4xE5DFOXqRI38:ATGvDGdLGe64sL2ZMN4th1zHB21ME/ms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997544, "uuid": "2aa37ff9-825e-4af7-b592-d7ba72e3611f", "value": 25232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997544, "uuid": "eeaa04f8-c562-4f00-8f90-92d1e34d8a2b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997544, "uuid": "add50b09-1f59-4e33-8338-c33a920f2031", "value": "1c963374f3c33e9136fb1bafc156938f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb73c10-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685003705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003705, "uuid": "f1166f9d-7074-4bab-a9ce-a696663387b0", "comment": "Malware payload (Formbook)", "value": "f8f0e589e87202ce0b1657ba331e3fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003705, "uuid": "8b76873c-2c4b-435c-b712-5602215deb4f", "comment": "Malware payload (Formbook)", "value": "2692c5fb278a85db144c8121617ab7909a54281e5161b8bff920bd485ea4eccf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003705, "uuid": "961e9eb0-a875-4e5d-9b6e-09e1ccc0969b", "comment": "Malware payload (Formbook)", "value": "663812bf9037681a9dc953a3520b1f54c17c7845", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003705, "uuid": "5a053228-f865-4304-a117-0e44b2adc43e", "comment": "Malware payload (Formbook)", "value": "0ba270a063c7e9550186d94870d7718855af2cf0d90965cfab5ab4121d8232f84524d5944584bfc6daa1d44ecdccc084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003705, "uuid": "6ba86a0c-3f94-4ef1-8cfd-948a6dc9beee", "value": "T15815F19125E08C10E2AAAFB546B3F27453755C55E763C30A24E02C9B7D3BA927F463C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003705, "uuid": "b60e2be6-da51-4a2a-b7f4-9d12dccc97bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003705, "uuid": "6f05f9af-3d76-4b66-b62b-1c32ccf42e5f", "value": "24576:wP0tN5wBL+KzvB+bZdcMtBx/vCP8fWH0G:wP0iBLTBMltKP8G0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003705, "uuid": "9f6ac338-4a78-4b34-a742-43d723755b51", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003705, "uuid": "3cf0fa8a-39e7-478d-928a-20758979a9d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003705, "uuid": "45d3b69c-baff-4bc3-bf62-d38c8516b1db", "value": "Bill Of Lading - DGGA33116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130558a2-fb0f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685027768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027768, "uuid": "85194f31-c2db-4de7-910d-58a4fa72dc96", "comment": "Malware payload (SnakeKeylogger)", "value": "22b6f7c3ac65ee153028a1030ae6e2cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027768, "uuid": "113e809f-2fee-49d6-a824-ca0efc840706", "comment": "Malware payload (SnakeKeylogger)", "value": "269acaea46407b685330d380216e2a2486f011ff227ccf358a040ad2883fee16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027768, "uuid": "37ae523c-fffe-4da6-98c6-f1b713dc0ae1", "comment": "Malware payload (SnakeKeylogger)", "value": "6ea5cdbff8f14824c923ba2396993f6440795d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027768, "uuid": "5d017b17-0344-4ff9-8eae-651d7605a503", "comment": "Malware payload (SnakeKeylogger)", "value": "018dc08486bc9b79e0ef62535ec6ede119658162a32d27410d73ada481f25b9407c5e717634c6bfdd319362e330f38b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027768, "uuid": "f83ca21e-5b27-478e-aa57-1c761c662593", "value": "T114054338FD0A21BFEBA6D234E4B9190AA5F414BB33358D5EC193774D190B603749A3AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027768, "uuid": "c0711a21-6a58-4dbf-a728-a715389aeae6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027768, "uuid": "2847a1ab-aeee-4db1-9d40-f2054d36403d", "value": "12288:W6o21/8yN5af8FD8A6DLXoge/QY0xRhom/ff3m2vtw:WbYzFDx6DLoge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685027768, "uuid": "743cba2e-83be-4ea4-97e0-8b5d5ea190bd", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685027768, "uuid": "060b596e-d69d-4703-b1f3-b63db4b66b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027768, "uuid": "45c08c76-eafe-4fa1-b095-923da91ead0a", "value": "22b6f7c3ac65ee153028a1030ae6e2cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ea8bef-faea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Chaos)", "timestamp": 1685012042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012042, "uuid": "80d7e4be-6187-491a-8f9f-14308f6c86da", "comment": "Malware payload (Chaos)", "value": "3566f930e73eacee6933e672c1085d98", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012042, "uuid": "bd73c307-a566-493d-967f-a6ad1b9a64be", "comment": "Malware payload (Chaos)", "value": "290072a9e1cf3872487cf586a592be534abc894d20ffd1121fe8338f1b52b451", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012042, "uuid": "8a703292-3b96-48b8-8cc3-346981a4ecf9", "comment": "Malware payload (Chaos)", "value": "d6c5408fabbf943721946073c80049c3c65f8c8d", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012042, "uuid": "4f4b3bff-3b11-4d42-81d0-36ad2c57404d", "comment": "Malware payload (Chaos)", "value": "ea85a53271f2ce770ae9b03c5fc3786b6641073d7bfe34a3237106cf7093582bd91c72037447a81d180d912dc0c8e101", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012042, "uuid": "f1c8255d-9def-468a-ad4a-3fc85a0911f7", "value": "T1161628243DEB501AB373AFA69FD8B9AED96FF633270760692051034A4723D41DD8173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012042, "uuid": "f9f5d68d-d135-4a8c-9307-19111696f11e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012042, "uuid": "2113c769-2ddc-4457-aa8a-c61c4cf291fc", "value": "24576:TbnWYoXXBzGmL53TaX+vnyuNMOCig82RfVL0K1RWLghaPZUwB74amJl4aOLW6u3r:/W3XXBzhaWBq8Yy8kZmzJ/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685012042, "uuid": "8f28d6e1-1b43-4fe2-90cd-82e9cb7b5984", "value": 4024832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685012042, "uuid": "0235bac3-946c-48b4-927a-2dce15324917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012042, "uuid": "f583431c-5137-4874-b4b6-6a385152793e", "value": "008247599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c482aa4e-fb19-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685032360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032360, "uuid": "aa8fdefd-fc3d-4411-9ea9-9fe62b0b324b", "comment": "Malware payload (RedLineStealer)", "value": "dee1f902575d7fcf3c4b5a8992f15a50", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032360, "uuid": "89cae5d0-cf35-48dc-906c-826b40d97ece", "comment": "Malware payload (RedLineStealer)", "value": "291d8988a8f46bda0aa9b2fb0b5267442ca40e4a115cb58c0122f70238cbc609", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032360, "uuid": "c418237d-4eb4-4b6f-b371-c3cc2d348673", "comment": "Malware payload (RedLineStealer)", "value": "93a56bb230e9a0a8b07513580278840f3f21a8f2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032360, "uuid": "d2d0ef1d-e8fb-4094-86cb-c289c5646f05", "comment": "Malware payload (RedLineStealer)", "value": "18aff1cca1149eaf05ea5fbd7c0a15cf0103ce634112926ea8e4e4f1dbce00345daf8a45b1585816af069208248a88f0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032360, "uuid": "a4e26d75-6266-43a6-b4c0-d13f0c36f3d5", "value": "T1CDF41253B9C89163E9F817B048F603970E34BCB09DB856AA2386AD5E1C736D9D13172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032360, "uuid": "b9311211-83d4-4e2a-984c-4c2f9413a491", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032360, "uuid": "983015bd-18d9-4acf-863f-c4dd28adc4c7", "value": "24576:sycqZmkeYejbj0d4PIjgoEEApj+9S2bmTg:bJskeYegdBcxDoSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685032360, "uuid": "53417079-c96f-41aa-90b4-1fb08719ca57", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685032360, "uuid": "35c0ccdb-304e-4cd3-801e-b751965c1f76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032360, "uuid": "71c00419-70ce-4485-9b6c-9014ea25c043", "value": "01587399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b853ff-fb36-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685044621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685044621, "uuid": "be0f83a3-f4f8-4124-b31d-e648049754ab", "comment": "Malware payload", "value": "9e52f104cc0e400f40459102d04c0aed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685044621, "uuid": "a2dcd83a-131b-462a-91fd-b062ff2358d7", "comment": "Malware payload", "value": "299ae162e9f2087ae41bdc77baade0d35bb21e31fec2f4580747d753f1f5af7a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685044621, "uuid": "6b761506-d951-462c-8d67-e4069d2b1545", "comment": "Malware payload", "value": "ef552215772503be5be0bada0375940e2bc9fe48", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685044621, "uuid": "c3c581f5-61e9-4870-90b7-91947a925fcb", "comment": "Malware payload", "value": "f3b706688c262120f2cdfed2cfbe3961b2fb01d40d9536303671a3bc215850ec08be8f095f715ce26dfbda01afd1fa90", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685044621, "uuid": "3a78ae2f-ee3a-49d4-bf1a-9762aed31fc0", "value": "T1C2151E6013E99A0CF2FB3F552DB952846F62BDE6BD7AC15D132024AE0D74E94C9B0732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685044621, "uuid": "3967e353-111a-480a-a6bc-a7baa2f0c26c", "value": "3072:8a1ygSq9hU+r+gTwx6WgdueyHtMypV/Ly9TBnJmgw3Fv8omjXLD8EIs49o6I5Pam:CKIlhTrEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685044621, "uuid": "07a5c600-0ed0-4fe3-a253-1f882bb18822", "value": 876890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685044621, "uuid": "8887ab2c-366d-4248-8637-a5661dc19e65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685044621, "uuid": "15fd6683-2c72-4e79-b4bc-4fec246328f3", "value": "file.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f975d892-fae7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685010974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010974, "uuid": "9b7fd335-1879-4196-9ce7-8b66cdf19aa5", "comment": "Malware payload", "value": "7cc9a2ef4dabbcb7ac04c56fd3f52038", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010974, "uuid": "16166182-b998-42f5-bb22-0e5cd58b0321", "comment": "Malware payload", "value": "2a05bd961a43d8caa8b7b9bcbe5fbe4ec8e69f8f58407a5f3e496efa08396c3a", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010974, "uuid": "f4815f56-dc57-462a-be08-150bea4a56b5", "comment": "Malware payload", "value": "98a93395fe9f3c71624ef418b810c13bf80549c9", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010974, "uuid": "086a7352-b707-48b2-afae-5d7a7e5487a0", "comment": "Malware payload", "value": "5df7eefdcbb65369044273bfa36ab4072df298c5d70420b16d9f0e04b28da428cf1e54f82a1c5ff6dcbf662b8b1b0d55", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010974, "uuid": "0e00ad8a-ccbb-4fe4-8e65-3267ca74bf0f", "value": "T17E452BA09B600572E19C473457E92750E7B6FE11A3B283A3318D571D5FFA7840F2097C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010974, "uuid": "95f05d5c-4bb5-43b1-a33b-d4d422e5461c", "value": "96:5jENzjHMzjHU0f6CjyPW48hdtDfb531oAxHaSZGzzRd694gze1zVXfDQ8sgR:dEVjcjDd2W46dtfb9z4zn69kHXfE8sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685010974, "uuid": "47a712a6-9093-4d46-a1fd-fac6b5db450a", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685010974, "uuid": "eea38c64-8ca8-42af-9b3c-97c01439a489", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010974, "uuid": "b6f10fb7-fc94-4e05-902a-301f947dca78", "value": "nIM08423_AYFTRANSIT.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247c1218-fab3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684988283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988283, "uuid": "b6912973-cee4-4e73-a372-d2833f2f6332", "comment": "Malware payload (Quakbot)", "value": "11b4f5c5d1086ff8775f941f906d1a0d", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988283, "uuid": "b5bd6cc8-ff18-45d1-825c-efc14df40ee6", "comment": "Malware payload (Quakbot)", "value": "2a44611b2bc68002d95926c7ceeb40751f41744b3d503e1a880d6a898a4c4e33", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988283, "uuid": "420e5097-9993-4e76-8da8-dad40e499c51", "comment": "Malware payload (Quakbot)", "value": "4ad984f80ea8147034c2b409f6598aa2ad803a43", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988283, "uuid": "8dd55db9-c582-4e6c-910f-243e95accdde", "comment": "Malware payload (Quakbot)", "value": "1ff08d7dcee60db48154c98f30e763f23dac083d4b6ea5c05992c2b29a56852c2c43c17f67603725d291dde4178f4977", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988283, "uuid": "6b5026f8-084e-42ed-8427-cd1aae48d756", "value": "T1CB832A5B9380133A56220135660F9BE5E3A4447C7B72DB74A49EC2693352C38D6BFAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988283, "uuid": "04683c33-6d20-436c-aeba-6c72302d2dff", "value": "1536:/l3Djn/3NlDCqd16gE49lDhslm/0jI09CEQiSVDTCmpfQXB6FNA1ktfxF8H:/BT/3NlDCqdFE+lDylm/F09ofCYNA1ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684988283, "uuid": "620bf2f7-9a80-4055-a179-de47723b490e", "value": 84373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684988283, "uuid": "3ba2e5c3-df9a-4007-b76d-c24452ff8ea8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988283, "uuid": "e8124f85-6a85-470a-8da5-b3536d3451c7", "value": "Claim_E175.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b10e4a-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994800, "uuid": "d6bd21a8-6d5e-4edf-a02c-64cf046e930c", "comment": "Malware payload (Quakbot)", "value": "7bcca3b3038bcf41bd00b37e204e6d8a", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994800, "uuid": "87995d3c-785c-4cd5-86ae-84ebb85f7522", "comment": "Malware payload (Quakbot)", "value": "2b0cb1b1d96a35aaaf2d823ebf473dee9a841af77392a3e9b8975eea2854212e", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994800, "uuid": "7a37220f-64f8-4ac6-8104-46336ac631b3", "comment": "Malware payload (Quakbot)", "value": "07bc144cf0af9048645a5b9d5d19a2b3f0e61472", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994800, "uuid": "8de84e5e-5115-4a31-9414-d798c75756d4", "comment": "Malware payload (Quakbot)", "value": "ee7e9d58747a21c99485fc7d278e12a9e54322fe2b2f475017d5ee5c5ef97cff141dc2a67ba9be0ce244e9be69b933c8", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994800, "uuid": "d47d8ded-149e-41c2-829e-80ef86a979f8", "value": "T19563195B53850335156302646B4F5BD2E3B894B86A26D678A49EC2793342C38C7BFEFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994800, "uuid": "592fe3fb-1e17-4978-80df-bfe669f8b168", "value": "1536:V0WdWgGqNxbP1wVsb49lDhslmblmJlmJWkbm3vTYl8BTN3DbQ9lDCBrGUP1+8GWl:OW4lqNxhnb+lDylmblmJlmJuv445b2lO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994800, "uuid": "24aef1e1-ab16-4412-9ebd-eb85712fbcfc", "value": 72753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994800, "uuid": "7cbcd3d2-b4b2-44d2-875e-a5a875858c4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994800, "uuid": "74978a1f-7f29-44f0-a9d7-e29dd7a2a658", "value": "Claim_A604.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5e0493-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994793, "uuid": "d0912e4e-d4c4-4bd8-be74-caf8ea165232", "comment": "Malware payload (Quakbot)", "value": "cee7684fd7f9421e28e91a4fc9f2c0fb", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994793, "uuid": "10643cb8-9e63-4080-ab42-47c70163af66", "comment": "Malware payload (Quakbot)", "value": "2bf2d8236514a187858fce66a8c2eebc708d922e0eabf3701496a156ffb934a8", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994793, "uuid": "392b46b9-b20f-4c2a-82bf-d363bb9602bd", "comment": "Malware payload (Quakbot)", "value": "beab4b5d046d3bb4dfd59e95e2a9283f01a73a67", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994793, "uuid": "c6fda1c6-02e3-4020-aaff-9c70dbed505b", "comment": "Malware payload (Quakbot)", "value": "2f65a5ed3a339584e8d9a3131c55ba147db8c083774dc0aae0c5bd83853332ac142d1805e28a4225a767837e6dfdacdf", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994793, "uuid": "933107bf-daad-4840-9107-1dcd9c541f82", "value": "T19D731A5BE381033966220275514E66E0F7A188787A61DF78E84EC39D3351DB9C2BE6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994793, "uuid": "1cd32956-471e-4ceb-9339-8f4a0d71270b", "value": "1536:YKZOVq7wi5cwwicZObZwioNfy8/LmFJqsMB8FIhUaBu:YKZO8wIwNZONwbNfy9osM6FIh3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994793, "uuid": "bd4dcca2-3d12-48cb-be89-aa32bf996fe5", "value": 75919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994793, "uuid": "e277b3c9-2cf5-4f92-a87d-08a721edb255", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994793, "uuid": "ff217c32-ef68-42b4-beb5-e2ca4e063368", "value": "Claim_C479.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028a074d-fa93-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GurcuStealer)", "timestamp": 1684974482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684974482, "uuid": "c127f89a-b9b2-436a-8235-347ff8396328", "comment": "Malware payload (GurcuStealer)", "value": "fdb8081ac26d8de3f7582b2616bcf3e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684974482, "uuid": "2716e41e-a2bf-4846-9ecc-8bfb6378399f", "comment": "Malware payload (GurcuStealer)", "value": "2c2d57d1ea08595db9a8a6c1bf8dbe40fac57a9b784eff00c4095c72fce80e98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684974482, "uuid": "be32aa2a-d9d9-4e64-9950-6f2388d41465", "comment": "Malware payload (GurcuStealer)", "value": "c46856c1394a0b36f7826285db0d72ae494f15f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684974482, "uuid": "4e93750f-4338-4432-aeae-da1f766410f1", "comment": "Malware payload (GurcuStealer)", "value": "1eea87281db0da297a7ec5ac62936f2c78c1496460be4c719dc1b9843ffe136b707658139093e5b9397f119c43bc2cb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684974482, "uuid": "1b40a307-88b3-4c50-a63e-11bcc1a90c46", "value": "T1B8D46B4C7749EDD0EFBF41BDA47627009334C0435214A6173FEE69E6ABA26406F4ACAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684974482, "uuid": "a45c7caf-139f-4516-a821-626dae4d7077", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684974482, "uuid": "6b584798-dde3-449c-98e5-3bd11d9c3103", "value": "6144:kH5XgP9i7Nss/t/a2zDGVPJXvnzZjDJHb571Kjn1929XDccH89bq3vcebsVDsu:8UkRatpvnzZjDv7oj19yTN3vi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684974482, "uuid": "6bb386f1-2331-41df-8226-eb4c25c04cfd", "value": 614120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684974482, "uuid": "cdc2b219-8d51-4774-8e74-02693d0841a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684974482, "uuid": "54a46fa2-7e41-4587-bbf9-e9a0c0eaafe3", "value": "SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5291ea-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996614, "uuid": "271f13ad-c841-4039-a540-8f241a7bdb68", "comment": "Malware payload (Quakbot)", "value": "ff5ec0cbe0b4ac39dd518c1aec25dbb2", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996614, "uuid": "89543972-ae70-423a-b91f-b3c3e8c0b1a6", "comment": "Malware payload (Quakbot)", "value": "2c2f9d89c0aa43aee4dee9de5e4c09eec97825fe1999cd8846a69964d8304e14", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996614, "uuid": "4193ee3e-9ca0-4a65-8cd3-16f5445bccee", "comment": "Malware payload (Quakbot)", "value": "9766f8d52d599b3e1823e596a9958680fdaedc2d", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996614, "uuid": "9a6a411f-f465-43f7-bf4c-851a8c2a9ecb", "comment": "Malware payload (Quakbot)", "value": "cd97881ffe6373f2e71b8f77ca4aa9551704d24790e55214359e6aced3cb387b4160faa02bcebafaf0a5ab76735701e5", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996614, "uuid": "424005f1-0dce-49c5-bbc4-abe6eafa6902", "value": "T1E473285B938113392A220235654E5BE5F3A4847C6B32DB70A49EC2693341C79D7BFAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996614, "uuid": "a9e5b367-00a5-42d6-811d-046f023a7417", "value": "1536:U1cl9lDCdvcSMdMGWPVw0WKlPRYmJ7siNbgNHSPxpr8n8aBC:kcflDCdvcNoWKlPRkcbLPWfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996614, "uuid": "d404123d-7f24-4900-b705-4a857fd2473f", "value": 76938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996614, "uuid": "806af75e-ef70-4fa2-97ea-831000d25a47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996614, "uuid": "4c917805-9d2c-4c29-a25f-7da91153e362", "value": "Claim_A829.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e37a97b-faf2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685015465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015465, "uuid": "3550111b-d1b5-49a5-ae97-f6bd603406d4", "comment": "Malware payload (GCleaner)", "value": "ecb56d67eec8f5b39efb78d74415db2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015465, "uuid": "34769a21-b436-48b6-99e9-c901da9ef98d", "comment": "Malware payload (GCleaner)", "value": "2c735da73853ebc6bc1729c0d2ddabc4ac2d77dd6c88ec169bce9c141a4072a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015465, "uuid": "7efa3975-0a9d-45dd-a1eb-923b134faabc", "comment": "Malware payload (GCleaner)", "value": "3b88989aa56372ef9e5e473f7d4652644db6758f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015465, "uuid": "e5814a09-286b-4e22-9f08-5807dd97594f", "comment": "Malware payload (GCleaner)", "value": "1a5afcd325244bf5c6491766571ee82707ac4a298eff9e62c8f1b89359a81ab8a0031926b3233125d1a9afbd89601aad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015465, "uuid": "18fb0821-23b0-4e6e-93f0-2412b6d51d2c", "value": "T11DA533D3B2B8A436E6F00F786C554B387067B8301833917C6DBA67AD3E5715DE40EA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015465, "uuid": "23f20900-2f57-402f-af9a-ef12d004601b", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015465, "uuid": "07825f06-43f1-4e94-81a9-7937f876aa79", "value": "49152:Cit8Aj9GXkUJa5ebfmrbrh+x9kMc1Za3puK+ls+zFss8wuK:CiWAjg0Ok4+Dh+4PasK+e6tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685015465, "uuid": "a652cbcc-9e60-4e61-a448-c499853b505c", "value": 2183824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685015465, "uuid": "1a74d4bb-5cc9-4f0b-a405-27e0b75a3e39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015465, "uuid": "67be27ed-80c5-4aed-a414-d769f11ff0f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2718e65f-fb03-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkTortilla)", "timestamp": 1685022647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022647, "uuid": "2a68152a-7025-450d-98b3-c8376cff3fb4", "comment": "Malware payload (DarkTortilla)", "value": "748b8492f205cc920a421b43dc2d8712", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022647, "uuid": "24feaf7a-323e-478b-8215-960c6541c73b", "comment": "Malware payload (DarkTortilla)", "value": "2cb7398c7dd9ee95d280bd666f70ec51313bb5760254d33d40ec2e22d53b5206", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022647, "uuid": "44405e3c-43c6-45de-b2e4-05c282fd8bfe", "comment": "Malware payload (DarkTortilla)", "value": "f89672902f44fef8535583906d3692255bb95572", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022647, "uuid": "70f61f53-58fe-427e-8abf-cf49946b6f9e", "comment": "Malware payload (DarkTortilla)", "value": "50b31e23341787fd6298bdc6bfcbcb12c5337070910ca8e9e6282d8d2d80754a6f3b6cd22cf1e22c7d6c4f075cb3fb03", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685022647, "uuid": "88558eb6-6dec-46ce-8d17-0cbd5fcd7c25", "value": "T16DE4E14757D49F84F93F62B66AF038908AF2BCCE48B1C62D0E6174F96D727801A91772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685022647, "uuid": "c5965f53-f2b1-4b78-84ad-7e80c2868a19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685022647, "uuid": "f12858c6-d842-44b9-8953-7c68d1e33540", "value": "12288:arjM5uxjcrWsUPEfIifqe8ES2FTLyAuNo+WWjQkwHnt:ar0w2IPEIb9NBXjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685022647, "uuid": "c1d7b619-4c68-4fb5-ba36-4cfd31191e5c", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685022647, "uuid": "9eaf7e8d-26e6-4b3e-a1a4-caa6c2657c28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685022647, "uuid": "384c4290-7ed4-464a-aeae-d609b71e41e6", "value": "SA-282339442023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e07cb8-fae6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685010274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010274, "uuid": "d64f3311-457d-4f25-a56b-cad91360b723", "comment": "Malware payload (Formbook)", "value": "e96a25401435fd27257b2cf31c8c87c0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010274, "uuid": "7e24c74f-438e-434c-bafd-6a2eaafaa9c8", "comment": "Malware payload (Formbook)", "value": "2cfb5a9b499a9e6e96fd9ed009162a3108adc87a6321b86aaad3019311a18ae3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010274, "uuid": "fa20a9d2-5a5c-4b12-b0ec-d0278b6a4804", "comment": "Malware payload (Formbook)", "value": "fdc978a6be64867d9e03b89a93d3b8efd7f31010", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010274, "uuid": "2ab0ba13-a6fe-4aae-a449-a0b0d7d94d3a", "comment": "Malware payload (Formbook)", "value": "fd7f23e9ef302b10c97f5c7c8738bbe0fc5502b315f40cdb51e3e30da37f75a3fe2f3069857697410e57ddbb41d25232", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010274, "uuid": "fdf4736b-06e0-4f6f-84b1-d09307c0bec5", "value": "T12FD4230C973FEABBD49D007FC07639AE5858148A477E80CED5CB915FAE1D3A589EE012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010274, "uuid": "0c83c0ec-86e6-4a78-b528-54dbe771293b", "value": "12288:C8Gnm4TQWoiTh7ErKK6jIqvPYGViJPLkn7KVlfa4KbrqUemx:Cxnm4LL7gyIssJPQ7slfXKbrvemx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685010274, "uuid": "74c988ca-9ba1-4e46-9dbf-827b5b545782", "value": 600434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685010274, "uuid": "90901a26-6c3d-46a9-8f9b-361848256296", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010274, "uuid": "99f1aa86-9242-4c84-93f6-d907c5612f06", "value": "nSpecifications LIST9QsCkNSTnyQq0NL.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b500bb-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996743, "uuid": "ed0462f7-0305-4f3c-81d5-cf81c39aa1f1", "comment": "Malware payload", "value": "8eb236633d3a1fc8213e496764f3a7af", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996743, "uuid": "97aadcc0-8fdb-4904-9096-a62894d5bf64", "comment": "Malware payload", "value": "2da528edf0a979c192eb2788c04cdc9ee6e3636191f79ed13cdc7d4a235b20dd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996743, "uuid": "6f595402-2e2c-480e-9d80-c7e7310abded", "comment": "Malware payload", "value": "841d5cdfbd4da10f6dfa363974f7c5c1e0dd134f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996743, "uuid": "090938c6-954d-43f7-8df7-a9a3e3369a36", "comment": "Malware payload", "value": "46c74e0c0cdf20971c633e8c88b2dd145eeb5c841cad32f3ec6910424de692bee07e97cb35c9df06b7da955aefd469eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996743, "uuid": "6eb38761-b335-41c6-bb4d-2ba37541c297", "value": "T19F6464804B5514B24B9B6E26663094B5EB7E1E7582CC5A8BF45F3260FBDEACCC8D1331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996743, "uuid": "d9d3b42b-f3c1-4a16-84e6-1ca7fbeb9fac", "value": "3072:6E6lXgX7R38U8vKWcWEZVtZGFtYvlAf7WgbqRUDYVRAwFK2fLa:OwF3ivKWgZ7ZOMuf6gbIwmRAkpfLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996743, "uuid": "214195f1-c65f-458b-a0cf-4cccb48767dd", "value": 314137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996743, "uuid": "64c4f5ed-c23f-4a49-ac5f-c561ccf0a6b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996743, "uuid": "632ec580-7209-40bc-9493-19f0ada9531e", "value": "gaincopeChondri.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c589a2-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003725, "uuid": "86bc4391-aeb2-43ba-8dd6-3132b7676f12", "comment": "Malware payload (AgentTesla)", "value": "26effff009acf84c76f2ca674c470e7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003725, "uuid": "a90ca6a7-cada-481b-9594-cd12ac8374e8", "comment": "Malware payload (AgentTesla)", "value": "2dff59418d00426fbaa8e2e9320ba63b19484b5b99b7b8cfd65759d7dd35d9b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003725, "uuid": "0b550919-1d4c-4458-ae1c-08293dd6821e", "comment": "Malware payload (AgentTesla)", "value": "3cb6b7cb585a73938193502d9526e00660f1feec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003725, "uuid": "f0b0465d-b49b-43fc-8900-51b6a83bd61e", "comment": "Malware payload (AgentTesla)", "value": "0fdb993413d6f45a440378802c26bca362f6da0ef101107cab2e6d4402f17ad07651f1218e8bed18b10ba6177d92f0ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003725, "uuid": "394bae39-f220-4b40-8e76-5f1bd4cffc14", "value": "T199D4D070509E4A80E01FCBB168BCFC72437174F3ADE5DA350B69A1C4CE6AF546E48A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003725, "uuid": "8f60287f-09b3-4aa1-93a6-650399ff6706", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003725, "uuid": "116e75fe-02c1-4445-9028-aa3d1221c4f0", "value": "12288:rYEv5Qhkt7k5dx/VkZj/W944hCSrx31sc:3oCorx/VkZzW94CzF1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003725, "uuid": "042ef67f-48eb-4f20-b98b-eafc1ace3cfb", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003725, "uuid": "297421f8-64bf-42c8-98a9-1dd0ca1e7e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003725, "uuid": "3a823a4c-f613-40cc-af17-a256a7c2d82f", "value": "invoice-879.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b34ab35-fb00-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685021527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021527, "uuid": "70fb1e41-ebf6-4d14-8c3e-6236de264849", "comment": "Malware payload (Amadey)", "value": "1866cd4f7f2c80e789a7a803bdef1dba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021527, "uuid": "8fab5655-b028-4327-b8b9-53750ee1f2e9", "comment": "Malware payload (Amadey)", "value": "2e6c2efecfc6216b75c368382c8493a5344b99394ef9a1003458b33cbafcf69b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021527, "uuid": "7d97264d-7500-4477-9bb3-792352e37284", "comment": "Malware payload (Amadey)", "value": "d9e61fb601ce5bbadab53751c594188c6fa5f79e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021527, "uuid": "7ca4a96b-1457-4cd2-a220-fe17616fa4d3", "comment": "Malware payload (Amadey)", "value": "a507e306af9a6a3b65bed8589585b74bbb3ef2fbcf47c7b48ed880382ad422082d9dd0df0ff1f5ee0e76f0a8aaf83a33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021527, "uuid": "5d2ed95b-cb9a-49da-8ca7-fc8d1d209fab", "value": "T1F935231376D844B1EDB467B0ADFB02830B397C9189B4868F27959DDE1C71DC0AA3276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021527, "uuid": "682de95b-92c7-4883-95da-db2022f7e97c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021527, "uuid": "12ea8f9d-f8c9-4398-91fe-b5a01821d68a", "value": "24576:oyxgXRdXNocfPtyS4xVCtRliQ9REKxTG+0ufZ9d:vahdacQS4xV2RliQ9RBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685021527, "uuid": "f06b285b-db5a-41e8-8821-bdd9d615d4be", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685021527, "uuid": "28a04331-6e5e-497b-9022-7f0ba8cc6009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021527, "uuid": "e083250f-03f5-4262-a00e-9351daab9816", "value": "1866cd4f7f2c80e789a7a803bdef1dba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64eb9e0d-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997840, "uuid": "edef7811-fac3-498d-ada0-2bf86c4597b1", "comment": "Malware payload", "value": "e5591b949e4c2b47822d99ba97fa47b8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997840, "uuid": "d8f74f08-64d5-4ce4-b576-8ae4be14ee1d", "comment": "Malware payload", "value": "2ea6016331459501234a43a2c11ae69e68cdaa456545c6d2aa41a87f6f3f1dc2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997840, "uuid": "e26e4577-fcf1-4653-bab8-9d30d79ad6b7", "comment": "Malware payload", "value": "9cb5113545e5376a4eef977cc9f1901171c1e2b1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997840, "uuid": "192a5135-50a1-4ec1-a3d3-6082c843ddb8", "comment": "Malware payload", "value": "4870b9978cbb63aa3627ccfd12330f3a71a7bea4ea77be59dc86424e15b46e37805cf111d49928bc37f0f70dd664fd18", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997840, "uuid": "f7860146-bcbb-4424-b4e5-856566985fd4", "value": "T11B64B880471518A24B4B2F36A72464B5EBAE1F79C2D4558FF4AF7250FBDF94CC8D1222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997840, "uuid": "74337c6d-bec3-4bc2-976c-abb705739098", "value": "3072:yBIY6/Nd9ZpD9yCf8rW+J3tdrKE9CY/a2Lyhb8PkealGYv6GukHGRiK56UA8ps6y:ymPl/bD9nfgWOrKDYy2Ly+i6FoUbppIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997840, "uuid": "e6562a96-7ea5-4a48-a058-d84e5483ab1a", "value": 315451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997840, "uuid": "c7dd4b18-c387-426a-a835-1056153548ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997840, "uuid": "32b10678-61cf-4f7a-802f-bb81d98cdd7e", "value": "ReligionerPiece.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c09bf9-fafe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685020440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020440, "uuid": "06c0e56a-9fa1-43ce-9a6c-b4b177d8323c", "comment": "Malware payload (AgentTesla)", "value": "03c4ee1189cef2664a6b227f7fb0ad38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020440, "uuid": "7513c422-9406-48b2-97cb-e2ecf86f748d", "comment": "Malware payload (AgentTesla)", "value": "2eff68c23c7347d6a7614ae78fb7860aa81cebc0037d9c2a95fb795c2e2b3d6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020440, "uuid": "5b039c25-75c4-4380-a6ba-2a2d22a0df2b", "comment": "Malware payload (AgentTesla)", "value": "6c5cf272392e5888a8d89f346f59c0c0f36fb572", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020440, "uuid": "16da553e-2c87-43ea-b635-2d94d4eb6cef", "comment": "Malware payload (AgentTesla)", "value": "444bf4115029f59cb48710f68def66ccdc636fb35fca8388c42be81db1121c00a3e60cd82340b4a0f2239fa8df0ab156", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020440, "uuid": "f0d9719e-4d9b-4677-a4ec-8809915c3736", "value": "T1B1E402A0B16D7F5AE579C7F94030397063FBB9663422E31A1DEBB0C72A72F424211997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020440, "uuid": "fa8f2539-e03a-4d13-9e7d-1bfa0d37293f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020440, "uuid": "2f9940ba-f967-486a-be69-568b65f803cb", "value": "12288:MPRmzZBEP85AyFWx28jKLixint9zJKACPTYjoa1KzkUrkwz:b9BEP8iyF698dmPTYIzkUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020440, "uuid": "42e15a45-3c05-4403-a27d-bf4d21b644f6", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020440, "uuid": "6812a262-52df-493e-9340-466bf7096b6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020440, "uuid": "dcc460c9-698b-440c-8eba-4ba99e0f9394", "value": "Halkbank_Ekstre_20232505_075616_005737.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdac6b74-fb52-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685056830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685056830, "uuid": "93402218-47d4-4e32-9ed1-a35fb8e9a422", "comment": "Malware payload (RedLineStealer)", "value": "4027d12880d7713e1c8a11971536ce79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685056830, "uuid": "e8ca785b-eeda-4c1b-81db-749294fc9b60", "comment": "Malware payload (RedLineStealer)", "value": "2f8f321e2cdb2d638e1c20827fed16b6706253cda5a076e79528588e79e68d46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685056830, "uuid": "f238357c-376e-40c0-be40-8b19ea5ee367", "comment": "Malware payload (RedLineStealer)", "value": "ab528e8ae6fc5c6aa03d402de822af9d0df4949c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685056830, "uuid": "7a531f19-4c94-4c95-885d-400e3840951d", "comment": "Malware payload (RedLineStealer)", "value": "3cbebd4b09f40769bdc32ae49073a2df93115bfe1f2606f00c3f9aed061d18a3bc1532782ad0002a4acc8999e664187b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685056830, "uuid": "66c6ab16-e6db-4b7d-a88f-a3c0a59ae304", "value": "T1E7F412437AD88033E8B15B708DF213970935FC769E7C82AF2646F91E1872694A53973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685056830, "uuid": "33a24870-e117-4432-9edb-a84ae0690e8e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685056830, "uuid": "1dfff3dc-68b5-4bef-bc80-1d0890a3bc30", "value": "12288:SMrIy90YmoqCijQZMSR0gmW4f4/6zGuifhRp94CmEbZWscvGkB9FnM8tIW+wEe:WyuC+QZH0O4A/6qTXwJ3ukLFM81+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685056830, "uuid": "7697c9c2-1d6a-4d0c-a566-0d562778b6d4", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685056830, "uuid": "36865fa9-5db4-4b54-8a90-dd11f28855f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685056830, "uuid": "adc3d583-aa7b-481c-b069-62739af76842", "value": "4027d12880d7713e1c8a11971536ce79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa018df4-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996668, "uuid": "cac71139-550d-44ee-9f5f-59cf5d88868d", "comment": "Malware payload (Quakbot)", "value": "72250aa7ecc5346b777f6a2ee7a6f7ab", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996668, "uuid": "b7faefa9-f657-4050-89cc-e83c1995fe4b", "comment": "Malware payload (Quakbot)", "value": "2fe624d31b0a2b87cbcccae8d79ffc6862cfdac6c2066d23a609e7a193820c13", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996668, "uuid": "a854f476-c3d0-4379-b949-5af852f93709", "comment": "Malware payload (Quakbot)", "value": "d58469c2b9718f9c9b0c8dce7da2318447f50958", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996668, "uuid": "0b710757-e9a3-46c0-b585-f5bc7c505d7a", "comment": "Malware payload (Quakbot)", "value": "5dea3c16ab646ad81b7ac0c1253bb1f687d8f7f3885706e5b5fc86efadf543b96b4d39babcc24250acfd6eafb8b48b82", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996668, "uuid": "94021217-18cc-4fb6-b164-7a91bea2422d", "value": "T13D53F95B9385037829220255564F57E2E3A488787E32DA74E48EC3AD3341DB8D6BF9FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996668, "uuid": "fae1bb09-9c51-4a02-b32e-f7d8a2d5fc85", "value": "1536:55Tclio/QP/1ZOpsAmBs6XDBzGRaKG0QlDhQoTpD2DE:55Tc8FP/1ZOpscQzGAf0QlDyKpDIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996668, "uuid": "eaa4663c-5ac4-446b-9c28-0f2f401113cc", "value": 65584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996668, "uuid": "deff9562-0af4-407c-89bc-7ab0e2ae3054", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996668, "uuid": "c9281a42-b11e-49c3-8538-7727935a5964", "value": "Claim_C926.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049053f2-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685003691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003691, "uuid": "50b1deca-42e7-497a-b051-3c98a4c90d60", "comment": "Malware payload (Formbook)", "value": "10907b14ac4755b3f61c9b65a5e53b37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003691, "uuid": "2af6e01c-e793-4f24-8b7b-6e345215b49a", "comment": "Malware payload (Formbook)", "value": "2feb24d823c5830d025c8ab7f43e049e3c6c7dadf3aad26453a0eed06ac88c1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003691, "uuid": "918ec616-eabc-4014-9c61-cf0fbad1260b", "comment": "Malware payload (Formbook)", "value": "c2600535f52143f7a2c63d445c38d897869ec054", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003691, "uuid": "f822a776-63f4-401c-9d9c-5aaa9a80fcc1", "comment": "Malware payload (Formbook)", "value": "5dd73303673df4d266250c974dc357045266b362721debc4fe3ed0d2218b51577c2f957697244f14a23c904a4652e5e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003691, "uuid": "118d67b2-cc14-4f0f-9567-59d2dd993841", "value": "T1B70423B8C50946AAD41E87382310299F08FCAF77D593F0DD5A83FA06DD993B93588D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003691, "uuid": "36dfd5c1-5ff6-4912-ba06-dc6ebe72d143", "value": "3072:ruKLGAte4rafJ4F8aIkwzrMZ98Nrs0BSVxW+Zmec/p:KwDlu4GaFwPNJBSrwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003691, "uuid": "541cf2ba-b9ad-481c-8600-b6e21306adb5", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003691, "uuid": "a6462a04-e2a1-4a29-8eb6-355be12bb9ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003691, "uuid": "ae8d340b-3fc8-4590-a5c9-936c4b956b72", "value": "2feb24d823c5830d025c8ab7f43e049e3c6c7dadf3aad26453a0eed06ac88c1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab334126-fb18-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685031888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031888, "uuid": "599a4297-2d10-4bac-871d-dfb7b3491de0", "comment": "Malware payload (RedLineStealer)", "value": "bacbb786a19dc14c6b5ef858c32ffc8a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031888, "uuid": "9a427a7f-ab38-4a76-8ffb-58a7806516bb", "comment": "Malware payload (RedLineStealer)", "value": "313585d2d0a21bd87791ebde0e70d7243361f4b7d987dda6f483e1fc45f5abe2", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031888, "uuid": "0890aeba-7866-4d6b-bf58-19e9446e55fa", "comment": "Malware payload (RedLineStealer)", "value": "2f155361c7c3d4c27d6da565470006f4c56769a1", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031888, "uuid": "a45b983a-236b-4d25-b6a7-52ea85e40b39", "comment": "Malware payload (RedLineStealer)", "value": "e121114b492b77cc555ea3e61a73a277952cc636ac57eb387f470e296000b331574c8a7eaffbc66e23963c38a978d78a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031888, "uuid": "6579175b-8861-4c3a-b51c-ff83f9300a8f", "value": "T1BFF42253B6D54132D8B51B7049F5038B0B3A7DB19D794AB71782AEBA08B3690F4307AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031888, "uuid": "55f4d6b2-a0eb-45cb-a6be-f0e611bcd5f7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031888, "uuid": "e7f9b000-ba17-4c8a-b6a2-d73de5b701e5", "value": "12288:FMryy908GxBI0sVIgTl/9uCgjXyR8oUQhHC+HhvTILC4v+Q+fbavX2bWzE4DeVa:XymgB/Jgji6XmiwhLILzj+Di2b6yY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685031888, "uuid": "cd05605d-3963-499e-99ea-e2de8d545cb1", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685031888, "uuid": "71695b2d-bfaa-47fe-8e36-486328ba896a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031888, "uuid": "50c51018-ecfa-46cd-b367-b49a68251e89", "value": "02353899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b95aca-faf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Metasploit)", "timestamp": 1685017229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017229, "uuid": "e68d9728-0c38-41e2-9184-4b0fc9d50784", "comment": "Malware payload (Metasploit)", "value": "608d39b18b489fa10792a8de9352159c", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017229, "uuid": "123dacb9-c1c7-4370-b17f-0f40baa9405e", "comment": "Malware payload (Metasploit)", "value": "3185876cb0717e3d8d6afadc8cbb2d439ad01cc3f4e172936b0d0ebc398c082c", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017229, "uuid": "9ae2dcd9-8132-4b12-9f2b-fc37d18b890f", "comment": "Malware payload (Metasploit)", "value": "d1032109625af32b329e32a255212253467ebe91", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017229, "uuid": "777cc349-2323-44e2-9e46-fb8460331e52", "comment": "Malware payload (Metasploit)", "value": "2fe765249f2d1c03d95a41629d6618305b35a8982f9713354148883d0f7a5712a377ab26630c06fa082d4ee7f2ce8cb2", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017229, "uuid": "888c1f4f-5001-45be-abc2-5437d887927a", "value": "T152238130F66CED12D11C65702B97F69521687C2F4F29D2ABBA813B0C7838E64EB22755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017229, "uuid": "7eafdb69-e6e7-4735-b821-d15ba7eee5c9", "value": "384:JN3vsOiShav9M18m01y/6mqfoQh5khMP+BQaiPi6r84Ph4igyVkjM50j013t:J+9AP/bu5K3iPi6J7Hkj4j1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685017229, "uuid": "15e48b7e-6bbf-42c1-9179-90c5005d8741", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685017229, "uuid": "37e6d7a0-2eeb-4993-9055-7753529ebd66", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017229, "uuid": "c4cf70ca-007e-421c-b23b-e06796cb1966", "value": "007376899.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77032075-fafd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685020204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020204, "uuid": "0a8ac418-fe5b-487c-9a9a-97381110240c", "comment": "Malware payload (Gozi)", "value": "dc5631de9a17bbdd49df198393609f44", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020204, "uuid": "f8cb7ed9-5299-49b7-9d9a-a14a77c83c48", "comment": "Malware payload (Gozi)", "value": "31af353b8c7e7d376d2e6c761e753c264366cf2435954a9f46eeb2f99ed1033e", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020204, "uuid": "e2cb31c6-dd6d-41d6-91fb-6aa193ab3e54", "comment": "Malware payload (Gozi)", "value": "ffa40314972d310cbf3f1ef803fc378bef377016", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020204, "uuid": "5a02cadd-fa42-4cee-9c61-8298701d0d82", "comment": "Malware payload (Gozi)", "value": "40aebc70b3a247d66cd929467507020a187038b42e7aec1fc6d05d4d0b7248623c69283d48c3062050b67ac998c0631c", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020204, "uuid": "14cadfa4-e514-456d-9ab8-227af9fbba04", "value": "T106029EFF32F965448EDF5BB4E129F21CD1812DAA701985F96B0D09BC1249C879D70EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020204, "uuid": "c5dcd621-59dd-48a8-a506-664e462f7ef7", "value": "192:muv++pMyGSTbXMOfaTEl9Quca3z4U+wYvF49CERNN:m6pGSHcC8EsucaD4BVvF491RNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020204, "uuid": "75084404-c375-4f05-acc3-4fbe90c6ba2a", "value": 8527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020204, "uuid": "387b11ae-7875-47e3-893f-091f3980a6c1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020204, "uuid": "72dd9d2f-5f75-4dfe-9eac-91462a4d1456", "value": "1_IT0_05_25_2023_01.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad835c98-fb00-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Pikabot)", "timestamp": 1685021584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021584, "uuid": "228e1c8e-7791-49a6-b85d-c40b6868215c", "comment": "Malware payload (Pikabot)", "value": "adf3c31cee0e42114ee1697284435c80", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021584, "uuid": "24707c41-8c20-457e-85a7-328ac9d670a7", "comment": "Malware payload (Pikabot)", "value": "3257e69fb1e0c27d7cac1ce85f2c4156797be1979e33744e991a1e1998a3b281", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021584, "uuid": "30c4c2ab-aa47-41c4-bb2e-515d0492a8b3", "comment": "Malware payload (Pikabot)", "value": "ba24ca545dbd592737d9469bad6eeee04923c927", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021584, "uuid": "727d4a11-75c1-44d6-9760-f540b7573d3f", "comment": "Malware payload (Pikabot)", "value": "327ca58cea660255855112e9b3b2359fb06919438a263e81f7a2e8d3a7416a0a862e76b2b5e279789cd4b6f9b96a436e", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021584, "uuid": "291adc1c-fa9d-4c64-aff2-6dbed30a9da8", "value": "T1F67302E1A4B24312D0CBA7CA2560FE439FD560838ED5AB5D87521F0439232D73A5FF5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021584, "uuid": "26785f19-f18b-4945-9644-581c2cab7fff", "value": "1536:/Zp/1RTmCiHIVsT2BF5bVBvzCmsPRZJZIVJl3Wr5z5h:/ZpNRqjHwhBF5vGmARZJm53W5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685021584, "uuid": "214848ef-807a-40b7-b9c6-28a91132cab9", "value": 73517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685021584, "uuid": "2253c29f-3199-4a49-8b27-c7df7f07f3d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021584, "uuid": "f0e46186-de02-4fdd-a6a0-daac8bd67dd1", "value": "741.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09990ec7-fb47-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685051804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051804, "uuid": "0e661e40-7e78-4900-98dd-1249d0ba3f44", "comment": "Malware payload (Mirai)", "value": "f12f46688e3218ec7c75904af26db692", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051804, "uuid": "d0012e91-5886-47f0-931a-f32ee2186b8b", "comment": "Malware payload (Mirai)", "value": "326d7a93b998b64c0dc4b330c59b43059284784b496a061e8ee3f1bab71b1608", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051804, "uuid": "0b787ffb-4303-487c-b3f6-6171829585bd", "comment": "Malware payload (Mirai)", "value": "d0ea6ee142bfc329ccc1c68db7dee7ee93908694", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051804, "uuid": "d1701008-b7f5-46d9-975b-25dd85f834aa", "comment": "Malware payload (Mirai)", "value": "ad2dfc300ae76cd047a73f4b7479fdf0a34556f8630a0de49fe3441c2943cc848d2268e9dc547c98848557e525bff441", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051804, "uuid": "4c08f18e-412f-4843-aba2-d3cb7c8f843d", "value": "T125A2D01172A32D65F3ED1C3DC9AE8317F9671BFC90F6327639455520C94D24A3E38A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051804, "uuid": "a885ca31-6ca2-4059-b53b-ebe8eaaa90c2", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjUhymdGUop5ho:vvQn4j+ZO5fKAlxQs3UozK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685051804, "uuid": "9b92d278-096a-4c93-9f98-45d1ea9e4cf5", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685051804, "uuid": "ca496424-9f5a-453b-95aa-949918c8152e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051804, "uuid": "9e4eabae-fa18-4e25-a58a-1e12a0912df1", "value": "f12f46688e3218ec7c75904af26db692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8abaec-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997210, "uuid": "83a1f476-32b9-4ae4-8e10-6fcf17cbf5d7", "comment": "Malware payload", "value": "48e77c4b59ec90cf3a68af380919ac21", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997210, "uuid": "2e7936e4-8b81-4960-ac2a-945f26b5c8cc", "comment": "Malware payload", "value": "329f07561fd5d9d8d84c5f1319327f054fac58e4df1f6146665c9df1c37e3833", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997210, "uuid": "442bcf9d-8513-4792-81a7-b09434a4734f", "comment": "Malware payload", "value": "9fc62429db0075af070f7628cad4587a39043b14", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997210, "uuid": "bbcb4490-11fd-483a-911c-43ce091f4894", "comment": "Malware payload", "value": "30b850c7896c8d6c6f19cb887c252ba067e09b3ee5a15fad65fc633f0b1b00ce668fd070207e3a611679072a53714a31", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997210, "uuid": "e26d2f51-2a5f-4e59-a833-82ca490ab4ef", "value": "T10B64A784471129A64B4B3E26B730A4B5EBBE1E79C2D4468BF45F7260FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997210, "uuid": "695bccaf-baf6-488b-b28b-faa52905f58a", "value": "3072:Xn0tBQzFwHkPwgf8GXTFY9+ROYL6LlA1KN34IYbMc91nAKU0uWA1gjPt0:XauIKwgf3pY9w1L6LlHcDntUXTWju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997210, "uuid": "928ecf5e-d4ac-4e23-a33a-5099604190a2", "value": 307841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997210, "uuid": "06eb707c-d05a-49f0-89f1-aad41cc7e98e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997210, "uuid": "4d2066f7-c81b-4cc2-817f-d80882ea5b9e", "value": "lollypops.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bf17be-faf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685018598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018598, "uuid": "11273836-d8a6-4771-8e47-fac739760492", "comment": "Malware payload", "value": "23a8af561f1135bf4763e4ace2f2262a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018598, "uuid": "dff14590-df38-44b5-a366-a8d624ed9fb9", "comment": "Malware payload", "value": "347380502b035dcbce0321955699615b9175dccf284937efd01fa7ffc8835a9e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018598, "uuid": "6642508b-3310-4645-bc5a-72d1cb61d6a3", "comment": "Malware payload", "value": "783da334d5f68ccdd6b94bd890c0581b99df25f3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018598, "uuid": "f8560550-74af-4b35-97f0-857ae825963e", "comment": "Malware payload", "value": "2daaa1e94ca6c4f5f4e5296a3fe740be7bc62abc57b95cda0dca10d92ada7fae9b06c3e2d06edc152eadf300b7438af9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018598, "uuid": "2a578d7d-a405-45da-9dbb-2df378ee64a0", "value": "T13114A7804B6524724B577E2A6B3094A6DABE0E7182CD5A8BF45F7260F7DE6CCCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018598, "uuid": "f0a72f25-3d13-4647-9eb8-b904018263f1", "value": "3072:aisUJr4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:anDqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018598, "uuid": "12d256cb-7d58-4b1b-83b2-51ca1b669e1e", "value": 205265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018598, "uuid": "1c53e8ef-b3f8-45f4-8d4e-1389ca65f7a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018598, "uuid": "e7a3179c-4250-4347-ba01-2bad85f3b68d", "value": "Gtnamd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957265cf-fabc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684992338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684992338, "uuid": "1b12545b-750d-45e3-ae46-fc15022962d8", "comment": "Malware payload", "value": "e21ee98779010c0e00c90aa4e5e17995", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684992338, "uuid": "14ca3300-91e2-42f1-bc48-18608d8e10c3", "comment": "Malware payload", "value": "347fd3bc8302aa366b2ff4e4e02a522747df60fe61f1e9a2de8c0bc7f7b944be", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684992338, "uuid": "3dbaf69e-edc0-4ec3-ac7d-dfa471c7f1bf", "comment": "Malware payload", "value": "16d7b93ff325f9f228657fc1c54d3551be6f629d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684992338, "uuid": "6c722d41-dfe3-441b-9385-6dc65eaef5db", "comment": "Malware payload", "value": "98c88d5f2a6cd1eac13fe744ff22959d2e218a882ef0e39fbc01dbbbcd218ed857e45780699cf75acf6bf31402c1d71e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684992338, "uuid": "f45523ac-b993-4ce9-98f6-cb76e3d05ce7", "value": "T133767C4A3AD508DCF8598F729FA503A833DD33339BAC0DD6B6080518676DDB94F4DA1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684992338, "uuid": "941b7f33-3175-4057-9fe2-c1e68b6bfd90", "value": "d14ac171253cf4e289cd276f47898b08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684992338, "uuid": "09eb9bfa-60db-47f1-bd1c-cb5274c25fba", "value": "196608:kvI3PF+j7iH2AwPHoPxTeWflXDmkY61c9yl:kzdbP25fpDoAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684992338, "uuid": "8c05b84f-a18c-41da-938a-5c962f71ed63", "value": 7322112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684992338, "uuid": "3623a423-1310-43b9-bcc0-09a1f8c53709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684992338, "uuid": "f96c1ec9-85e2-42d5-9854-a42f9c69afec", "value": "e21ee98779010c0e00c90aa4e5e17995", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c6031e-fb46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685051747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051747, "uuid": "00164330-cde2-41c1-8507-c42c23a00810", "comment": "Malware payload (Mirai)", "value": "9f320bb8dcbda1e0f6c44436704eb185", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051747, "uuid": "6fe4b646-8328-4535-9293-25b840157234", "comment": "Malware payload (Mirai)", "value": "34e7056ef1d1cc0c6f32aac935134593c575177e3c3ccc5237b38373436c85c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051747, "uuid": "767198bd-5eef-42ed-9081-2a7332e03399", "comment": "Malware payload (Mirai)", "value": "b6edfcf32608c1657c05f9979c75029ed60e7b02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051747, "uuid": "641a24d5-b96b-4323-87ef-c33fb0acecb9", "comment": "Malware payload (Mirai)", "value": "46596d1ca1ec6fa92805e3f480861ff2f43db04dccf956940724b982969d8b3ab6b42151b5c9f72f569a8962e87c5d9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051747, "uuid": "a500ce61-414c-42f6-b089-05f172159e30", "value": "T14CA2E019BF1C858BC836397955D9E6D22353FD61F2DCCC0D2940C15FB1A33A92874E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051747, "uuid": "8abd1e0c-23d6-48ad-a244-ecf25a1f99cd", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTG:M98o08kxofBE+ZkXaITbp2F2TWul0c5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685051747, "uuid": "14923156-3986-4e42-8467-777302391868", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685051747, "uuid": "fbf59355-88eb-4f3d-b0f9-a83320e9045d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051747, "uuid": "84683a78-5f8b-41b7-9788-9528e9bf3098", "value": "9f320bb8dcbda1e0f6c44436704eb185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f456b251-fb48-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685052627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685052627, "uuid": "882468af-d866-4025-857b-e6d85fb1c1af", "comment": "Malware payload (Amadey)", "value": "78dfe97a8e7076433ac8768caeceb8e7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685052627, "uuid": "7badd46d-5365-4b68-b479-407b6479b8ac", "comment": "Malware payload (Amadey)", "value": "35d563eea0909d6313be8346af4a2d206b1984e0941cef35f7eda2e5f6ea3bbf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685052627, "uuid": "86c61eb9-02ff-4984-ad7b-8c2cf4f9ebee", "comment": "Malware payload (Amadey)", "value": "8d2fbeede3051d6e82f6e5bbed63ef827ade09c7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685052627, "uuid": "ca6c5355-8163-4247-a7cc-dfedd67955c8", "comment": "Malware payload (Amadey)", "value": "faa3447181b9a0c726cbac59bad3692f35992e4039fd4657000bfc6b7e12196cf33ada84b5fb59b431cf775439811252", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685052627, "uuid": "fac58f97-6099-4264-bea2-c86236c7ddbc", "value": "T1E2F42322E6D89171C8F517B049F213930A72BE234D7446EB1384AE5E2DB2EE0957277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685052627, "uuid": "e70f8d8d-fda1-4485-85f7-0cb080c17933", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685052627, "uuid": "f7955e85-f96c-4abd-b824-ea30b70e5d6e", "value": "12288:MMrfy90DzKGs3/7S0Q8i5u/SQGX4ua6ghprsXOvAWKBh/N/HTGaWSkB5GnMMtIWd:ryCzS7vTbuTgHo+JIhNSadkHGMM1+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685052627, "uuid": "c6fc4c11-502e-4fb3-b7e6-f2aa35245f1b", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685052627, "uuid": "ad8a7923-1212-4956-9b57-bad7d1b87f6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685052627, "uuid": "91d30c72-f395-42aa-9208-bb038d733692", "value": "78dfe97a8e7076433ac8768caeceb8e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122a4e60-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (XWorm)", "timestamp": 1685003714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003714, "uuid": "57adf396-8f6e-4f10-9446-aa92ead837d9", "comment": "Malware payload (XWorm)", "value": "40b9afd6d00895c8e8225afba7368a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003714, "uuid": "640cf034-04f7-43ad-a7e0-78d12a12bde4", "comment": "Malware payload (XWorm)", "value": "35de52b8a58914f2cd19cba71756e80f1b8e0fde69a8fad54e9ec578322d57be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003714, "uuid": "53712987-9092-47c9-acee-b720188e9849", "comment": "Malware payload (XWorm)", "value": "18632a74cd8654dc23a9753360d37ff03cae5a3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003714, "uuid": "1a1f093a-97c5-476f-bb40-63bbbb657352", "comment": "Malware payload (XWorm)", "value": "057781aa82c9bb18ee9aa456c36d1f2e2a2ef6c1b4b6633ccacb20d8c461121a1d5f78a6c78e0e4f93c6781f52ba2fa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003714, "uuid": "11aca4b5-b199-435f-99d4-c30b1f1e4e8b", "value": "T189C4AD5032649B92E3B94BFA4134090007B539A53D3FE3689FDF20CABAA7F465A54F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003714, "uuid": "d3cfd488-2b29-4477-a6a3-739e8eb2a5ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003714, "uuid": "fed0cd4d-1476-4724-baca-e95d60a7c537", "value": "12288:QSQBv2IfXa/zqtXHWIZ7xtXHyiFr+8VqXbuOid:h/I/aOtXfNxtCQ+uouOid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003714, "uuid": "17df1b99-01ee-437d-8177-f89272aba3c1", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003714, "uuid": "11266707-a4c8-4623-a275-7d296c19a030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003714, "uuid": "3fd92efd-f662-43b9-98f1-cb7571caecd1", "value": "ECQ_00884729.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17a9c03-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999713, "uuid": "923c7e8c-043c-47f8-9a83-33bd41870263", "comment": "Malware payload", "value": "c9937d205af92a1757f407e07eb30b12", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999713, "uuid": "0ac8c7e3-5edd-4013-8fb5-cae000b3e5f4", "comment": "Malware payload", "value": "364121f5632c28acda8a890755999d907807c8bd90cf5eeea5ca6c867e0313f9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999713, "uuid": "67d732fc-a188-49cf-b6fc-02e43cadb374", "comment": "Malware payload", "value": "2efd8b6bc60aadc0ee40f2224f5286cd19c23687", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999713, "uuid": "b9a91874-b017-4bd4-b991-6557a607bd15", "comment": "Malware payload", "value": "e650be818d138bc0cfb96f282771c30cabab4d3e3e66f354a2b11e3b7650f874825b723c6a45b94880e4fab4078034c4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999713, "uuid": "8f1f9650-2eb6-44fc-b26c-b873dd57457c", "value": "T18C6497844B1514B24B5B7E36B73094A5EBBE1E74C2C85A8BF46F7250FBDE98CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999713, "uuid": "c07dddcc-49cc-4db9-9890-e98a2d8cd7f8", "value": "6144:3bhavYeoMvr2a/qYZd4Rux5Ghf4fW7iXwEB9FkHvdvsAIMUSr:3bhav9Ei+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999713, "uuid": "18794aea-3594-497c-a31d-a2dcde702099", "value": 324183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999713, "uuid": "fd363fa0-ba90-407f-ae65-37427c5740a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999713, "uuid": "8e33363b-9dbc-4f6f-9149-917b03f314fb", "value": "eddyingArbitrat.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0304bfe6-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685003689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003689, "uuid": "182e31ea-736f-4bea-a5c6-00d59e9f7a18", "comment": "Malware payload (Formbook)", "value": "9054fd17cfcdb90d83c779a15c9759f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003689, "uuid": "6e6e4f15-75df-43bf-b269-746209357b55", "comment": "Malware payload (Formbook)", "value": "364dd2fca24dd00a4f94bd807353c0cbb7576f833ef754036480bbc2778b6cad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003689, "uuid": "f7b00be7-51c5-49dc-9b30-8482f36f2454", "comment": "Malware payload (Formbook)", "value": "9fe2e1dd1051611faa64c2e568eabd5f6a41e440", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003689, "uuid": "f9c3a2f7-9247-4a54-8be5-98a988eb8319", "comment": "Malware payload (Formbook)", "value": "4b1f2cce3bc25ac903580fc963d5bc5e4fcb09d46d1d2ec660a0bb01a6cf5287509869997d9fa77aeb1133ffbf2eeb8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003689, "uuid": "1216afc3-f78a-47e0-ab67-5db48560d390", "value": "T1D034120693E4C2B7C4A306306E7A0FFF1BB1982698F4560B53748B6A7E672D2DD0C794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003689, "uuid": "b1c0daa5-7f52-4ace-b95f-eb78b4a0f8b1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003689, "uuid": "f40272dd-5348-4a1d-a71f-9608fdcf4677", "value": "3072:XfY/TU9fE9PEtuOb9B0tuHduCc/mGCQIfkLD2wFkyh/WsD5cy/rVD8d8aG8ra/dI:PYa6O9BUh/mBfgBVXTSdoV+ccK8d9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003689, "uuid": "62ae6a92-578c-41fb-abb7-9de6de5a5c60", "value": 242623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003689, "uuid": "8b5c0a1b-0864-424b-a4ae-a0b053860079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003689, "uuid": "f2483251-7d08-430b-bb8c-17e5188c098c", "value": "1120231805kar-v23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2cccbd-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997854, "uuid": "c54810c6-7619-42b7-9b37-302fc61c5a02", "comment": "Malware payload", "value": "af3bc689b95f5ffac3720079fe68dfca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997854, "uuid": "c3350f94-be6d-40e9-99dd-32bf49757e8a", "comment": "Malware payload", "value": "365708cb83ac39f815b053d6f15687509b665fbdc63489959a69154a12e8deaa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997854, "uuid": "20c7c1e0-4b15-4452-a861-08746fa3bee8", "comment": "Malware payload", "value": "56c7be0f42320e92f3f0d4b5a6e11d1774578742", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997854, "uuid": "a44b1932-ef2a-4a96-b286-27b8e5454383", "comment": "Malware payload", "value": "7182522774192620c97505bc65347a5739e06c447c0d318f833788462cc33c56366bf593b5b08abe447476238b9c84d5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997854, "uuid": "09e59cc7-ce03-437b-a78f-15ed8ba4150d", "value": "T102649884471119B24B5B7E26B730A4B5EBBE0E78C2D4598BF46F7261FBDE94CC8C1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997854, "uuid": "4378ec0e-bbe1-4ddd-9e40-4fc59a124b0d", "value": "6144:cmZx2IJFPrLN6RS1+saBrCBIZqUsbz6a5+:lNs+Iw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997854, "uuid": "a019f542-3683-42ee-acaa-7872b3d8a475", "value": 311690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997854, "uuid": "6d5be217-d556-48cb-8251-6f8eff24320e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997854, "uuid": "d3ef52ce-461e-4137-86f3-1fb3f3b84a92", "value": "RetypingDivisib.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db29690-fac3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684995144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995144, "uuid": "ee3ddb36-c85a-4b98-bb90-8e27da1d7488", "comment": "Malware payload (Formbook)", "value": "403771edb8c4ec626198dd031da28612", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995144, "uuid": "9dc77f0f-b899-4ea9-aa04-df52a63f30fe", "comment": "Malware payload (Formbook)", "value": "36570a66439108b5e63bb142c2f4f0aa3f998301d56b79f393b10f069e34b987", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995144, "uuid": "91578dfd-473e-4193-aaa2-b1db2fcfac34", "comment": "Malware payload (Formbook)", "value": "80182186863ff565a0e9f43ee9c7c5572ac224d0", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995144, "uuid": "481a4ecc-8edd-46e5-9834-1216b9d96007", "comment": "Malware payload (Formbook)", "value": "374d499385778caf9b93d9afdbabc79957fa849b9bd79d09f1defe65c7c20d64966383cb21a88893e0c4eddb6cfc648c", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995144, "uuid": "a922c582-d76f-4164-84e9-f2fe9e9a0d65", "value": "T106F4F1430BCAAAA5E83D4477EBF42DE1DEF5AD2E00E097284D9576F0CCB13C61A425B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995144, "uuid": "2963aa55-46f0-445f-94db-e00abb6c6d39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995144, "uuid": "285d0f36-9651-4f9e-abc5-91b589671256", "value": "12288:fIrjM5uxjcrWsUPEfIifqe8ES2FUp1yL1u3qDhRy5jqXCne0:fIr0w2IPEIbDE2j4CnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995144, "uuid": "bf34e332-513a-4b10-9ba8-6872dcde509f", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995144, "uuid": "2faf992f-3e1e-40c7-8f0b-2a88f7141655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995144, "uuid": "a43e21f1-b8d4-43f1-a3a2-21b8dc02e9ff", "value": "Zahlungsbeleg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780a8dea-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997872, "uuid": "f2752ba7-d541-4286-b19e-f5863d4a3244", "comment": "Malware payload", "value": "c566c5c3361eb9ad7735754eaac6a7bd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997872, "uuid": "3559cc92-8d21-4944-bb8f-2269ccad4f82", "comment": "Malware payload", "value": "36856314fef9390da1ae151d75034361037fbbcddadd503accd512da7874e031", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997872, "uuid": "346dc9b6-bd57-48c7-abab-2d660ba5abb5", "comment": "Malware payload", "value": "1acb94ca0a069597ea8f5616db3cc13542a4fb63", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997872, "uuid": "d2e554ca-defd-433a-9f41-b573350d99a0", "comment": "Malware payload", "value": "08b2ae96ef64f39438857f92b1152244547455a6ffd29e95fcd0c1d610883caacae535a375100c85678f1d678d5647c8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997872, "uuid": "b60a3f38-fcfc-4fb1-bf05-b7bc8c79e46c", "value": "T18B4497804B1528A24B5B3E36B73064A5EBBE1EB9C2D4598BF46F7250FBDF54CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997872, "uuid": "057bf226-a4f8-47e0-aeeb-86fcac95c607", "value": "3072:ghmQuD416xdxR79kk2Q6eqLClHtQ3ccGvg0/9RnzA71cRgWkyig:gvuD4AxDPkk2Q6c4GvfnzA7eRgWkyig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997872, "uuid": "0dadbe60-6c44-4fca-8c60-48c6aff85042", "value": 257912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997872, "uuid": "6ff6b48a-856d-48e6-a749-c618a15445a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997872, "uuid": "828d215f-3ccb-4466-ac0c-ea355c9d4fa6", "value": "Satirizers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728beda9-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997863, "uuid": "71a71333-7091-40c5-8198-ae52a202d1a3", "comment": "Malware payload", "value": "7aa7ec30eb7b55cfffa6c6a39f457634", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997863, "uuid": "85d7470d-ba98-422a-994e-70284301c470", "comment": "Malware payload", "value": "36a71cf2245f9b956ab70df7642d82ed165b74d039e3bef377aebab0f8e6a584", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997863, "uuid": "d66d5119-99a3-4340-a179-10cdafdbda57", "comment": "Malware payload", "value": "5c1633ce4956756f13bd8a4f84e7b81a70bf5a3a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997863, "uuid": "48be2388-fa5c-4e8a-a591-aaac80984504", "comment": "Malware payload", "value": "5d981cc3b7894bacde47ffe44adf5bf8b2b7223bddf4e3092ee99582dedd6ecbedd21f753909b9ea381e24c56569a2a2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997863, "uuid": "bcb60a58-4f72-416f-96c7-9177620593a6", "value": "T195449480475128B24B5B7E26673094A5EBBE1E75C2C8568FF46F7250FBDEA8CD8C1321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997863, "uuid": "fb948638-3841-4751-8001-820b70046d6b", "value": "3072:XOLvXg2SMPaBR7eFQ6wavkQc/celmNFKxylHLN6x40:XOL/g2SMCBR7eFJYmN0ylcxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997863, "uuid": "f137e3a2-be9b-43db-ae0f-e8f71e3d50fe", "value": 257626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997863, "uuid": "5bd1356c-93cd-49eb-95e7-329cf275598b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997863, "uuid": "c1f08028-fe86-4312-8b36-91e6c358aef5", "value": "Ruthenious.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722ec862-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996574, "uuid": "08eeac1b-9c82-4371-a2ff-724345a5b505", "comment": "Malware payload (Quakbot)", "value": "927d7366d559accd41c668971aa722e7", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996574, "uuid": "00541789-1f22-4b61-9e8d-4ae950068574", "comment": "Malware payload (Quakbot)", "value": "36c022bbca9f87049f72b08cc9e4f3edf433d64eb76f3d60abb7841ff3ec8623", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996574, "uuid": "62a5796a-1c53-42bd-b9da-cfecfff1e9e5", "comment": "Malware payload (Quakbot)", "value": "6b19ba118514669280a8c0ba84acb25308d5ac44", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996574, "uuid": "24445801-cbf2-4f0b-8efc-6a14f493c3ab", "comment": "Malware payload (Quakbot)", "value": "03433453f8ae8c752c4408202bceb316cbf2920141c7ed30254f5c388f94036d2b78d0dd0a4f8cf6ea1f4536a3e2eff6", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996574, "uuid": "b6c93de2-e3bc-4fea-a7f1-3845859b3700", "value": "T142530A9FA381133D69614236240E56D5F7E14838AB76DB78A80DC72A3322D38D6FD1ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996574, "uuid": "af2b8bfd-738b-48ee-975b-ba2788721315", "value": "768:wsfp6DKbpQyrDXn2kLr4bpSiJcPBmghsbpzOCk9lOnxtEsxIcMyrDfn2kLrcbp6J:7dQ1kO3J+mFpzOCKsE2MjkydU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996574, "uuid": "0e7f4fff-ffd7-4b79-b2ef-3457ead11c5e", "value": 65418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996574, "uuid": "d8147079-f329-4d52-a68d-b98f487d5773", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996574, "uuid": "382e2652-6ffa-4604-af73-8b7b713153bd", "value": "Claim_A107.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb8597e-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994796, "uuid": "ffe91303-15e2-4739-8927-4b6065ee2a10", "comment": "Malware payload (Quakbot)", "value": "7f6f709e34fc8d89e6030a62c910378e", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994796, "uuid": "8feba2bc-556c-4a46-81da-c83a3bfa0f15", "comment": "Malware payload (Quakbot)", "value": "37154775211b2b3a34bbae18a8c6991a15346cd3aab2d6ad5758621c874f36ae", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994796, "uuid": "1b4b75cc-1c62-4444-9550-8b69360f0470", "comment": "Malware payload (Quakbot)", "value": "07825c50ba80c92ccfe1951694ef5cddfeea8fda", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994796, "uuid": "bab30e33-1f12-41cf-bd30-d581a0ac26af", "comment": "Malware payload (Quakbot)", "value": "64d36750e1988bc490b125a542293f45bd3ec834e7f74edfa1649c2790e8fae3cd0dd29ad7409d21cecbbb163b9e1db2", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994796, "uuid": "02db1bee-3f06-448c-a559-9d31229660b4", "value": "T1EC63095B93810375562202545A4F67D1F3A488787B76DAA4B09FC2AC3341DB882FFAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994796, "uuid": "592f1996-f982-4278-8b27-f76eaa7a71fc", "value": "1536:Ul3Dj0gpHlmVMEkNbmKXRZvjuC9izkY1ZO0jltQ3obo2/N1ZOA:UBjzpHlmV3kNXRZLuKizP1ZO0jltQ3iF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994796, "uuid": "c81564fc-ab48-4ac5-8200-59f4e9ae8db9", "value": 70078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994796, "uuid": "5be40d8d-9eec-4a29-bcb7-43d449576c6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994796, "uuid": "83a6768a-119b-4692-b0ff-3603ed3c659b", "value": "Claim_C094.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f017f1-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994785, "uuid": "d86cde0b-551d-463f-aedc-41d5843bda3e", "comment": "Malware payload (Quakbot)", "value": "8acb610acf1fe4e0bd8177898e3aaf2e", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994785, "uuid": "17ef9e8b-827a-4914-b425-72565f089e16", "comment": "Malware payload (Quakbot)", "value": "376a07067e5c751fec42980d8f0b6afb9363fd24280af747c51ceb69986af654", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994785, "uuid": "9aecc130-ae21-4218-a234-69a46bd37df1", "comment": "Malware payload (Quakbot)", "value": "401bca02f452bf5f5798cf783096439a1ec453e4", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994785, "uuid": "d9436fee-08cd-421e-bfbe-03295b25aa1d", "comment": "Malware payload (Quakbot)", "value": "d97e107da4fb0173cce893a16bddb0ccb9e06b6d5e8bb23a65c8c4f056e345e82bec19024f51629c9d0233e2c90811f9", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994785, "uuid": "dbcbeb14-dd94-4600-acea-b9042184ad10", "value": "T14B63084A9280037A69110254A64FB6E1F3A489796B76DB74F04F83DD37119B8C2FE9FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994785, "uuid": "5e99aed2-4c2d-4193-9c9a-8f1197370174", "value": "1536:KTclgHhx2oBOmvmsSy/3ARfDhmffGT/1ZOv:KTc+Hmy4y/3UDYffGT/1ZOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994785, "uuid": "ad10fff1-2582-4313-ab47-79f23e1f42ad", "value": 72097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994785, "uuid": "a8e487ec-0fab-405e-8a35-c21b1978b123", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994785, "uuid": "889a4904-3f26-4c7f-8b40-fc1c7dbf35db", "value": "Claim_C974.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff51b68-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684995067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995067, "uuid": "770d27d6-86be-4df7-8fae-728514f1043e", "comment": "Malware payload (SnakeKeylogger)", "value": "9eca629d52fad1d486de69291274f5fa", "object_relation": "md5", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995067, "uuid": "1f370497-6a82-47bc-885c-229b1aa09999", "comment": "Malware payload (SnakeKeylogger)", "value": "389cd12974a382686c0f491549b4bbe32c2dc9604b0b3a193ee4fb30ede8335d", "object_relation": "sha256", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995067, "uuid": "5f0521cb-7516-4e99-91d4-e8222b7f9ea6", "comment": "Malware payload (SnakeKeylogger)", "value": "65d28ff36307ac3af8ab12a8c1afa0276d155630", "object_relation": "sha1", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995067, "uuid": "7123845f-3d1c-4135-ba70-599a36695255", "comment": "Malware payload (SnakeKeylogger)", "value": "e7372320bceda9fa184a782c4f1b6eda87ce5090df7a851b6d849320a618b7f40ab0ceac71c333788339ce21584dc186", "object_relation": "sha3-384", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995067, "uuid": "3a4ec521-8c5b-4a40-998d-5dd697fd74c9", "value": "T198E4222439676AB6E9BB07B000927BF0177F9BA13966F6872D47F2C8D305F090122B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995067, "uuid": "2f34a6c8-f7ac-4e0c-9b5d-693144d91667", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995067, "uuid": "d811ded7-9a9b-4e5a-8774-df4681b56b50", "value": "12288:QaWIm6lVvtzZBEP85vXMdyODnVcKoYSvKlHHOeAvcAtFa2:NTmIt9BEP89MdyO1VSWHOGAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995067, "uuid": "9ae03742-0901-4932-bbcb-40dacc170771", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995067, "uuid": "98d31347-7eb8-4dff-b496-aaf8fa5540f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995067, "uuid": "ded68814-e835-4255-98d5-a490307b6cd6", "value": "CaixaBank _ banca digital CaixaBankNow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f61e87b-fb38-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685045425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685045425, "uuid": "1e4f6d32-547a-4b47-b73b-f5c48526a4e7", "comment": "Malware payload (RedLineStealer)", "value": "855003dec064d4de37b4216e6ca6bd05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685045425, "uuid": "a9704836-b4b9-43da-a37d-847c78281f32", "comment": "Malware payload (RedLineStealer)", "value": "38c3c5423b06b1f4796b21c2491afcd284427df2a60ccf72fd49cc64e0b1a966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685045425, "uuid": "d332abbf-8f28-41e8-b419-2c7f5b70b82f", "comment": "Malware payload (RedLineStealer)", "value": "b5acd257fcadbf1e764db7ce75176afd3102c814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685045425, "uuid": "a6d6b4c3-be1f-42be-bd8e-d7252aea398c", "comment": "Malware payload (RedLineStealer)", "value": "5c4ea02bd201d6096443dcf17cd591ea2457785203dc59bed71fad7d410f6f78a49da89abab67fa2db116963db8fc1b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685045425, "uuid": "f10b8947-3658-4fed-aec9-6105e8e2a823", "value": "T15DF42353F2D85473E9B013B409F713970A3A7C729D74826A3685AE9B58735D8A83233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685045425, "uuid": "f7d98d01-aa02-488d-9604-4c3d270b399e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685045425, "uuid": "e027a346-37c3-42ff-b64c-c98abef968ac", "value": "12288:nMrby90X5mMdTuMDe/bXxxosrCL++pLmk2plRaYAsC/uAOPkvGkBxVnM8tIW+IEp:gyGZTK//o5COLmkuPis0duk3VM81+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685045425, "uuid": "e06a0bbf-5b16-42c8-8e32-17150a4c9b89", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685045425, "uuid": "36c0b689-cbf7-43fc-bc8c-febeafc01fe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685045425, "uuid": "25b28aff-5a2a-405b-8c10-a36d814c93a7", "value": "855003dec064d4de37b4216e6ca6bd05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a937114f-facc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684999243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999243, "uuid": "9130c2a8-c7be-4ba3-8c8d-797c8fa93005", "comment": "Malware payload (Formbook)", "value": "4a83869bc55310ad396531a68282b9fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999243, "uuid": "dbd3c4a0-72f5-48c8-a5d6-3ffaf12d906c", "comment": "Malware payload (Formbook)", "value": "38e090d8747dd1332c68563c5f8204876d297ecfeb0a25da3282c57579cef3fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999243, "uuid": "c6dc432e-f18b-4c81-b7d1-8c3f827ddd08", "comment": "Malware payload (Formbook)", "value": "b026e15f84df130c5b61c152c709e9ec3de577c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999243, "uuid": "ecade1cf-d1cf-47bb-a5d7-8d9d38bea4ba", "comment": "Malware payload (Formbook)", "value": "8a4fcdfe688cf9764636534c43027b18327df5835652540546f8dfd1b906fae844bc621170a640b7a367295f59f51d9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999243, "uuid": "d680b5b7-936c-4449-8ba9-b231cd612791", "value": "T13244125D3FD0D86BD4A51A705EF993667FF0BD2298A09B0F57C07A9CB971722820E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999243, "uuid": "f0ef3f46-baf7-4ba0-96af-dcd19f88d646", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999243, "uuid": "779be267-c965-443c-9d8e-e0402de03f8e", "value": "6144:JYa6sl3x93+f1onecjFaHDpBg7gvjvOwXVyWI9o:JYaln+ynec8zx73lyWI9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999243, "uuid": "b680bcdc-a1f5-4ac5-8d8f-67c3fbdf3b7e", "value": 259453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999243, "uuid": "09ba82fc-f3c7-4d7b-902a-f83f1985c537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999243, "uuid": "caa3ded7-f38e-478d-b208-a879be932d97", "value": "M.R NO. 1212-00-RE-REQ-649-0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54906308-fac3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684995236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995236, "uuid": "60e83e25-ecb4-4628-8ddb-7d6dc3e9561f", "comment": "Malware payload", "value": "5e16d35ef70bc8553a404212e7ae5355", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995236, "uuid": "b60012c9-41bc-416b-8826-e4889cbf98c3", "comment": "Malware payload", "value": "393324caf0e13790a772ecae9b7ab46bf4f91f54c3b4bb8f7cfe0801efead0ed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995236, "uuid": "ea8e0b67-eba4-4847-ac8c-4c13135b12d7", "comment": "Malware payload", "value": "16e8bce35dc2ee969ffec86e6e4eb38624dc975a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995236, "uuid": "f0d8a43a-3c2d-437c-b9f1-1c845c31294e", "comment": "Malware payload", "value": "eab4a377af3f02b7d3f07bd9b6c39f9d84bd2517a649cdde12086176283214544057f0b9bd78e6ac94b05693bc9e7007", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995236, "uuid": "5b7bdd25-7169-4508-8d89-6013867da971", "value": "T1B89184031AE011C2038B57F67F37B5F6E65454BB2C84466F7217EA61ACC8E25CBE2A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995236, "uuid": "4580416a-2bdf-4895-a41d-e991148ce304", "value": "96:lxXfkBlXxyCmAi1u2hLtNHkYaKG+cj+00IbBhyrZ:fXfolByIi02ttpVC+trI2rZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995236, "uuid": "57afdd2f-3d9c-462d-bc22-98f4c14b6a34", "value": 4564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995236, "uuid": "ee49b105-2943-46ae-b214-f05b75514bc0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995236, "uuid": "13521412-05b2-4c45-8c4b-7c6baa5b14b6", "value": "PO_756380.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0677b8b0-fac3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684995105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995105, "uuid": "73e076a7-4dd4-4c76-8651-bda386f84706", "comment": "Malware payload (GuLoader)", "value": "4a92b44cabe5ef9d5dc989a90ee05998", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995105, "uuid": "7adf8ba7-9388-4bcf-8de7-e4d7f840b51c", "comment": "Malware payload (GuLoader)", "value": "3a0cb7a9d6102898e2e773ec99805b0aaa3c4e3982576655a37433475ce5dc9e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995105, "uuid": "2740a5df-91dc-437f-b755-4d478a951e83", "comment": "Malware payload (GuLoader)", "value": "849259455239e9c2fd42d791dbf991699c97cab7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995105, "uuid": "f6fa149d-c684-4ca0-8621-81057129a640", "comment": "Malware payload (GuLoader)", "value": "606363f23f4778523347a1ad345eda769dc9aedfd42b804f2284e70a620c19a1f8c9efb84e4b07450e4f7de5b42d2bfd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995105, "uuid": "6a90b0ef-983e-4206-98cd-b12362bf80a9", "value": "T19683F1EB9144816BC2C8E7752F597C1FDB2B5AEBA6B51D02E62B17DC0032CE25EC0594", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995105, "uuid": "7a7e83a7-67b0-4d56-b470-b09b46661e1d", "value": "1536:mQr6pdRv8o2HIbD4TZV/yFaAzodrAZAkYZo0A3PuEZo0A3PuLcf0M5PmTcZo0A3/:N6p7d1E91yrKAZA16x6AcNR6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995105, "uuid": "69613489-aafb-49cc-9585-5779d2c20e2b", "value": 81782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995105, "uuid": "392a9a8b-7088-42c9-aae1-0488c56c7160", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995105, "uuid": "5a0dfb87-6432-4813-93cb-d33aa4df9965", "value": "New24 order shipment.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d2ef36-facf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685000342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000342, "uuid": "e241ff1b-4282-4004-b6f8-ae95bc3ee6a1", "comment": "Malware payload (Stop)", "value": "ccb993f906ba1de16e7810e456262c0e", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000342, "uuid": "ceca88be-36d2-4e52-8fc2-0029bc5d8c1a", "comment": "Malware payload (Stop)", "value": "3a7a5677e028001086397a06a1bcbcb964a43c9ef768eedd4f1211bc11b19817", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000342, "uuid": "5e6d542f-dd30-4680-bc35-d362a23bca40", "comment": "Malware payload (Stop)", "value": "617fbd70adf33a07a4a423ce687db7bbfcd7fe25", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000342, "uuid": "229ab11e-b8ca-4d11-9c0f-9b6ba9727895", "comment": "Malware payload (Stop)", "value": "cdf207e48010f95017ac1ec4c06a3d90f487ddec468a98839ccea71f1f368aa4661d165ff05296441194b8e228f94f52", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000342, "uuid": "073a3944-6d78-4d72-93f8-02fd7f65aa04", "value": "T187F4121176D5C0B2E227183658A4C7A58E66FCF59B2146EB73E43B2E5E343C2CA38747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000342, "uuid": "0a6bc524-b723-4344-8c36-6af4392ea5a2", "value": "761a416c92dda0b5d3a5091999204e5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000342, "uuid": "9c73ee1d-d5ab-4966-913f-3ee0a69256ab", "value": "12288:KtAxI2rcw/7u2BQp5FNPSB0XAW3R7BQV2Nqy06ObfVALlsi7afb0dS/4FoTo7T1:Kme+9EjNqB0XAUR9fqX7VCZmZS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685000342, "uuid": "f0d4686f-27a3-4e1a-9411-c3b5712ab3bc", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685000342, "uuid": "068516a2-b81f-43ef-baf5-514a613901dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000342, "uuid": "aa981b28-1913-41ea-a29d-b8833455cd30", "value": "M7R64396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc51c79-faae-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684986230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986230, "uuid": "19387418-d65a-42b8-8574-14d84cfdbfa9", "comment": "Malware payload (RemcosRAT)", "value": "06168af4a9d358eab028fb62b550299f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986230, "uuid": "417d045f-55b5-41b8-9d4a-c372512c71e7", "comment": "Malware payload (RemcosRAT)", "value": "3af90f03d3c66f34961a6a9f07d2df0b51fdebf346900bb5cf564c8956a32a50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986230, "uuid": "bee89874-ea23-4832-a3c9-274448e41f4f", "comment": "Malware payload (RemcosRAT)", "value": "ca5f4a9bf1f5aee03299662b0cf1289f5a786bde", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986230, "uuid": "1a2b65be-2bdc-4004-b6fc-a07e56fc92ef", "comment": "Malware payload (RemcosRAT)", "value": "679c513cf3b4796dca31b0d644bb7e98633af0c65e6770516de4f93a21c5067def36a8b60dc1dc76c2e1669344214104", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986230, "uuid": "6a5efd94-cbaf-4352-932e-03c6028b969a", "value": "T1C7758C0B0F90EE5AE02D41B9D6A198F053F00E06D215DBC36DE53EEA3BF7E55AB02645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986230, "uuid": "6aae1b7a-6b92-465e-b9a7-6a67861fb995", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986230, "uuid": "7bf88efd-f544-4be7-aaf2-bf6da2ba17d9", "value": "24576:J6oV9I0oh2pEGxobDWMAVx123MBAKx9nf4L7XFz3zI9oRe:uhEEVbih123M6KDnfirFDzI9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684986230, "uuid": "133bbe8b-103f-48c8-be37-b43c7a018f12", "value": 1587712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684986230, "uuid": "ca7cfed6-fb08-45fe-929f-04e0763e54a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986230, "uuid": "e1e66fd0-c9bb-4908-98e3-0739bb2cb462", "value": "06168af4a9d358eab028fb62b550299f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d94525-faf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685017087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017087, "uuid": "e8278549-3718-46ac-bfdd-174cb73ebe36", "comment": "Malware payload (Loki)", "value": "ba188c9d8815869a76b910a465c6b695", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017087, "uuid": "55a29d8b-4574-466f-baa8-554cddb926a4", "comment": "Malware payload (Loki)", "value": "3b282e85f1c3566bd088c73a424801f1fc47c6655a067b4e3534f07b4303e288", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017087, "uuid": "c3464742-49b5-4c64-8071-cb673703be02", "comment": "Malware payload (Loki)", "value": "9c71d9e2237f5a9c2f9ed67088fdea9bba3517bc", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017087, "uuid": "cb3f6f47-0577-473d-a891-4b090a1c5eb3", "comment": "Malware payload (Loki)", "value": "07babcb8907d8fbc7ceaf08282de23465d3f1490c3baf47acd24232ec6b05c182cb81c62aec405f981e4d0d41764b953", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017087, "uuid": "517b3a93-6261-463b-9b4d-30279e60ab6b", "value": "T15FD40291322C7F56D87EC7F88820367053FBAA6A7126E3462CEBB0DB7256F810511D93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017087, "uuid": "ce8cdac6-4a0e-49de-b1b7-ff7908a9a847", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017087, "uuid": "81cd6300-8b55-4aa4-a37e-c9af911c9597", "value": "12288:Td/mzZBEP85q/h4d4Lmj+RvhBRS+2cWLIvEOASEl5sjYk/:k9BEP8mV6qAjLIOnoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685017087, "uuid": "2e83c1de-e87b-4d45-b4f6-aa65be5cf016", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685017087, "uuid": "756027d3-b2b0-42fa-9bf1-b620f3f19fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017087, "uuid": "d606e755-116d-42c8-93e6-64f6003ea642", "value": "003841799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454f8fb7-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994781, "uuid": "cdf77eb6-c1a0-4cab-a679-0f962e6f159b", "comment": "Malware payload (Quakbot)", "value": "7fe65ebdcd74168a3d8627c187edbbd3", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994781, "uuid": "00985a98-ecfd-49c2-b516-bbe47e75979a", "comment": "Malware payload (Quakbot)", "value": "3b7169b815445397b4ffab26418edb4e68ecd1b9d981a747b588ceaa12562add", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994781, "uuid": "dfe20d4c-0b33-4a21-b6ab-f371ff9803ae", "comment": "Malware payload (Quakbot)", "value": "f798621eb51c73743ef08a0e7e194288cbb778b4", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994781, "uuid": "5de7b63f-7bad-49c0-ae30-8571880b0538", "comment": "Malware payload (Quakbot)", "value": "011ec5706a15a7feeefce900d71693240289a85ef37a21c8620088883a5b006abca5ecafc548613f8db3095aca981955", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994781, "uuid": "9586215b-72e2-4b69-9703-e46c16134447", "value": "T172733B9FE381133859620225614E56D1F7A184387B61DB78E84EC3AD33129BDC6BE6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994781, "uuid": "6f2236f7-6d23-4993-abdb-2fbc5b1764c1", "value": "1536:pi6zcnwivcnyj/tQl4HozWkniamc4QnAaeEdZ3nDFLuEB/AkH:p3zcnwuj/tQ6Hz8i84QAaFp4kH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994781, "uuid": "2650466b-3e26-49eb-9f11-1a83c29b168c", "value": 79503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994781, "uuid": "fa6673d0-1a0f-4f65-adf8-e7ccfd39b38b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994781, "uuid": "86db5e91-5d6a-4e22-ac79-0623e3e89bad", "value": "Claim_D574.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd12e7c1-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997988, "uuid": "4559c05a-2eea-4afb-96e1-8850be95c402", "comment": "Malware payload", "value": "5fffa612296b40746473386e0bff9e86", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997988, "uuid": "37d6fc1e-a899-4e59-b3dd-9c900b9af133", "comment": "Malware payload", "value": "3be60d6d09134685ab4883255646ed05d6cc8300e29760f4df8a7c213664663c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997988, "uuid": "618761c0-d947-4108-bf56-6866bfb1d372", "comment": "Malware payload", "value": "60f62382c4266b26e4d91ffaeed8d1cffeacc521", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997988, "uuid": "c23bf6f3-8ea3-435d-8d59-6ff74b6c2043", "comment": "Malware payload", "value": "5f77699c434a12a3769998e30d7c1dfa6bb3a7d8105ce0817f9c67fc4d9774b2a150b2f53f629bd92b1bbd790e4768c3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997988, "uuid": "0048fc0c-546d-4a2b-a683-e8948118009c", "value": "T1DB54A784471528A24B5B7F26A730A4B9EBBE1EB9C2C4458BF45F7251FBDF94CC8C1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997988, "uuid": "48c95b23-6123-4996-a015-3913a8d1b936", "value": "6144:1imcm3GlH63C2MBBJd5g6uNvtH/jgbXUX:CUSv1cDVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997988, "uuid": "e2478ac5-a968-450d-aeb6-246015aa044b", "value": 292315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997988, "uuid": "682d3730-91e7-4cd1-8687-5b0c29542a4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997988, "uuid": "b6b01f77-a0aa-47e4-9adc-90f3bfac2542", "value": "TatteredlySuper.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8171125b-fb29-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685039120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685039120, "uuid": "44efa09e-7a2a-42c9-a1e4-7c7ad87ac537", "comment": "Malware payload (RedLineStealer)", "value": "a2829b4968f8ac10effb4c7c68548b82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685039120, "uuid": "45827654-e508-4641-9030-34fd27620116", "comment": "Malware payload (RedLineStealer)", "value": "3c09e76f8227b109be3257996c7b923decb118e33c46f951a1e684cbc3e6dacb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685039120, "uuid": "30247f90-6de0-4a1d-aac8-b17b48cc0898", "comment": "Malware payload (RedLineStealer)", "value": "b526db713ef03795c51f578273fa10a5d5d4d433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685039120, "uuid": "ddcc6b68-5802-43f9-bd4f-59d0b3835741", "comment": "Malware payload (RedLineStealer)", "value": "dc26d8470644b183d0ab30d55b8ada7704e3c4a8fda3be4d40eca07c5406e4772d0e8ef343c8f057ae2b0639a9a2338b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685039120, "uuid": "00341e60-b94d-41f5-8aaf-edff9eab7756", "value": "T157F42263F6C95071D8F127B004F712D70B36BDD29EB9027B2796A95F0CB2180A875B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685039120, "uuid": "afa6b6c5-35ce-4b56-8a73-ca7fc1b1a6fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685039120, "uuid": "c8ba15c6-780a-4794-b382-99407f7d390c", "value": "12288:wMrRy90WT72VnNLS3yUccTldzems4883jISOfN0FUZLWk+Q+ffavL2bWIEUXgV:xyFTKNLSiidCmhUN0aZakj+nS2bJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685039120, "uuid": "55cd4d6e-f19b-465f-a699-fc8410e2b566", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685039120, "uuid": "36c6e4ea-56e9-4088-aec4-5ab76046689c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685039120, "uuid": "13a598f2-c83d-4886-baee-0ae187148e65", "value": "a2829b4968f8ac10effb4c7c68548b82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9eabc4-fb0f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1685027995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027995, "uuid": "8caae65d-3aff-40e7-831d-9f1b58d07c6a", "comment": "Malware payload (NetSupport)", "value": "dbbdc92ca62d36dceef0883b2da867ed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027995, "uuid": "fc2ec281-8cfe-45ba-8520-80e21b11fc10", "comment": "Malware payload (NetSupport)", "value": "3c502bb5021338ef3778c4dd6ca43f9afa1fbda25e0f13a5d956482eae80ac11", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027995, "uuid": "736999da-4000-4f83-8fd9-8b3dadf99b52", "comment": "Malware payload (NetSupport)", "value": "5671539e582d08c0c589ba4ac1721af4ed6f71a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027995, "uuid": "39839c43-3bf0-4d66-aa52-bdba24c060fc", "comment": "Malware payload (NetSupport)", "value": "9bc44334d32d31e1a5dbc5db22ce69c8a079c7dd8ba4fda12dbcbe46664acf1dbd1fd56269f4cfeedfa0d53610f156be", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027995, "uuid": "ce643721-c6ab-4bdf-96e5-a8f2213d42cd", "value": "T1D15382C5BA96F0EA110330B75E174161C7A76DB462CC4A58E074BCA0FD3CE9CE79AB12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027995, "uuid": "dcaf000f-999e-4884-9176-1facd780541d", "value": "768:P+UeULOhtYgty9w9CHwYjQiJsnnlrD9a5Ybgu1zD+SpJGgflJcCB1vnJrm6YkFf5:/eUL2tVWWCv07nlPMSgSzyS9tJvM/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685027995, "uuid": "9c8caa51-1ea0-4459-b9fd-99e3ac561f6c", "value": 62554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685027995, "uuid": "1bf4182b-f6bf-4e5e-a012-8fc1cf86a50b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027995, "uuid": "49b1a4fc-246d-4de9-a7df-445d86677a9a", "value": "img499113656.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9007ba-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997071, "uuid": "9da9e264-8150-47c4-87c7-b30e8adc0e44", "comment": "Malware payload", "value": "ccc183bbfdb88ef2877fc7a4db286c90", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997071, "uuid": "238fca68-e582-4ca4-99f7-ff7e3958452e", "comment": "Malware payload", "value": "3cdc6de1a9229c515d81254537bbb62b9bedd926a0d4e4315490fdfd15bdf2a8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997071, "uuid": "b39aa294-f2a4-4471-9244-dd91502d31c1", "comment": "Malware payload", "value": "b2805c45d1b6c3cbbeb75177b77e46e1f39b14db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997071, "uuid": "9e0302f4-3dec-4325-be7a-178cc21b7e10", "comment": "Malware payload", "value": "5a8d00f2360d6822b3b974551fb9dc8de6fb161ca66e32d65af78b7daba4e37ed7973b21cda6ecffc254e540929bf35b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997071, "uuid": "4ca9ef73-3a1d-4844-bca8-789c63b271a4", "value": "T1846487804B5128B24B4B7E267730A4A5DBBE1E75C2D8568BF46F7250FBDF98CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997071, "uuid": "07181fd4-6c01-4fc2-a0f7-0ca4b09b62de", "value": "6144:qBkrSp0qHlcAyNRAVv5W/r0HWG/h5hviiI:rCfr5nI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997071, "uuid": "96d3e73b-0e23-4a73-81ff-78bcb40ab142", "value": 330189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997071, "uuid": "494a1550-e105-4298-9b8e-437b7dda3597", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997071, "uuid": "86bebc97-25a9-41fe-8056-833e1eb7a330", "value": "nonhostilely.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141ecde8-fb02-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685022186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022186, "uuid": "c9d9bc09-2d2a-4d5e-af82-600bfd54a845", "comment": "Malware payload", "value": "77d404e760d2435a2760dfe98e07fb09", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022186, "uuid": "53de8bca-d070-4c53-a086-e7d4d54a633a", "comment": "Malware payload", "value": "3d1616f903ec09722f794a973aa8c749b3648c4e749063b15a826fd0197812e0", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022186, "uuid": "c9716bdd-ee70-4ed5-8bab-5aa5ab52a60d", "comment": "Malware payload", "value": "a1e39559bbdd1ef3a5b5bc818c479c0aec51613e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022186, "uuid": "4ab7e66b-5fd1-472e-8643-39ddbc753362", "comment": "Malware payload", "value": "3ebc44eea272609a4ddf82d79ee547366b0984082a4087caf058b92b032e62a5d24ed296f8cb047aa01fcba3e6a63986", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685022186, "uuid": "648130aa-5418-42f7-b1e4-bf0f0e19052e", "value": "T1DB672261F7D7CA26C3A75239427D2D3756268CD542C3968B190B3A384873FF84B46ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685022186, "uuid": "49c2e9d6-846e-450f-9929-38f5caa9cd25", "value": "786432:ETSgdmVExMP3JkDDntKous2UwmLqEs3ieCypuBJ:E2gwZGDDntKous2ULqEB4cBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685022186, "uuid": "49470eff-526e-4cb9-83f0-1ad9dc4fcf53", "value": 31846776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685022186, "uuid": "a0695878-50e8-4903-8d6e-57ebdc02f8c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685022186, "uuid": "d11cd0bd-48aa-44e0-980b-7e49b82f998c", "value": "MetaMask.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24361526-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996873, "uuid": "e20ab4c0-6d2a-488e-be12-2ea5ac4a5494", "comment": "Malware payload", "value": "3776ce680276d261325ba4f5421641f9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996873, "uuid": "48754428-4191-45bb-a4fc-b1c121a93ab1", "comment": "Malware payload", "value": "3fffbd14b6b918a39a047397935e0097f6557e59b79026d3f0318810836c5562", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996873, "uuid": "b63590c7-33d8-4d13-8bf3-4c33fbeb6240", "comment": "Malware payload", "value": "42c622f1c6581b12ce65989dfcf9eb371d16ec45", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996873, "uuid": "3e768c17-8284-4bdd-ba56-49e770c66af6", "comment": "Malware payload", "value": "2cd1aa302c8340f574f5e4fc51d0028796e927d89db502e468a47d4f4c3aa3d78ad2d60d975d2da9e334a7614121f90f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996873, "uuid": "b40fa1a4-174e-4025-82de-2a5fd9e1fbcd", "value": "T12054B880475528B24B5B2F36A73094B5EB7E0E79C2C8598BF46F7251FBDE98CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996873, "uuid": "29bf4315-158d-411d-bdce-7150db27b17d", "value": "6144:RBPpyngKREGLlGbS6cp/MJ/ie49LM3zWTGx:DxV8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996873, "uuid": "a1b0b7f9-ab85-40eb-b436-ccfc17c1d1f0", "value": 299616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996873, "uuid": "78de4dc8-9f09-4c76-ab59-dea3fc974441", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996873, "uuid": "7707a37a-1491-424c-af54-b1612383ece7", "value": "incrustStaphylo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b8daf3-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997226, "uuid": "5afa7ed0-9b67-4f11-8f1b-10fefefac629", "comment": "Malware payload", "value": "be0befe76b79784b9fd530336171a3d0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997226, "uuid": "f061905c-9e88-4b3d-832d-f1595d9b0797", "comment": "Malware payload", "value": "403053ac6c20ce05025339612c9cdec1db7dd980f6b07ecd0d73e8b3b1e21105", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997226, "uuid": "ed62fc35-5b7b-46c9-9988-a22f00ba4880", "comment": "Malware payload", "value": "57aa495978c10af96fce5865e7ea3f856740ca9f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997226, "uuid": "4f5e9b8a-1088-48bc-9774-02f662a9f205", "comment": "Malware payload", "value": "a6038345ec1ecbba9d1fc0d3ff945f1acc89ddc5e4b0cbca08db07ba7929bcf1483bc5409f606499d979ba2701e71728", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997226, "uuid": "adcc9467-21c4-4ed3-987b-5f2453ade4d2", "value": "T19F54CC844B1529A64B5B7E367720A4B9EBAA1F79C2D0468FF45F3261FBDF90CC8C1121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997226, "uuid": "119c0588-5450-4107-a973-4e0f02121b07", "value": "3072:C1gYdh6fukGcD3VmZKkh1ZssNLZyrEPa8VM1jZflQT1DP:OgYf6fukGcD3UZzTjS8VM1jQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997226, "uuid": "6bc4e8e6-87dd-45a7-82bc-0f78960acc21", "value": 297622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997226, "uuid": "665adaf0-fa41-482f-97b3-321b04cb5aac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997226, "uuid": "a48abe54-74db-42b5-89d3-c75334152451", "value": "leatheringRepac.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3ee6ee-faf7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685017448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017448, "uuid": "4322bd60-d7a0-4b73-a0cc-4ea3858d23a5", "comment": "Malware payload (RedLineStealer)", "value": "a9d65790a07fd8192cd6c06a44768f50", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017448, "uuid": "f35092c2-dc7c-43fe-93cd-3b0a41f42329", "comment": "Malware payload (RedLineStealer)", "value": "40a496bad6013c71eed2a11866d19d127a96a23f11ac11157102141eade2dbb7", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017448, "uuid": "19a5d491-1515-401f-bbd9-b946ca914fab", "comment": "Malware payload (RedLineStealer)", "value": "40f8b729233c3ffe7459a88fc647a9f13fc853c2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017448, "uuid": "09175852-2a40-46a3-b2ec-f9296b36da31", "comment": "Malware payload (RedLineStealer)", "value": "28f28ed176a5fb087e7a8779a97eff78bdfa875730da1a2590edb5b0d683ff42e6f7fa22c25652c18512f0355b20a0f1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017448, "uuid": "07abb77a-0d7c-4b54-a170-953d80839769", "value": "T12D352322E7EA8561FC917BB259FA02C30B3BBDA04D60472F670AAC6D0D72755E671313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017448, "uuid": "1a029f23-7b91-4c0c-9b6a-fee0a0606d0c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017448, "uuid": "a32b569c-0f70-42d3-afef-75b11196e99b", "value": "12288:AMrGy90YhHyvcci+aflylMQS7eA8c2fdi74+SyxvyYXuiDKfDJ0HIaVxVdVEro0I:2yDJN6/7A8pFr+2wDKmo20c0Yf7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685017448, "uuid": "ad3a9e83-49ec-43ae-a965-c8481128e0cd", "value": 1069568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685017448, "uuid": "a1fbc15d-160d-4260-b64a-eca91cbe8822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017448, "uuid": "c31bcf99-0cd2-4f55-93a0-76ae9db8cb7a", "value": "01880499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6dd06de-fafd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685020285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020285, "uuid": "d2f10871-2fd5-476a-b443-42b8434a0245", "comment": "Malware payload (Gozi)", "value": "b243fbf64686efc156a7248db8bac0ec", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020285, "uuid": "6dfd8f69-3eaa-4433-80a4-3dee9e7ca601", "comment": "Malware payload (Gozi)", "value": "4101cab81e757fa62ac9cb4bdd0d3102e5be0796ceec17b4a5b04d46b5cc3cdb", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020285, "uuid": "8af44a50-fbf4-4b3b-a2d1-c502472f0036", "comment": "Malware payload (Gozi)", "value": "e78f1e3f668d76e9ecb6002562f486647e331c33", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020285, "uuid": "67d46e08-66cd-45d2-bd7c-2e6c27b2cf53", "comment": "Malware payload (Gozi)", "value": "b26124ed8e54b436a8195ef08633a3f5b3addfcde0d36943491b9b25b2934efffd13094e484fbddc42cac15a472d33b5", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020285, "uuid": "02acd919-f723-4f4b-9d25-b40e8db5a452", "value": "T18413D06BA6E9A84DC08719F1946538819A4CF377BFE008D338ED4CDF9704C28DE676A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020285, "uuid": "b35a592c-2d4b-4599-b556-a8819a1ec0ab", "value": "768:x8T8z2G1tl83MLrbeZ6B6vySz+2HSvjx38prfQGnhfD5xq3Hd5srP8Nkg:x821tl5Hb9BZS62HS6tlSt53kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020285, "uuid": "88df562a-441b-416c-99e8-6dffe31511a6", "value": 43269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020285, "uuid": "bbb034fc-76e5-4b10-a3fc-a0e4e6ad1a5b", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020285, "uuid": "5cca1726-389f-4c78-b592-2d04121ceff7", "value": "comunicazione(1)(3).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "decdf987-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998045, "uuid": "e62c894d-2fcd-4dbd-97f8-3dc67a921636", "comment": "Malware payload", "value": "35c065a0a1deae59ec1f754cef398408", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998045, "uuid": "52fe54c9-70d0-49fc-b89a-3f9c82d5e8b7", "comment": "Malware payload", "value": "4152e3bb5383d05c14803eea40724571ffcbf222b6e50a61aeff1022d174a004", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998045, "uuid": "6bbe6285-0d68-45c6-8459-299862b9eda8", "comment": "Malware payload", "value": "b776e35f5bd5efa39a57ba75f9cbcb7370f01ebc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998045, "uuid": "6d157304-b092-4465-a562-c289e09deca1", "comment": "Malware payload", "value": "cfea34eab124a147a175ba5429c5d3e37523b57c1b6aacc7668f72f2a889c03f5295659ba85d2d7083abec583fb63458", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998045, "uuid": "1791c230-529d-4891-8cc2-d4c2535d0c20", "value": "T1036486804B1518A64B4B7E36B730A4A5EBBE0F75C2C4598BF46F7261FBDE94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998045, "uuid": "29ed6108-c4b7-490b-893d-d27c212d4661", "value": "6144:p9rLmjV3DGiZpTK3bs8zDVn58fcePFv2Q1:TZ2Ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998045, "uuid": "354b142d-a215-4eb5-879a-f3748b685cdc", "value": 326467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998045, "uuid": "1a0e78ff-e7be-4a51-b20e-dfaeacee6df0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998045, "uuid": "e4015dee-67ca-47fb-aecd-7408e79fe571", "value": "UnafflictedlyRh.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9182c7d4-fb15-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685030557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030557, "uuid": "5adab235-edf8-4e5b-a49a-02c96a889b8f", "comment": "Malware payload", "value": "c7f3ff6056ee802953af5a271166755a", "object_relation": "md5", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030557, "uuid": "07668219-2b66-4fb8-ade0-812f2e7fbd06", "comment": "Malware payload", "value": "418c0706510868bf2afad98bfb66d7492fdb594ca8d477aba89f471ca00d70fd", "object_relation": "sha256", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030557, "uuid": "8d6049a8-fe0f-4b88-aaf8-0b13f2ca1432", "comment": "Malware payload", "value": "08a6cf51a4a5478c983205e2e4982b62161c5f45", "object_relation": "sha1", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030557, "uuid": "8e2bff4d-e32d-4ae3-a79a-94375e38c847", "comment": "Malware payload", "value": "d0b4c63fac8b4c7b3f059c6904a472214103a27dde2e8108683b2bf808d60e5e36fff48a9f74b9ab10bd76478cabbe5e", "object_relation": "sha3-384", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030557, "uuid": "757a7092-c942-47bf-9c39-ef7d05d8a442", "value": "T105B41257CF2B1FDD4D1C0F4D84392E060A9EEA2B2831D8D8E69F2D6B5529D4811B4F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030557, "uuid": "66eeb224-7262-4533-847b-5af46d0677ca", "value": "12288:XKNJm9i7r3d7CwYhVOc00Gquv6lViYWZZS26PcF+xCOs:YJZr9zY7fNAYWyEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685030557, "uuid": "503be8d9-a0ce-45e2-b808-cae01e7a6624", "value": 509717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685030557, "uuid": "e620dce8-e99e-4117-aa5c-4c70b4dd2b28", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030557, "uuid": "ba27bb29-babf-41b0-8542-c48027710766", "value": "Invoice DocuSign May 25 2023 6841006.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9975b820-fafb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (OrcusRAT)", "timestamp": 1685019403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019403, "uuid": "41a400ee-8b8d-4e85-9801-491a177119c8", "comment": "Malware payload (OrcusRAT)", "value": "1b2e46873d9b3e346c21492a1f1c612a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019403, "uuid": "f19370b1-b886-43fc-bfa1-ab8a2935b5df", "comment": "Malware payload (OrcusRAT)", "value": "421a3a05b2075995ec1a5e0fe9307f88c7faeec3d28052d5071ce2e895afadec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019403, "uuid": "127aa96a-3879-418f-80fd-4b83ece50ca1", "comment": "Malware payload (OrcusRAT)", "value": "5fbcd31622ccd101b3b1f7184f5133f7fa3a2766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019403, "uuid": "2ba2574c-c80b-470f-8fa1-225a5cab1293", "comment": "Malware payload (OrcusRAT)", "value": "cad522d61d493b8093085a3c78b56bebfc0d63d969116168efe8d784e2bf736e47bbc04c61843ab293368dac205a3d3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019403, "uuid": "206e8cf1-7e5c-45c6-9171-6aad136f1db8", "value": "T17C1622113FFCBE06C1BE2678A7732AC91BB4E9069941FB0B0960615C0D9B7427E553BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019403, "uuid": "2d073e0a-96be-4af5-adcf-38b524271f8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019403, "uuid": "8913326c-7352-416a-a1a8-6894751d095f", "value": "98304:MpX2LQT116ToppwMgVypSb2TgTUKo9JCm:w2A13ppwMgVypSQJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685019403, "uuid": "367785f4-3027-4c24-a8e2-b6a8b2996a78", "value": 4370432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685019403, "uuid": "568a248b-aaa2-4fe7-85bc-4fd9a579c4ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019403, "uuid": "5a7f10dd-e6a8-41fd-8a0b-0facabb62f60", "value": "1b2e46873d9b3e346c21492a1f1c612a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab1e0fd-fac3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684995192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995192, "uuid": "b14b6e57-c865-46bd-89e1-a26a4245dd93", "comment": "Malware payload (Loki)", "value": "87307b1d8c8a6af4566da42d4f8f66e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995192, "uuid": "e8c27886-6873-4070-b234-0169a80d1c6f", "comment": "Malware payload (Loki)", "value": "4229ac95a7cd9cc9eb93d0d77a73c9120aff761dbaf18fd51b23dfa766408137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995192, "uuid": "7b56804b-93f1-4b38-9f42-01814528179c", "comment": "Malware payload (Loki)", "value": "721bda4207dee819b4ab45449dfaa8e02befc67f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995192, "uuid": "5301203e-a7ba-4404-a9ab-56beaa4e3c14", "comment": "Malware payload (Loki)", "value": "246655bf94c4808fffb70225a24cd9e1b73f8ae829f9b0f8806f0d80db00c10d0b1f585c759d607907f91b3182115176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995192, "uuid": "c6abb59e-00af-486b-bec5-7fe213073122", "value": "T174D412F03A2A2765E6AB0BF1042076F0177FDB863672E6931C8BE6DAFA11F014551787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995192, "uuid": "bae1cc10-4e96-4c99-a3fb-e726da0da9b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995192, "uuid": "a3c43f9c-142d-4d14-9c9d-2042eb48277b", "value": "12288:haWIm6lVvtzZBEP858gdVrNpWoK3inxeuMFe2pI73wFJwRzAEV8srb38iPLic:ITmIt9BEP8+kVfkNe2pqo8Msi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995192, "uuid": "5c14a427-d3ed-4fa8-b998-9287969b895b", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995192, "uuid": "aebebd49-368e-44f5-aac1-ec1c56cb9584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995192, "uuid": "178f80b3-fc33-4692-b103-fb3878ea54c1", "value": "TNT Express Receipt_879293076647.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32dc2cfd-fb31-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685042424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042424, "uuid": "7e53f965-450e-475b-8b3a-35495a699689", "comment": "Malware payload (RedLineStealer)", "value": "9323651feb385b6c740c1379e759c5bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042424, "uuid": "7fadcafe-bdc7-444e-b12a-155d973b58f1", "comment": "Malware payload (RedLineStealer)", "value": "43327f077e11d33669b9baa6cf6dbd0cb12d151f684ba442fa11af3bb3a5929e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042424, "uuid": "fe88634a-197d-483e-a9a1-6546685192f7", "comment": "Malware payload (RedLineStealer)", "value": "dfc9eac319ecc19a3c4ff0d588509c24dccf4795", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042424, "uuid": "7d8bf6d5-aadb-4c4f-b0ad-42f9aec5a21c", "comment": "Malware payload (RedLineStealer)", "value": "38e1b0364d1aa959ab588cbbc648b4258619fdbb52bddc2114bcf6b7a4bb895f3a4d5908d15e461ed4fc9e8a5093b4be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042424, "uuid": "c13e3047-df29-4648-aa6a-c252047c33a1", "value": "T1A5F42223A6D84032D8F117B058F703930E7ABC515EB4877F1385A95E29B37A4AA7077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042424, "uuid": "00edbe49-d902-4897-936c-518dcb2f0f35", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042424, "uuid": "a28b29f2-9750-4165-bd06-73daf038850a", "value": "12288:FMrky906927bky+K+Be9LkeqMNG+hFCA5rtg4EHy8A2Dyw8bREWSkBFynMMtIW+M:lySnky+YxkepL55reVS32GNCdkfyMM1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685042424, "uuid": "2c4ac8dc-2454-4fb7-afc0-5ff0c194c358", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685042424, "uuid": "0c137758-6b8a-4b9c-a30a-c889cef4c7c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042424, "uuid": "b1efdca6-24c1-4f02-8aae-23cd4e8e5638", "value": "9323651feb385b6c740c1379e759c5bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9ce025-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998012, "uuid": "1b4467b0-4f14-4577-8a32-ce2662d3c17b", "comment": "Malware payload", "value": "f690bcabc743524301dce49ad18b6cd6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998012, "uuid": "55e6d1e3-5403-4f4b-914c-2f79f575ea1e", "comment": "Malware payload", "value": "43e24a1fafb810c0b8328f6c4897bc46ac5d368c0469bd6aba92c81055381da0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998012, "uuid": "471c6b80-501a-4f3b-91f2-de50b43b20e6", "comment": "Malware payload", "value": "44f2f497aee3aa12f4b5a04a158cb722d6b30c99", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998012, "uuid": "31ee3fbe-1bae-4fa2-a932-adb5c7f4c266", "comment": "Malware payload", "value": "f083d27726923f8bb65722ce2a56712191a9f93cb154cfbe9b40e8ef21768b64cc53b3c993974ac088db869a68c1c0eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998012, "uuid": "d4e7baa9-9ed3-4d1d-bc77-670ce0dccaf8", "value": "T1213496844B1129624B5B6E36B730A4A9EBBE1EB8C2C4558FF45F7250FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998012, "uuid": "cbc2c79d-8cdb-41d0-87d3-f03f22dfe78a", "value": "3072:pqXcaJ+hmLVdJyWtnM94Fb4ipwsQe5BJg/ZBhKhMt2U:wXczkR7tnM941n+/ZLt2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998012, "uuid": "6feecd96-e5a1-4911-9c21-c4f23aab6a55", "value": 248798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998012, "uuid": "e85b9b96-af25-4e10-9d08-7a8cbb948155", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998012, "uuid": "6f483b81-88fa-4213-b01e-681f239fa21a", "value": "Tonalamatl.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af0bf01-fb11-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685028747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028747, "uuid": "56267f32-c6e3-4f5c-9236-bf53d69cd3c8", "comment": "Malware payload", "value": "51ad4da3bd6573b81eafc19773b0df93", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028747, "uuid": "d7157807-1d58-4759-9050-e045e04246e8", "comment": "Malware payload", "value": "43f92974fffda0cfdc9bd019c23a34fc56c776c2c8def3275c306d66f6f3ea6c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028747, "uuid": "e08008bf-4ab6-4aea-8cd4-1ec54967a679", "comment": "Malware payload", "value": "f5cebf669a16feb7a97f86d287a0a2be24ed5a74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028747, "uuid": "b720c2e2-18e1-44b4-a84f-c625956a7133", "comment": "Malware payload", "value": "e7bb3ea70c6b304830307d28bf1e3ddb25004c0c5d4f0c842ec301a2f73f69f4ff6e93465e1b536293f34dbc28132208", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028747, "uuid": "a25b7795-6282-469f-b907-b64ebdab0812", "value": "T1C953022B57A1F98DDE425775C612DB623E558B8BB39C028D2F74A3C533D8B6801AF10D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028747, "uuid": "c661fb00-a2e5-4fbe-9aaf-a6be32f93891", "value": "b4740b7551b2866375d7f1786cbe6e6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028747, "uuid": "274c4ee0-754f-43eb-b3da-451761b77ca1", "value": "1536:SNRbyL+kFF1ARzoTuN/4cyoIno0Dmue/46bnZ8lRZ0KQdR2:SNRy3WGaN7I/C14a8LK9r2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028747, "uuid": "2dfa6cc8-f13d-4f59-8874-bb8c6a32ffd5", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028747, "uuid": "ee629a3c-43e1-4d31-b54f-395673ccf521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028747, "uuid": "af839a4f-5f1a-4f26-8955-09b77a50078a", "value": "SecuriteInfo.com.Adware.InstallCore.53.162.23571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4437cd-fb46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685051778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051778, "uuid": "345a4f1d-b7fa-422b-9401-f0c44a23b3a2", "comment": "Malware payload (Mirai)", "value": "b492a9e23edc71c0e1a24946d5744e5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051778, "uuid": "1a27770c-3773-4e47-96cf-eb7503ae6e1c", "comment": "Malware payload (Mirai)", "value": "441f373e00d07d030d7ff365a9f16e48c37a8deec27a940878ffa1317bdaa3df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051778, "uuid": "4eaea47d-aec2-4bab-845e-9b55d59675cc", "comment": "Malware payload (Mirai)", "value": "e7053587ea8585254b91ab8e36e236a281d6f6e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051778, "uuid": "3d3d77bb-7632-4cfe-b04e-1c80c5057f0e", "comment": "Malware payload (Mirai)", "value": "e6cd1937789cbec019ee0fa78b035ff16040fbbca33e0704a2159eabe964f08415259c1cd6fec7c40542a3c535bad94e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051778, "uuid": "66869935-7574-408b-8c30-24859a583e8a", "value": "T146B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051778, "uuid": "19d767c1-37fb-4702-9d8b-229c78115e68", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1m/LWy:c9sSyzz36YaWWgg1mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685051778, "uuid": "6c43e7e9-8626-44f8-84cc-a81b03a1cd8a", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685051778, "uuid": "49a4f642-2a35-4be7-96d5-f12fdab42d35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051778, "uuid": "8e0de69e-baf4-485f-b3b2-d2136e4da6b7", "value": "b492a9e23edc71c0e1a24946d5744e5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c7c59f-facf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685000333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000333, "uuid": "253f5710-75d2-42c5-8b0c-f18d083b03b1", "comment": "Malware payload (RedLineStealer)", "value": "623d69f96ab20466f7a83ab719630606", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000333, "uuid": "698f516f-c335-4363-bcd6-6f19e8a9f095", "comment": "Malware payload (RedLineStealer)", "value": "45061550de915903c987f1a64f4a5d719cac6d6558c4dbe2e53519cea93d8af5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000333, "uuid": "17ff681b-afce-42ca-9bd3-0155d72dd5f4", "comment": "Malware payload (RedLineStealer)", "value": "2949a73095d5d846d77f264aa64b7441a3b3cd05", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000333, "uuid": "7722cfee-a5cd-458b-9bdf-ff4742c9d9f6", "comment": "Malware payload (RedLineStealer)", "value": "960d19cc5bcdaa6d3465c6dccc676daaa672c87500935abd0ee3b9ac560a7fae61a6e87736b63a1376db38e267cf4109", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000333, "uuid": "ced4a08c-f8fa-4f6a-94d8-e50a836161b6", "value": "T175252343EBE88073E87917B088F742934B7ABCA18D358B5B66455F464CB3394B421BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000333, "uuid": "9375404b-b238-436e-870d-800843339618", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000333, "uuid": "b0f088e1-d76f-4be6-94a2-876ae19f4a08", "value": "24576:IyUvUR/a/LiN6ZzkuG66h/fzpBhFMkfQzaYkn8:PUQa/L7VGVh/fHspzaYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685000333, "uuid": "6f099970-0001-4507-a7d9-a4190608ec28", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685000333, "uuid": "235c4c0e-fa0b-40d9-8f75-be41d3075ead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000333, "uuid": "ab301135-6644-4751-a89f-148dc2bf1550", "value": "M7R61533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d21a263-fb11-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685028751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028751, "uuid": "bea02d89-84b1-462e-b7e7-37e20370096d", "comment": "Malware payload", "value": "df5f5f01444225d7d44db805b8faf8bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028751, "uuid": "997ce0f0-2f72-4db7-a6ec-1949cdeb420e", "comment": "Malware payload", "value": "456790e9caf3d053d40f1d25cc561b4fdcdd91b5fd8d5caf0e3ed03cf3c6d8f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028751, "uuid": "a1f383a1-857c-4566-a47f-e11449a348c6", "comment": "Malware payload", "value": "e13a561d9bcbf25e54ee280b77c5375ac9af92d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028751, "uuid": "999464e0-31d4-4bca-9072-9e32c6f1c4d9", "comment": "Malware payload", "value": "05b56d557ec146c991121e2193f6bb3f36dd1864e29eb76a3d8f374d696f9c84d966582c3bfdc460fc7c516b7f6332f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028751, "uuid": "a2406bea-50fa-4592-bd61-789406eeaeff", "value": "T1032523069588D0B5FDA796F21D31DB299B337A7B1834301AB0DD6A88EF75652810C3BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028751, "uuid": "1a0152e7-b772-4382-9b1c-afeac97c2bd6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028751, "uuid": "1b4d23dd-106d-4041-8c5d-2639bab9f16e", "value": "24576:U2lWLzyZakddhnDewfL3sIWxrwQJwJU9wRpq93id:U2YLzyZak3kWL3IrHJF9yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028751, "uuid": "976e93df-b713-4417-a6c0-26b2f6b4f821", "value": 990858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028751, "uuid": "44454039-1fb9-42a9-a7ef-2bdcbcc1c09a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028751, "uuid": "30f86b65-b5ae-4815-a0ea-95238de57524", "value": "SecuriteInfo.com.Gen.Trojan.Heur2.VP.Ke3@aijZweE.23911.10406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26447a80-fb54-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Meterpreter)", "timestamp": 1685057435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685057435, "uuid": "a4f8c6d6-806f-45ff-9cf3-08c10adca240", "comment": "Malware payload (Meterpreter)", "value": "ab73ad9e35cf03898133ddadc732744c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685057435, "uuid": "e49e4497-718c-41c3-91b3-42ac3ae5cd83", "comment": "Malware payload (Meterpreter)", "value": "45ba49b1bdf286caad4aabde83c88838371eed396b0561ba5829d8b5f70eb27d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685057435, "uuid": "5943129e-39e0-4a34-9c9b-c48d7ebdc4a8", "comment": "Malware payload (Meterpreter)", "value": "6ba3ff506c949ae2a2bbbb03ddaaee79ea7ba07b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685057435, "uuid": "cdeaf164-a9bd-487f-86db-7ced0f847df6", "comment": "Malware payload (Meterpreter)", "value": "0d4660387a3c16cf25c386a4213a2a1fceeb18fc4b0de813a7d538ebab07bb3322244f5e92e8177c2406b06aeb17e729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685057435, "uuid": "bc8e33a8-ecff-491e-8eac-cab303f9e7fa", "value": "T1B373BF82E9C01432C196227D67753A7599B5E6F63601C1D5368CCEF9EBC1CB0A62B3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685057435, "uuid": "4403526c-45f6-467d-856e-7878365c631b", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685057435, "uuid": "654ca872-7032-4360-a5c0-b4014b47d0a7", "value": "1536:Iz4ERgIpBR1D88wazns/KWjU53D7o49R5iLlKMb+KR0Nc8QsJq39:eeIDPfslg53D7tEKe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685057435, "uuid": "38e2652b-0789-42ad-8810-f89f25d582ad", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685057435, "uuid": "76cfea11-139e-463d-9626-6b6089a8ca6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685057435, "uuid": "9c8c7e5b-552a-46bb-a9d7-377ac759562b", "value": "ab73ad9e35cf03898133ddadc732744c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f76b0d-faca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684998188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998188, "uuid": "33a6164d-21cd-44da-9b28-d61bbb4e0869", "comment": "Malware payload (RemcosRAT)", "value": "e959e3e1eddf849772e15251f78e0de6", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998188, "uuid": "3bc65454-2594-4eb6-84bc-625371151b8d", "comment": "Malware payload (RemcosRAT)", "value": "45f015ca6db6ace213918cab76ae06b0f66b45c8a95ef80fabd1928a35fd043d", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998188, "uuid": "3f9d2530-0026-4dbf-a25c-028b597f476f", "comment": "Malware payload (RemcosRAT)", "value": "5901e6816cd19e944f3822d6498d5aabe162a370", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998188, "uuid": "2ca79e91-40ea-450d-9c76-650302a05c6b", "comment": "Malware payload (RemcosRAT)", "value": "95c118fd020e2a0e5d50f973971b7c0bc1360d8a2a3563d92f0fb713630109f3e81d9410d1e6924536e75adc933c5724", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998188, "uuid": "cd458139-7c41-4cbe-8902-3075e389cc99", "value": "T1E5A4AE01BAC2C072D57524340D2AF735DABCBD212935597B73EA1D6BFE30190A72A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998188, "uuid": "ff97dccd-a16d-42f7-b5cb-72d43542281f", "value": "b1c8f7572a6db205362528e88fd3ff32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998188, "uuid": "eaa7f9f4-bc55-4453-8e12-42c08aa483e4", "value": "12288:uX8/Vx65HCnDAByqulR1fZJQGs/Z8tRq:l/Vc5HCnDABMfZJQNZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998188, "uuid": "ec8317da-57da-46da-8e9b-48edf97cea95", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998188, "uuid": "3cd69d95-4417-4a7b-a5fc-7f538fa51b24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998188, "uuid": "efb2867a-b4ef-4556-9e34-b528aea0e6c0", "value": "1684998183c3c8f1bd3f0ddeaee2db434539f9be609285262ae1e6dfb0e7bace8268ead0f1921.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0557ef11-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685003693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003693, "uuid": "bbd6c249-a90c-4ce6-a5ee-624e70fbcec5", "comment": "Malware payload (Loki)", "value": "d20a4039b259b16a264d59824bd0ccae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003693, "uuid": "b10e6050-2c7c-4c3e-80c0-c8b402cdbf22", "comment": "Malware payload (Loki)", "value": "4617a042fe44aaf516943d755d5c600dba7ac6b7c142aa6a9d3f17f5166bc77b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003693, "uuid": "4ff48b2e-e0f9-4c15-8254-533f11698e2f", "comment": "Malware payload (Loki)", "value": "4804aa673bc927140520194de12e11646f7383f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003693, "uuid": "8e19d2f1-cd5b-468d-932a-9667152f7892", "comment": "Malware payload (Loki)", "value": "5c96501a8c0ae70d6fb7299347ff6562442ed8536445a117a7d2f332125af844da0644d88288cece45d4ad5459f4a558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003693, "uuid": "2ad9a35c-64e8-4aaf-a3ff-0dee4512ec03", "value": "T1B5A31942B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003693, "uuid": "6c444d94-c1e9-45d5-b714-cc5551e51518", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003693, "uuid": "7e59fdc4-087f-4c5d-96a8-ab70216f0929", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003693, "uuid": "45a575d9-11be-4b96-a52e-9565df2267f0", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003693, "uuid": "36505613-c8f4-417d-9a9e-a0e310d26ffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003693, "uuid": "f3dcb5b1-fbcb-40df-b6b0-fbab8315af43", "value": "4617a042fe44aaf516943d755d5c600dba7ac6b7c142aa6a9d3f17f5166bc77b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d5d9c1-fac3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1684995315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995315, "uuid": "046b1283-32c8-4810-8475-e51ef5545fc3", "comment": "Malware payload (AveMariaRAT)", "value": "99ef3cad54ddee0fced96d3da2a2a6c9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995315, "uuid": "7bc51134-3b06-4cc9-9fb9-a57b3fd08e23", "comment": "Malware payload (AveMariaRAT)", "value": "463b268cd4afa5d7aada344628ece50e60ae207254032ce2ac0b510c3b8596a7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995315, "uuid": "c84d3e70-b9fc-49eb-856b-ba22d863e1f8", "comment": "Malware payload (AveMariaRAT)", "value": "e00fa263f060ef0a10f72ffe4ce18fefaf19dbd6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995315, "uuid": "4ede886f-13fc-428e-8ae5-685fc984e0c6", "comment": "Malware payload (AveMariaRAT)", "value": "3034e668a7474ee8741f779550eab9e26a16cf2ee226a0bb2d96b5f2f47488c29ae3508fb5c051b947356ef358b16351", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995315, "uuid": "3c398117-f089-49f4-9beb-2856893f94b1", "value": "T12535BF63F7D14433D1666E39AD57E7E55A1E7E202928744E2FF82D08AF352813C6039B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995315, "uuid": "0d0586af-ecf2-4404-acce-a49611c9ac68", "value": "b3b7f3046623191c43621fd310d374b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995315, "uuid": "79543d99-383a-46e7-9e01-7fff27a1a636", "value": "24576:GSWrMz8C3kJ+VnkaJ56TxIN84Mm/3vfJM5GJB:GS0o8YXMFIN84X3vfu5WB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995315, "uuid": "24b49f96-e155-4fbc-bb12-809f194c7a81", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995315, "uuid": "e7c86301-766d-478d-88e7-162e3880d3df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995315, "uuid": "06738c6b-1f4b-4912-ad41-ac12dbab49d9", "value": "Payment confirmation HA-9VVNL7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ff4f4c-fb46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685051740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051740, "uuid": "1af24cba-4daf-4314-89cb-b37f710d689c", "comment": "Malware payload (Mirai)", "value": "bdae482b7511cea963c8281bc846afc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051740, "uuid": "6a9e09d1-a12d-4b62-a669-a9b6e9bec415", "comment": "Malware payload (Mirai)", "value": "4645e352ddd76e6d8d4a1ce49a74d436139e3849e76a558c28b57579ff0519b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051740, "uuid": "2a1db3b6-3253-49df-8c71-8aebc3779ab0", "comment": "Malware payload (Mirai)", "value": "9cf2e3b007bee87ff661d05fe9e3aba91441e6a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051740, "uuid": "2d151d7c-bb6f-42dd-8da8-73bdcb53dfa0", "comment": "Malware payload (Mirai)", "value": "6c5048f90d9a5d609720c5299cf37fab2ca265c51ee98f3a92fe79c0b51fd3fb59904d147d5f66974dc47965b37dd971", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051740, "uuid": "d3815977-6fdf-4b24-b605-8cdb45086b91", "value": "T1D1336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051740, "uuid": "da3cfc78-52ea-4b5a-a5fa-ce20ee5c311a", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685051740, "uuid": "0240bea0-030e-4151-acca-31fb90a806dc", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685051740, "uuid": "e418bc63-c14b-4a45-b553-2c35247ce5a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051740, "uuid": "904a9cd3-01dd-49da-9817-bfba1b52d527", "value": "bdae482b7511cea963c8281bc846afc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4459a9-fae0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685007811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685007811, "uuid": "2ac1e1ab-f226-4e48-9424-2576b5589ff8", "comment": "Malware payload (RedLineStealer)", "value": "4c4a5d720c16d1879e26df12b017c0fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685007811, "uuid": "28edf10c-b6a3-44d7-905e-049fbd8150c8", "comment": "Malware payload (RedLineStealer)", "value": "470dd60a0a657fb951213ae3517ac9dfeb22a4f4ca9086e3d060b92b6caeaa44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685007811, "uuid": "5b35d71a-869b-40bc-af49-83b68049f82a", "comment": "Malware payload (RedLineStealer)", "value": "1e1b3811446cf66352f4df2d318e9c8cb26c278b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685007811, "uuid": "3ead8761-9316-4d9c-b837-a28bc86db3ae", "comment": "Malware payload (RedLineStealer)", "value": "b821611cd71e0e649b3e82b56947ed6677be81f5c2c9825ef20e880b8d8e19732a74f3a12d9eec41334ae2080ce57082", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685007811, "uuid": "a0b1a001-97f5-4c51-b1a8-d495d9a3dc9d", "value": "T1E384D01273D16C71E52A1A358E3AC7B85A2EFCE08F9577EB23886A2F09701E1D571707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685007811, "uuid": "c62712df-44b6-4fb2-a9de-b390a8dc5b23", "value": "761a416c92dda0b5d3a5091999204e5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685007811, "uuid": "d4109195-7fb4-47aa-838d-cdf1743100a4", "value": "6144:GGsv8KdkVs/YApeDL6eyiLMGXvyaWr5z21wCjYi7fX2suKWZKM:GKKiVcYAeuUwMW126Cke+9KWZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685007811, "uuid": "38f021b3-94b5-460c-b42e-e959744ff126", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685007811, "uuid": "1fa3ece2-e7b6-467f-99f2-f1c7e2ea160f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685007811, "uuid": "532ef08b-e8a6-4b0b-b198-7232e30b09f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78dd0beb-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996585, "uuid": "0197ae73-223c-455d-aafc-c0d3227edf61", "comment": "Malware payload (Quakbot)", "value": "f163a8073a26ca610da5d4dcd4863a23", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996585, "uuid": "04c43abf-331d-426e-96ce-3b36c545af0f", "comment": "Malware payload (Quakbot)", "value": "48ea9270acc953d4d71351d55caa05d19644a07ccafe9f806f9b70d19c37c7cd", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996585, "uuid": "716945d7-009c-4d2e-9cc0-c9b6ce4b5d4e", "comment": "Malware payload (Quakbot)", "value": "ea88c5ce53f867391ecb36e12d86f1e668fa842a", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996585, "uuid": "c303b368-625c-4c5d-9dc6-e721de246d24", "comment": "Malware payload (Quakbot)", "value": "354d977c74bb6838920b11ae85ea12f73cb93f3aae1c9ba0fbf61b83eda98509f345fac4e4f910008c1f57c308e8fefe", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996585, "uuid": "673fc206-8caf-452e-9a69-6aee1bdea338", "value": "T13863095FE380133879214237640E56E5E7E148786B76DB78A81DC62A3321C39E5BE1FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996585, "uuid": "4ad63feb-21da-4cda-ae55-261985fafb48", "value": "768:8xIcMyrD3nlbURjBMMK1p6GDKoxrC6tdSbBmEQ3u+lG4dzj+l7lNdNiesWsz4GaB:mMaaBuHC6rSmB3ueCl7lRqWiiSk6kHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996585, "uuid": "eec4647e-ffb7-4b8f-8494-d5150479f209", "value": 70729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996585, "uuid": "4a7d8188-e93e-429c-922c-21b4f139efdd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996585, "uuid": "61d40b0a-0368-4eac-9134-ce929ca66a6e", "value": "Claim_A560.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fa5eff-fb30-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685042125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042125, "uuid": "500beea0-93af-4186-af65-46a4a7c25578", "comment": "Malware payload (RedLineStealer)", "value": "a08202b9df39233fe5be941dc99ed95e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042125, "uuid": "e38dcd0b-a228-499b-91bb-03ed67667a48", "comment": "Malware payload (RedLineStealer)", "value": "49c732500f919c6dbce4128a8835595cc8a4decb0c0e20c8ac6d167a3ddc86c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042125, "uuid": "0b1d0e84-e469-435f-9ce1-61cbf9e14bf8", "comment": "Malware payload (RedLineStealer)", "value": "4ffbb3fa6d23cd78a98e7229f7a8c129329fd4b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042125, "uuid": "9a533c27-1edc-42ec-b983-9e37f62eb9c8", "comment": "Malware payload (RedLineStealer)", "value": "cb48389ac935f624c9968085303d49b884528f231d03fff84c742b8bdfaf4054cd979574fbff98ee5e57c0c5e5277ad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042125, "uuid": "c2636fbc-153f-4d4d-8582-039abbaebc66", "value": "T1E505C5403C546B6CF06A9FFAF748BD36E15719819E54A8F77ADA2A84439D2BCD7203C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042125, "uuid": "403966eb-19b5-45c2-a363-aa3c14f821b5", "value": "34f100dccd5363ea782eb30d12b39b9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042125, "uuid": "110796b5-b501-4722-b250-a3f472699228", "value": "6144:JxGY3rtgZDEZZQm6BAOFfs59IUk7CN2XIGtxc1rW/:aY3rtgfBffrC0tIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685042125, "uuid": "733a7782-1b8f-4b29-b798-8ee0bc9562d7", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685042125, "uuid": "7acf8ceb-263e-4386-b213-11e4a5314e0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042125, "uuid": "a5f4d514-0793-4dda-b062-093cb20e257c", "value": "a08202b9df39233fe5be941dc99ed95e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87c5c9d-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996772, "uuid": "1eb5b6da-2e74-457a-a3a5-9306faa06ba7", "comment": "Malware payload", "value": "135a79528cc5c615654e274f5d915cf8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996772, "uuid": "8f2ad0f4-cdaa-46d1-9e70-f6068d2e08e3", "comment": "Malware payload", "value": "4a5fc5b68493b984e7f1faec6de881b5388c741684d331d2546f7bb4f607f8e7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996772, "uuid": "677a3522-6b57-4fd8-99cc-3a6d03888d71", "comment": "Malware payload", "value": "f0a07bc4c9359e4029e07f397f9f50e9cdd6c590", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996772, "uuid": "495c7af8-3649-416c-ba33-7265e4e0c73f", "comment": "Malware payload", "value": "f53c7db5af5ae5f6ed026d76934e1d68968d92cfa2b0a1651f84cfb129a2a9f5ddccc4e489e7ee508d2beffb66975417", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996772, "uuid": "8d5bf5ed-20dc-43b3-94bc-93bfb502b70b", "value": "T1E1748784471528A24B5B7F26A730A4B5EBBE1E79C2D4458BF46F7260FBDF94CC8C1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996772, "uuid": "7bc81c8e-9241-4325-95b3-327ee8b5a78f", "value": "6144:7BKsYOxZdnpLQxSJ2poAO0nFcAp8J19ooyLC7+rzH2z+ywx8ZeO/YrovoksHK4Z+:dKar5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996772, "uuid": "5eb86e71-98b7-41d3-a6ea-8d3d18a7e535", "value": 347652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996772, "uuid": "72677b4b-99f3-4b4a-8bcf-e965b0813552", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996772, "uuid": "c970b5b9-e5eb-42f0-b3c0-360fbee9cff6", "value": "handcuffsPaxill.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e615dc09-fadf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1685007506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685007506, "uuid": "7bc91900-fd7f-444a-befe-cdde97373b36", "comment": "Malware payload (TeamBot)", "value": "4231da1fb38077f0475a29930c760165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685007506, "uuid": "3ce73f3a-5bf4-46c8-8401-f82eb777e845", "comment": "Malware payload (TeamBot)", "value": "4a7c67b1f968f885eccadb8c083c47c773fcb22b5025e061f31c38bd6b9be916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685007506, "uuid": "cf36c198-5ead-4db4-8bff-866a711f1c36", "comment": "Malware payload (TeamBot)", "value": "0702058f9a9a589710a0042fb6bcb28a59259a46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685007506, "uuid": "b3313327-66c0-401c-b795-5a5de9f19b25", "comment": "Malware payload (TeamBot)", "value": "96b16f6ffdc58b0849af302fdd675ce50f0f595406c96e2d45f1cbf3f900a9044b8404608529e38169fa4052138cfa33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685007506, "uuid": "6a7cf90a-c67c-41f6-8a7b-17941cc18b69", "value": "T12B548D0272D1AC31E51A1A358E2AC7B96B2EFCE14F156BDB33947E2F09702E1C572746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685007506, "uuid": "68ea1e5a-3b2d-4aeb-9506-979fa63bc2c8", "value": "761a416c92dda0b5d3a5091999204e5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685007506, "uuid": "7e8b7511-4fd1-4f7a-81d2-42924b7aa85d", "value": "6144:lGspRvj4jgqhSh06E5NlH94GYRAJXtkkJz3+Q8:ldvkjBhShs36AJ9Pzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685007506, "uuid": "ff53ce8d-7ac1-4400-a184-ca6fbb38ea80", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685007506, "uuid": "7bae0f5c-43b0-4397-935a-d55635cbbbf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685007506, "uuid": "c03ad2f0-6fb2-4db1-8e2a-c148d5ba7543", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21106c64-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003739, "uuid": "367d68e3-2910-4df7-9a4c-5e23aa178897", "comment": "Malware payload (AgentTesla)", "value": "d5858b70253e02094744f540c8266198", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003739, "uuid": "39ee56a4-8cdb-45d9-bb2b-eaf6376ea4f4", "comment": "Malware payload (AgentTesla)", "value": "4ab4ed9170d6a77d6c4a3c4716b94fc3aa9bbed1ee6eb631736d98a5a5d6b791", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003739, "uuid": "6b511f5f-132b-4025-bb6d-446d47002a03", "comment": "Malware payload (AgentTesla)", "value": "587e1718483278deafc6079c89ef70f8fe47c301", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003739, "uuid": "08ebc57f-6263-4896-8326-9ab0c7eb9d42", "comment": "Malware payload (AgentTesla)", "value": "e64fd418bcb686bd58aff4568552322b74142c3aba957e6f833944931757442633bab01b8c53425d600b4ee921223403", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003739, "uuid": "6a31a916-b560-48e9-bc1a-6267221a4e2c", "value": "T1B50533398B6585DAC07BD37466C805AFFB639B17B14C97784CAE234262A35CE60C3C9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003739, "uuid": "b6017098-be20-4987-a086-ca147d421510", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003739, "uuid": "81fa69d6-0298-41e3-a891-cfeb60c19610", "value": "12288:ivJZESljSNEO8tOCB1OXGuY3p6Q1p+RlFv:SJZ7yjkbuY1p+nV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003739, "uuid": "d6834ba1-c8b1-4a54-9a94-fd32d33a6452", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003739, "uuid": "c24f0fa4-e9bb-4330-bbc8-7d39c9f99fbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003739, "uuid": "3ade9d1d-23a0-4748-968d-687bd1273b17", "value": "pJn38FquDNO4yDn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb3007b-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997186, "uuid": "8ab27836-768b-4b56-b4af-d518bf2ef66b", "comment": "Malware payload", "value": "51d364bf32eff9357ebc607f1d8e1dfe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997186, "uuid": "31417640-0ab9-4aac-bf48-b8516bd95b37", "comment": "Malware payload", "value": "4b16bcc633f22fc8feacc0fcd6bfeba94fd52882bcc9e27b5caf4134ddd3ebff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997186, "uuid": "0ab3553f-4f87-48d1-8332-59efb07fe7cf", "comment": "Malware payload", "value": "7ba0aadf16486656966d722bce250dd62ec0b3ac", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997186, "uuid": "609121fd-2307-48f8-b120-8a234b290c50", "comment": "Malware payload", "value": "1c80cdcabc00b1cc8fe73c45484dbd7c4420c27b2e1426409539aafaaf67c9b5ca09d06aa860d5acac1f9f20c11c4cab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997186, "uuid": "46d28257-bd4b-4289-9cd6-0ef6faf7e430", "value": "T1E96464804B5128B64B5B7E26A730A4A5EBBD1E75C2C8468BF45F3251FBCE98CCCD1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997186, "uuid": "6621ee8e-a4e8-4573-876d-3f96dcb3c9c2", "value": "6144:KQUu1goeypv2UoyYFW7nsDhMox+hfiVB1:KQUkV705+OT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997186, "uuid": "c9782818-cb5f-4774-9983-51022943181a", "value": 307878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997186, "uuid": "69fd4ada-fc32-42a6-8988-bed62d09d0dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997186, "uuid": "6508a545-bc76-4ce6-9093-f8b0e4b63e19", "value": "marxist.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36cee387-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994756, "uuid": "7bdcb519-d155-4d97-9c2b-389d92b13b30", "comment": "Malware payload (Quakbot)", "value": "f809175124617a359990c0ec53861fdd", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994756, "uuid": "842db967-86a4-421a-bbb3-677fcd64c0da", "comment": "Malware payload (Quakbot)", "value": "4be898c42e9b53ed2142cebcd246f152be4e7de3b95209e60af2926b0912e4b1", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994756, "uuid": "090fadd5-3774-4bfb-9182-a902f017ba2e", "comment": "Malware payload (Quakbot)", "value": "1e3ca7987d8fe129367ba8a86149044bde323462", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994756, "uuid": "d1137c1b-4be1-45e5-9ad1-1d1cf7e5a32d", "comment": "Malware payload (Quakbot)", "value": "7ab793ce7bd767925bdbb60940c8fdacd0a364890272af297dbdfcb55e8456914fc355b38b4e08198d1cb25f1cf2a34b", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994756, "uuid": "9f4fa4d2-1904-4613-8d39-0872f2de76ff", "value": "T15673196BA384133955220258524E57D1E7B488787A61DB78E88EC3AC3341D79C3BFAFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994756, "uuid": "216b7b99-7dcb-46b9-871f-26fdb3f2db81", "value": "1536:BTojDcSwisc9wivcsj/tkImvCURaSXIZ+PGvAflDCuVzjIcN16cQi0QidVwl:BTojpw/c9wgj/tHQaS4U+4flDCxcNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994756, "uuid": "16c4b464-757b-4aad-b224-d35a02b18098", "value": 76041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994756, "uuid": "a43ccfa7-566b-44ea-b33b-27facbf317b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994756, "uuid": "cf3eee92-f00b-4f18-91bc-03b7199ca841", "value": "Claim_F851.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ce2d53-fafa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685018853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018853, "uuid": "d65a991d-fc26-4039-b86f-8cbb6950dc10", "comment": "Malware payload (Quakbot)", "value": "dfb961b1ed58b0f6c26dc80757a38006", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018853, "uuid": "e75afdac-85b3-45c2-a159-91e7d2665f19", "comment": "Malware payload (Quakbot)", "value": "4dbbb74e92c5dfe7963a985aa28dcad362b1f7654b083b0a4f7a278e9209df79", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018853, "uuid": "d58898a3-627d-47cf-a51a-ba4e18a5da8f", "comment": "Malware payload (Quakbot)", "value": "c0d3f6bb0da22800632e64fbcc79bdf7dbdc566a", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018853, "uuid": "4fc863e3-bb5c-4618-98fc-f48c0ee36b8f", "comment": "Malware payload (Quakbot)", "value": "5a5445029de2581e3713f120be5e960e0e32710854435d8958778ba974bb7999ea382e5e0a12097c83a9a04e9fe0f225", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018853, "uuid": "d634cd95-beb1-470e-bc0a-3737035d4b16", "value": "T18F63095FD38113396A224126614E66D0F7A244387B22DB78A84EC36D3321D7DD6BE6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018853, "uuid": "f13bb315-e0a1-4b9d-91e3-2d88fa3b024b", "value": "1536:PwiTJwLzzBSnwivcRJXmkxlPfxTv888ncf:PwOJw3zBSnwd/Hqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018853, "uuid": "c4ca5ce6-8a3d-4ce8-8df0-a2cf5692643b", "value": 72776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018853, "uuid": "c884a8d7-c831-4c11-8392-42e7463e1d66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018853, "uuid": "262e996d-fddf-4ede-9521-84839025e3bc", "value": "Claim_C697.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85a237e-faea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685012127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012127, "uuid": "c4059dce-dc86-46f3-829b-af191630429b", "comment": "Malware payload (Stop)", "value": "7f6667ae84281e5d97ac298efbcb6707", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012127, "uuid": "32de1d1e-e9fa-4e30-9660-0fdf33af424a", "comment": "Malware payload (Stop)", "value": "4de2d00f758ece9e388f390616b66ca6581376cc674a6c2448f1bd9301246e8b", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012127, "uuid": "5bc3cecf-14eb-4840-8ad1-5737843d87f9", "comment": "Malware payload (Stop)", "value": "1a88e2c8803884c71dc0955c7cfd942fa875617a", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012127, "uuid": "572f470e-756f-401d-939c-9bc6368261cc", "comment": "Malware payload (Stop)", "value": "b1d36124a1859ea7f7a6b3f00e13d29318ccdf069d63b6959045d1299feda7e00b21c504b09b29f4f0f5c6d2c0a39844", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012127, "uuid": "6b4b9fab-6baf-4788-a2d8-1874dc833fb5", "value": "T1ED05010372D1AC71D5162A765E6AC7F45A2EFCE14F007ADB73847A2F09702E2C67274A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012127, "uuid": "d52dabb6-e574-4e05-878b-3bb083085ea5", "value": "4dc3e52c058b03af2b7dec3a031b4e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012127, "uuid": "5770f272-518a-4c7b-9873-0e5633abaea9", "value": "12288:MQtgyuKiArFJFeGXdIMaKjv+PdzQm9eG1L6vv+PP4VPd:MQ6ZKbFJbz0dd9eG16vA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685012127, "uuid": "ea445ef0-d0f9-47cf-91be-e1ac360f134f", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685012127, "uuid": "780b53ea-34b5-493e-b229-944d34b729ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012127, "uuid": "3df2aa5a-2814-4473-95b4-ec303c6b635f", "value": "02854599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74cb739-fb13-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685029734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685029734, "uuid": "dd7f37b4-1570-4f8e-86f6-b0eff4ef82d2", "comment": "Malware payload (Loki)", "value": "038cfde5d531e51f39388d24c70e34e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685029734, "uuid": "9bcab5c3-7520-4061-bff9-6743470a1c0a", "comment": "Malware payload (Loki)", "value": "4e21a93e941a2e0899526af6e6196ab23b2c916bdd01a396a7c546122b1980df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685029734, "uuid": "1e93e52d-df83-43fd-ba77-2c5a515475e2", "comment": "Malware payload (Loki)", "value": "237e14531cc7c09613edda27ac048aacb46c9efc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685029734, "uuid": "ae355834-4144-424c-a1e0-e14539edeaa1", "comment": "Malware payload (Loki)", "value": "ecd3dced0473b15beb9281b6403b1e2232c217a9810def6ec7bb3c288529a2f76c5d67b232d2d4f5a90f33aac04a2c7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685029734, "uuid": "bbd7c12f-d132-4098-9111-dc0c8e1d2193", "value": "T1D1D422B03767276AEAEA077104551BF0937F8FAA3472D3971E4BE5C9FB027096441A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685029734, "uuid": "9336fab5-34fa-4ee9-9231-03fd6c067c83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685029734, "uuid": "b39135b1-2df0-43e4-a75d-bbb26d056b47", "value": "12288:jaWIm6lVvtzZBEP85enVrcBufSpyX9/iRi6D0WwxnUZf:+TmIt9BEP8YVyXyX9oUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685029734, "uuid": "d032263a-b134-4f80-b661-fb0d7b5c8cd0", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685029734, "uuid": "4c522b2a-6dfb-4aff-9060-8b0705817756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685029734, "uuid": "90e6be78-5e73-4a8b-b026-398131e436c8", "value": "038cfde5d531e51f39388d24c70e34e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5be33e-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685003731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003731, "uuid": "0bdabcc9-6ec4-4284-a5ee-2db0346626c6", "comment": "Malware payload (Loki)", "value": "3c86890bdaa42fd83816f6bf7919fd9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003731, "uuid": "9c316012-7e5b-47b9-afbb-70ac74143ea0", "comment": "Malware payload (Loki)", "value": "4e2a71ed46028e06ff94a1a350d117b4b430c94f98277946fb0d7431ca9568f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003731, "uuid": "7b2575cf-119a-411f-a9ac-5bb806f708cb", "comment": "Malware payload (Loki)", "value": "f6f5c86d6437162b129cd6a4b5b7e9a118f4f1a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003731, "uuid": "3d207dbb-065f-4ce4-bfac-44cf6d0150eb", "comment": "Malware payload (Loki)", "value": "fceff150ea602cf08e8278f1771a5e2d6aa73b311f1230671ab7860ba43065e6407ca3821acd47eb6e142fe5cea7f092", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003731, "uuid": "f0f351a8-1f59-4f0d-95e4-10c6f1a5bd49", "value": "T192E3021536D0C057D9E19BF10E7A5A96AFF9F61201A5AB4B6B901F2C7D33581CA0F332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003731, "uuid": "2b2ef57a-66f2-435c-a623-d8e44a810251", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003731, "uuid": "1569c68d-0abc-4bc3-88df-dcaef8d4fe2e", "value": "3072:HfY/TU9fE9PEtuPbssuc4E7pU4n1BXx+a0LwyFnp/xEo:/Ya6xBkEdU43B/edx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003731, "uuid": "8d59a500-d05f-443e-a528-59463cd1b186", "value": 149908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003731, "uuid": "178317b9-b682-4a31-99f5-d40024ef990c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003731, "uuid": "91fe7d3e-ad64-43dd-9fec-58f1d724009a", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ece6b76-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996944, "uuid": "c7cce6a9-bd4c-450a-8905-0b6deabac48d", "comment": "Malware payload", "value": "1b4749abee4936f9fbc989353fc83a65", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996944, "uuid": "6a9b32ae-b729-4936-a94d-b9d3005710fc", "comment": "Malware payload", "value": "4e482a6c52cb68374c2bd6ed6299a36d769354fb8c62064273f2c338d40b0c8b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996944, "uuid": "8fbd4e58-7408-4925-be22-2b3982b70b92", "comment": "Malware payload", "value": "2556843821bb450106e9cc0c56ec2b2e86a37433", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996944, "uuid": "673d519a-0dd7-4509-9017-5f2d35849804", "comment": "Malware payload", "value": "44b7392816d47f764fc915af62fc4c4a379f7a88569301fcc793dd629c84b82a77ecea460d0d3b80dd6c175cb9e08251", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996944, "uuid": "ed0acca4-b6a5-4a25-8309-e9347b18a2a4", "value": "T10174A584471528A24B5B2F36A73494B9EBBE1E79C2C4498BF46F7250FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996944, "uuid": "782a7081-d21d-4912-b2b5-5b16d6562ed4", "value": "6144:0EyG1zLuykiRgVM9iE/cF0gEq6nNw5HDV7YWVxfN:0EBROEQv7YuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996944, "uuid": "c6cea712-b762-4377-b4ff-5d50d5dcad74", "value": 346628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996944, "uuid": "7804093a-5cee-487c-883e-a49f9ffd34e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996944, "uuid": "63fd7c2d-308f-4a07-b589-99375595a6cf", "value": "ooecial.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d27961b-faca-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998122, "uuid": "b48435c5-4d7c-4091-af6d-94468070b14f", "comment": "Malware payload", "value": "935c93480952a338580e85008d1507fe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998122, "uuid": "f29434dc-2fa6-4188-b47a-8499d016d552", "comment": "Malware payload", "value": "4e92c856b4cac889f1b93cf08a30064014c59d81e78eff9001322a59a4753638", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998122, "uuid": "667ddc55-f503-4501-a565-a5ac491dc910", "comment": "Malware payload", "value": "58957aa4fe13373046023c9ee8cb21339a1ecd01", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998122, "uuid": "97174ba6-8d8d-4cf7-b56c-c860d08f6a3e", "comment": "Malware payload", "value": "87b82d7f8a4de2b79ddb11d7e2e5d73d25a06ff46432bb013c878a1f12d021cf8a67d283164d82311e89258ff7f82efb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998122, "uuid": "8482d8ba-4161-4b62-ba74-2cd1ae407f06", "value": "T13D747580475514B24B5B7E26A730A4A5EBBE1E74C2C8598FF46F7250FBDEA8CC8D1321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998122, "uuid": "d416bab6-3c75-4720-9755-cfb05b5265e6", "value": "6144:+vhLiTZBQHIksbt5ixHCQr5vV03hNdA4WFj+b:5QFaw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998122, "uuid": "865e62f2-bbe9-4bc8-8259-99fbbfa44223", "value": 342888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998122, "uuid": "5441db0f-fbb6-4695-84bb-6c932d86b67f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998122, "uuid": "cec735dc-f52d-4c63-8f13-dd06c7f69871", "value": "UnsallowPlatyme.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45bfcf6-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997973, "uuid": "31fafef7-38e7-44c2-9764-c1e6d41b439e", "comment": "Malware payload", "value": "3dbf8c40e94c4efcf3089d6a4c076b44", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997973, "uuid": "ad6ef9a7-14d8-4c40-87dc-9353a686bd55", "comment": "Malware payload", "value": "4efd0d6190838c685d12d2076a4516cead6d0e1752a0c314e5a2dc8be226cac0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997973, "uuid": "9820fa6f-5d9b-4e0d-8307-301d2031efab", "comment": "Malware payload", "value": "c66fe6f21d971156375e10101269d61fe4bd8f52", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997973, "uuid": "7ba2532f-6773-40d4-8c6a-5cdafb24e176", "comment": "Malware payload", "value": "684636560701a699a008666e9a09b4ed824996b875250326e581354f695b62dda471750c035cfac1b85ddc173e068bf1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997973, "uuid": "691b2254-b012-4b31-8a50-5f53d7cf9154", "value": "T1655456804B5124B64B4B7E26AB30A4A5DBBE1E74C2C8568BF46F3251FBDF58CCCD1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997973, "uuid": "a164121d-aedb-4499-8d0a-ae06909dd280", "value": "6144:ZcmeptsNC1S3TgQ/8VdZqOowvd8lmDNv5BCi:OQkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997973, "uuid": "55388426-d6bd-4531-bf90-5822693e2979", "value": 296932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997973, "uuid": "2f2fd9bd-32eb-42f0-a7fe-466ae5a4c133", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997973, "uuid": "2cd28507-504b-4a24-bef5-ba9cc76f258a", "value": "SucculenciesSub.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531140da-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997810, "uuid": "b915b841-3160-49c8-be5a-c46fa8827d17", "comment": "Malware payload", "value": "2fe849c46d8709b89274af3db3d7713a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997810, "uuid": "10b16f54-f18f-4fc4-854e-911220e3fb2a", "comment": "Malware payload", "value": "4f27bac0a60d018878bb1e34981986e086b1f825ff51a5edc56290ef90306584", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997810, "uuid": "6948b75d-7a5c-4628-8b0f-47ac51f9315c", "comment": "Malware payload", "value": "dcebd0128eff3613f9386428f4611c078002458a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997810, "uuid": "0996ba97-e216-4c29-afac-b512c63deaa6", "comment": "Malware payload", "value": "d59021e269e76c56a25904928309f1cdca8e870fbec8b7ed680c0ee618498cdacd7e346cdfb3f50dc61787e207aa678f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997810, "uuid": "621ae131-e1eb-458b-8014-e8c4c47d7750", "value": "T1DD5477844B1124B64B4B7E26B730A4A5EBBE1E75C2D8468BF45F7250FBDF98CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997810, "uuid": "7f91b3e9-54d5-4828-a363-27c674dc0601", "value": "3072:MLN7ShTL4QhNyy2beR8moOW954waF4GnlN9zyQeo3TV1JdKc8zTZ2:MJIf4QhNyGR8moOW9pUcQv3RvdKcGZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997810, "uuid": "5896f951-8c41-4bcb-96a8-3bf445818094", "value": 292288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997810, "uuid": "d615f663-189b-497f-b4cd-fa0618365844", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997810, "uuid": "5201e9bf-4f59-4289-b397-fc74b1926465", "value": "Redoing.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf42493-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999706, "uuid": "9b16a45f-2b02-487b-9090-c403ea0b7292", "comment": "Malware payload", "value": "b856528fbe2954d6a0ab7ba468e1c920", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999706, "uuid": "edaf3899-36a4-4a4d-be6c-0fb220b4f439", "comment": "Malware payload", "value": "4f441bb522ee820477a15453fcb7a0e34106ec46f709c42a6ff048b913e438f6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999706, "uuid": "34ff2866-0641-456f-9bc8-1abc61a1876a", "comment": "Malware payload", "value": "bb7e4a0fcdd84d8567ddcef28b8f91eeed3b0596", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999706, "uuid": "79438172-1772-4e3e-bc24-36cd32348565", "comment": "Malware payload", "value": "149fac7decc90469e642e27c0c868497d0e00239cf0f8bcc241beb300b8e75d1ef17d500db0226dff4b6cff373036191", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999706, "uuid": "1a4e006f-8e36-4320-abc6-598dd4300e87", "value": "T19D54A7804B5519A68B5B7E226730A4A5EBBE1E75C2C4568FF49F3260FBCF94CCCD1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999706, "uuid": "962c8e7f-693c-45c1-b865-02bb3d3fd928", "value": "6144:z25zDY6Aebz+OeQSHC1ApBZzj/N+8TiOpcOo/E:ID5+r/Lo/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999706, "uuid": "5b2c37f1-63e7-4fb3-8d4a-3e37fc60e2f2", "value": 283003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999706, "uuid": "7a464efd-378c-47ac-80b4-faf96f097224", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999706, "uuid": "5dcb43be-9cb1-4aa4-9734-5b217d0f8a8d", "value": "dietaries.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec84f9d-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997830, "uuid": "7b191dbd-98ef-4cf4-8943-37ec81b037ff", "comment": "Malware payload", "value": "15b9b4b98d0d00c556ab2557e29fb9e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997830, "uuid": "aa5f8bbb-2d88-4f4b-94fa-117204681dcf", "comment": "Malware payload", "value": "4fe6ac924f6e9dd18318c59989cc889910696e2b2f07736932fcd840f8574c1a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997830, "uuid": "e481a94e-c869-4b14-8028-60cb803ad596", "comment": "Malware payload", "value": "21795515018add802cc4bacb693fed59d6ee210e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997830, "uuid": "054f99d8-b8c0-47a7-8a55-1d4d1f1fd092", "comment": "Malware payload", "value": "bb35ac86d4374d10cfe1f36529e58d7431bd6887bf64ff08ad055c07346dbe698d43fe9365cd2a679cf469bdc1bf21a1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997830, "uuid": "c42fc5e1-7910-4033-84ef-3be1089fbe18", "value": "T11754A7804B1518B24B4B7F36A730A4A5DBBE1E78C2C8598BF46F7251FBDE58CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997830, "uuid": "d9b6b8c8-ed31-4125-a270-8b3ea39e80a6", "value": "6144:q5BOkefXTQ/4oeJKNvVEwtz0t3sUsEvyFQW4flZVasv:qf0Jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997830, "uuid": "538e8b61-69c4-4a93-a62b-9b50f4e15ef1", "value": 280010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997830, "uuid": "2d23d4a1-f22d-4388-974a-355e6a909312", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997830, "uuid": "cc1f956d-4d71-4b99-bff7-f1e54c38d645", "value": "RefoundsPinkroo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d057d2c3-fad9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685004892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004892, "uuid": "87bb64e9-671e-45b4-bc22-416b7de3cb95", "comment": "Malware payload", "value": "796ec3fb2cd6fd68463dfd25240bf67e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004892, "uuid": "55da5c43-768f-42d1-8e5a-b9aed3e6b543", "comment": "Malware payload", "value": "5266d0390bdfe895d13ce5322416dc3f2ed779b86e5dc680461dfd7b9e8515f5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004892, "uuid": "bb514ecd-9618-4261-8e98-f6ab33f40534", "comment": "Malware payload", "value": "3faa8515d0a879fbdb03e8a1b0714a3462ea7e91", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004892, "uuid": "573e85fd-ceb3-4f23-933b-22ae3cbe3c6d", "comment": "Malware payload", "value": "71d87cd8b5e7765fd46eabbe589abb6ba8f114bba057bf3c11791c1982702babd1495c416ae83f6f4cd41f36d07f321c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685004892, "uuid": "373795f8-1f2f-4c7a-a78d-75b73610c62a", "value": "T127A18A0027F50214F3B75B3AA9BBA251593BFD55EE31CA9E415C914C0BB3624D872F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685004892, "uuid": "0ffb7feb-938d-4b7c-a294-8747bf707fa8", "value": "48:84ZuaFky0eO+EHw5Oe72AeFaJGjQd0Y9XuHQBqiYLq4:84ZX5jOHH6OeTJGXY1um3YLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685004892, "uuid": "80fbf71f-490a-4019-8c88-73c8c439dd92", "value": 4864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685004892, "uuid": "8a523937-0727-48e7-8615-8f05547a5659", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685004892, "uuid": "e939e6b6-e417-40f9-b6c8-e8d4beea8219", "value": "M7R98927.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5822ccff-faea-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685011992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011992, "uuid": "8e1f1ca3-30dd-46dd-8d6c-61f35135b01a", "comment": "Malware payload", "value": "daaf40078f83fa1d3deb400c5f35ceb1", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011992, "uuid": "1bd30017-a999-4a48-8fa1-cbc842684f0f", "comment": "Malware payload", "value": "53729a368ff8ef04fa158a1daabd328f9574cbd7558b62e65638c22d59ffcff7", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011992, "uuid": "746a1d1d-3b00-45a9-894f-66b822e6b8ae", "comment": "Malware payload", "value": "bdb5cde4a9a02008d5cd1a1cd31d106faaa56c26", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011992, "uuid": "89e939de-fbb5-491b-ac1d-8887a402481c", "comment": "Malware payload", "value": "53ae16f6db9a068b4ba3d9ce16d987f8e17abd04294fd5c1e2a4e8665f04ede15e736d51d66616a9f6d83d1f3fe7d2f6", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011992, "uuid": "8e44b2c7-d7de-4ea8-863a-f5d473b5b39d", "value": "T190427DF0A7314321C1F946397BC91AC4D92EEE14DAA4E1A2314ED70D6BE4708AF2073A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011992, "uuid": "bd6a2c12-8683-4923-ba57-a8f2fac4117f", "value": "96:jW48hdtDfb531oAxHaSZGzzRd694gze1zVXfDQ8sgR:jW46dtfb9z4zn69kHXfE8sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685011992, "uuid": "f81ef26d-e38f-495b-b3fc-cb58b4bda970", "value": 12934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685011992, "uuid": "7c0efb4c-5c87-427b-a793-a25983ce255b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011992, "uuid": "598edc76-56d8-4316-afce-55630710dcfc", "value": "007193199.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b346b4-fb18-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685031716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031716, "uuid": "b478a23c-9eaf-492c-b83c-57bc6bedd1c5", "comment": "Malware payload (AgentTesla)", "value": "0d03959a01cc559070ce9d8de43ff275", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031716, "uuid": "a5ced574-dff0-456f-accc-86f84d496bae", "comment": "Malware payload (AgentTesla)", "value": "53b48f956a35a099893d037f8a7f48e4d6c647b12fc333888101152dde8c2c20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031716, "uuid": "3888206d-3d50-4efa-9682-ef5c42ac0598", "comment": "Malware payload (AgentTesla)", "value": "de1c6bc4fa8923fff527289d7aab846367706467", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031716, "uuid": "83950568-4b46-434d-a8af-8ecdaa744b19", "comment": "Malware payload (AgentTesla)", "value": "5b6ba6b152fe6e2342c425522d63f0c477c1d259ec21f672208ff9ec9a45798dbf68666f54fa9e35134f41c720cdee66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031716, "uuid": "a39bdc78-1444-4b03-a839-43ce90cd9c12", "value": "T140E40285353E2F92E47ECBF88820757057FBA56AB172E31A1EC7A0C73661F415A00DA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031716, "uuid": "7c5d8fd4-3144-4827-bfcd-fcfcd9b038bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031716, "uuid": "3231167d-a707-4551-8552-ada593797862", "value": "12288:qamzZBEP85gjZJ5p7ZXPhZFsNrOyCzBiQK+PvRvRyAyPeMi+Nn:+9BEP8qv53XPrFsN9KB/K+PJvRqh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685031716, "uuid": "72b9fa48-8555-4eea-a890-a80d94feac5f", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685031716, "uuid": "3a96a97a-012a-4294-bfef-39d5024a5e58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031716, "uuid": "7521db65-72b0-4a84-9d2c-0311203fea56", "value": "INVOICE NO. 29998172.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d438897-fb0f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685027973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027973, "uuid": "bafba3a8-a64d-4fff-be96-f26448feb48e", "comment": "Malware payload (GCleaner)", "value": "b1a9daecdc2546b78107c95aa8e6feec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027973, "uuid": "44f6b447-8f14-42d4-b014-22bbeb3f2eeb", "comment": "Malware payload (GCleaner)", "value": "54e2c0573350abebfc89c752845a2dbbf6475104900970f4f8c83d64cbd7a8cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027973, "uuid": "da16681a-7951-42a3-afd1-73a886b01ab7", "comment": "Malware payload (GCleaner)", "value": "830699162f15c47d50ff61fb966752c8d6057f05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027973, "uuid": "7c53e98f-dec1-4988-92e5-17d417c00d91", "comment": "Malware payload (GCleaner)", "value": "dd96e62c1baa55ef485857b050d1e5885857b74e05bddd3f736c5c0211d0eb4c4f0a74a3a918a50f5058fd0994ee1f35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027973, "uuid": "4784d636-e81d-457f-be3f-ad298e594447", "value": "T142947D03A2D07C61E9155B328E2FC6F8771EF9918F4977A76368AA2F08711B2D133746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027973, "uuid": "64861da8-f90a-481f-9457-eefc975e2919", "value": "8522dc5d9d6a2a97002c24ca5ed58b85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027973, "uuid": "db649572-37fb-442a-a6b8-e612a32ae4ca", "value": "6144:Gy5uLy1tLl71oPrZID5M1e6fmZQfTY5HjhEiJDc4v:kqLl7ImzW+Ck5Hj/xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685027973, "uuid": "dacbdbbc-28f3-479d-8d0e-94ca232ad2d1", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685027973, "uuid": "e1c650e4-f63e-48bb-93b0-eb145aa2a39c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027973, "uuid": "4806cd03-18ee-44e5-97d2-c6a123fda759", "value": "b1a9daecdc2546b78107c95aa8e6feec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67dc041e-fafa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685018890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018890, "uuid": "e9a3b1c2-896a-4f49-a972-1d82c348ab00", "comment": "Malware payload", "value": "78c9b0a991ddfe89cf7b5cbc30c44d76", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018890, "uuid": "c4b5fb5d-423b-48e4-9c0d-6e95b3fdc420", "comment": "Malware payload", "value": "55112755ff7158a4e0fdd74ba34ba3b73d500c22d0dffd7a9176dfb15805a6e6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018890, "uuid": "54530244-2410-4c5d-8b24-d24f5f8dd9f1", "comment": "Malware payload", "value": "4b9705d7886472aa204ffb684b53cc59408620c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018890, "uuid": "8f7d3f6d-24ac-4989-8fb4-512c4113256e", "comment": "Malware payload", "value": "79cd2bc249b02a0816e4a1e1f7468e7e35b23cf726712889f6bd074d98a84284b3403fa1b095fe73811d5d15d6d38fa0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018890, "uuid": "9316a962-6e9a-4ecd-b3d2-1e12ce5bf504", "value": "T1D914B7804B6524724B577E2A6B3094A6DBBE0E7182CD5A8BF45F7260F7DE68CCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018890, "uuid": "79869c37-cc1b-443f-9a89-3516bb3f1247", "value": "3072:azb3r4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:IoDqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018890, "uuid": "f0b740b2-eb4e-43d6-bbc9-6c760c27bddc", "value": 206799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018890, "uuid": "26ffd3aa-4b29-4f4b-97df-6648e7424f8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018890, "uuid": "d4cdd83d-aceb-4f28-b325-ed0a0ee72cf2", "value": "Pvfgxms.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9da1bd-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997959, "uuid": "a426be34-2012-416a-afa3-7ca2b5a4da41", "comment": "Malware payload", "value": "783dab6ebd14107f701d3a0aef9f9a4a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997959, "uuid": "9e136c66-ef7b-48b2-bbac-fa99e3f62dfb", "comment": "Malware payload", "value": "55e0d41b9a1608d00704af87951ebda379fb72b6b12638934081e28833252d69", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997959, "uuid": "c6cefc93-6a20-433f-9c2c-c65c074953a4", "comment": "Malware payload", "value": "935779da79a99a06986a51a1950a66486402c864", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997959, "uuid": "45b1139f-1154-431e-9fbc-b4ce585da919", "comment": "Malware payload", "value": "26c753b3e59d598cb917b009d4d6a0a46144cf9abd347cc64c22b29fc51d3c2750851fa7ac0db5fdb973a7307d7d3360", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997959, "uuid": "81bb80d2-c0db-44dc-981b-c6dd493d9b65", "value": "T1DD5496844B1128A64B5B3E367734A4A9EBBE1E75C2C4468BF45F3260FBDF94CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997959, "uuid": "ceaf31c1-bdae-41a4-aaa5-a0d9c3c3f6fd", "value": "3072:kEfbGDf6G2Mm/AYtw0WHka7vHffFOEcYaA0mPFFrGVWF0KgPyvkwwbRm:zfqmG5ctw1vHXT+IvSVWF0Kg6vkwwbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997959, "uuid": "f04aa94f-8417-451e-a5fc-7d12c20647db", "value": 296300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997959, "uuid": "a264463f-b8e5-4f4f-9f8d-d96b4df31ed4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997959, "uuid": "303afa53-2d56-4639-8f22-6cfcc6808468", "value": "Strowing.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4864fd86-fab3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684988343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988343, "uuid": "48532255-45b2-4301-aeea-940a5e8968b4", "comment": "Malware payload (Quakbot)", "value": "0e2070746e6deea9a19db55b68f8cc9f", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988343, "uuid": "c3127509-c81a-4b67-b880-6478e4f6b9dc", "comment": "Malware payload (Quakbot)", "value": "5614bcd88be08ca924773e4f954e0e69dce7a63016620681067d32465e3076fb", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988343, "uuid": "bf6d1604-32f4-4fa3-8fb3-a8d153ff385b", "comment": "Malware payload (Quakbot)", "value": "97b12b9a7d698bad091b318474374fe154830b16", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988343, "uuid": "d2037d53-84d1-4280-9b4b-6cd1536a3d94", "comment": "Malware payload (Quakbot)", "value": "358460676457b1c797dfa02c29009221f79dbfe350878c73b6d2b331f21287661eb6ecdacd96c3823af0a0c35455055c", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988343, "uuid": "2710d942-7c46-4fc3-9190-93d554db1100", "value": "T15283195B9380037956620254964F6BD2F7B484787B35DA74A49EC2AD3301CB9C3BEAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988343, "uuid": "ffca5272-fd6a-4a48-b2a2-f98f95a6669c", "value": "1536:Sc16gNsu1pGWP10V6mX2+pQ/FTS1ZOpojlZOZwivcY:ScFNsu1cWuZv1ZOpkZOZw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684988343, "uuid": "b0f262a2-8803-4fa0-9b9c-d328687a4795", "value": 83776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684988343, "uuid": "3f64bfe9-360a-4605-8e93-949668fd3874", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988343, "uuid": "c2a145cf-7006-40d5-b4d9-248325bfb0ff", "value": "Claim_C248.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc797f3-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997858, "uuid": "d1b452af-1f72-4ab7-87f3-a22dc557b8fd", "comment": "Malware payload", "value": "732a126714b2cbd4674a837e29979482", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997858, "uuid": "ba426962-0190-42eb-a4be-e8da1f1a526a", "comment": "Malware payload", "value": "5628154cc4b8336a2fe0acbe34a9650590c56849f419951e83310a7d6a4c386a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997858, "uuid": "d8d94fa5-94db-4615-9b87-d74fdfdfb44f", "comment": "Malware payload", "value": "e3bc7ca8af14e86f5f028e32705406bd65ab9da2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997858, "uuid": "d2b703f6-bdb7-478e-83dd-968e9af395fa", "comment": "Malware payload", "value": "d1ea55d2caf3ad5ca859181c495b3c0253f1db845588091595b5d7354be1d718832d4e6c0d72e80dca6f408a5ead473b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997858, "uuid": "21b69738-1f46-4cb1-b95a-e10f05bf6769", "value": "T1D5748A844B2129B64B5B7E356730A4A5EBBE1E74C2D8558BF46F3260F7CF98CC8C1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997858, "uuid": "ae412fbb-7353-4744-b23c-e468ae697876", "value": "6144:AFhhqXp8M2lWfqNmaV9MmG/CoWIB4BIO69JLRQtRbUK:AdoRrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997858, "uuid": "433da8e9-7a99-45cc-8aed-95be1e478adb", "value": 340870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997858, "uuid": "0153565f-fd83-4fb2-807d-c022e1f3061b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997858, "uuid": "1ddd70e0-8daf-4a22-af61-d2609f876e3b", "value": "Rhinocerotiform.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc9fbe1-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997077, "uuid": "1dc2f91a-e0aa-49ef-b8bf-50bc0fff5c6d", "comment": "Malware payload", "value": "458e378943e47d0f10e73a7c2f236e6d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997077, "uuid": "c5b8c476-0ba7-4efa-9130-01d473562d72", "comment": "Malware payload", "value": "565391736cbc3e5b6f169a2ddf6519b91ef1f63065fa415b9b146b52765db405", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997077, "uuid": "90ef7f08-5f6b-4b59-b73c-de34a631ea0f", "comment": "Malware payload", "value": "9908d52b2528a72037668d073aceddc1c670d18c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997077, "uuid": "32b5f108-ab6b-4408-b3e8-d49fe5e32547", "comment": "Malware payload", "value": "0ee48dd0709f548abe1c627e1335b8575f84c9276b72ea875404c31b6ccd1f2161b6ce00e6e6adf68ab062c81ffc5aff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997077, "uuid": "3921fc2d-18bf-49ad-8e19-ae640a81036e", "value": "T1194454804B5124B64B5B7E26A730A4A1DBBD1E74C2C8568BF49F3261FBDF68CCCD1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997077, "uuid": "64578e29-0fc9-4c2d-8688-3794ba459bfc", "value": "3072:M3uspquS2JymzmrcoPmgxzuWxQgdNHrQc1175Ac/5SZVNL7QM:7ruSYtzmYox5uWxQ6d2cRSZVNL7QM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997077, "uuid": "597d55a6-0af2-4e83-b5c5-5600ca37496e", "value": 267838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997077, "uuid": "dfe88ec4-db41-4fe1-b60a-4bdc239d48c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997077, "uuid": "8ba12e34-84d8-4d15-b7f0-57179ac267ee", "value": "noncontradictio.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8d0efc-fafd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685020215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020215, "uuid": "ffaae26f-4414-4086-968f-c46dbcd8b6b4", "comment": "Malware payload (Gozi)", "value": "281aae187558092aa15b03e85f21b48c", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020215, "uuid": "2beb4128-8e20-49d0-8dd6-428f4deedb29", "comment": "Malware payload (Gozi)", "value": "56bab1697544e577a53b6e30f0c2a9e12a949565fe70e43f62893bc2ae11e2cf", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020215, "uuid": "b89c8751-b150-49bf-a185-f68a9c93474a", "comment": "Malware payload (Gozi)", "value": "00b22be8e19e8c5f27f6bd5ce8399e5958560dd2", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020215, "uuid": "e2683f9f-9bd4-4c06-a57b-705ce680f472", "comment": "Malware payload (Gozi)", "value": "3fef0e7830d234351c7243f1c148fcba1b77e12f7dd5d0ec289938f2b0c834ba2b40d0475264512a78404621e338d8ca", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020215, "uuid": "94cda3a0-1280-4d31-8812-b1ba6d4f9f78", "value": "T130C2335A2D81687A7232D03F2A176469FC69EC6B6E9905B3F36CE440F32C358E079717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020215, "uuid": "23b58cbe-aeaa-4029-915a-ee964bd579ba", "value": "384:34dPV2+0fXS3/oLugkr4ie5g4hm1XqMWqVC90b2//Y9nJDB8TA:+V2+0fXS3/oLuPePhrWo/uJDac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020215, "uuid": "13b6e6da-a8bd-404f-8079-de8129b420fd", "value": 25840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020215, "uuid": "2f637245-26ec-482d-a897-c745e4838187", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020215, "uuid": "58d16819-f7af-4b8b-970e-d8db7d4bede9", "value": "1_IT0_05_25_2023_01_22829.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe8df79-fb2b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685040104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040104, "uuid": "aa26e1b9-53a8-4353-98d5-bf27a226c187", "comment": "Malware payload (RedLineStealer)", "value": "edb518b226a8bbb7f36e682c39e67e34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040104, "uuid": "acc370e3-d9fe-47ca-bbf6-fa072c5e95dc", "comment": "Malware payload (RedLineStealer)", "value": "58254442348963136e6f22bf0be0723c38783eaa29240bb2e65b5837de7aa4bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040104, "uuid": "659f77e4-7b66-4771-9b05-4d2471ff7c5d", "comment": "Malware payload (RedLineStealer)", "value": "587a10183d0562bf047a378dc8a9e0a8c41e7132", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040104, "uuid": "4f459079-517a-44ca-a15b-0f4aa0d4639c", "comment": "Malware payload (RedLineStealer)", "value": "5868e4babb214a1bd3d4c155fbc15bb6b1225f09853c6381d7647d3e37cc884eef949172a8b12d983ee5cf406e32f980", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040104, "uuid": "9c838fcc-de14-45d6-a8f3-2e255f262217", "value": "T1E0F4122267D84032E9B1237029FA17A30A3A7D66CD3853BB27596D0F18726D4747277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040104, "uuid": "145abe67-e995-4bb8-b964-ea0ebe35a836", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040104, "uuid": "85adf807-ed5c-4ffd-8ebc-256556a8cca7", "value": "12288:RMrNy90VYlWdfo3aiEP2kDZZEVNxYJseD838PiX013WSkBRknMMtIW+xENvV:MyQ2WdwKfeOZGE13dkjkMM1+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685040104, "uuid": "9997462e-b9d2-425a-9fc3-37e89388deac", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685040104, "uuid": "13fdaeb3-b78d-4765-a840-fb4100a65a04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040104, "uuid": "88a8c0eb-8987-49f6-9b38-ad5daa26a685", "value": "edb518b226a8bbb7f36e682c39e67e34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accd8bdc-fad8-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685004403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004403, "uuid": "ff887f76-27aa-4288-aeee-035bae580731", "comment": "Malware payload", "value": "d86486fdcc9747b5ccf9a246dfa727dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004403, "uuid": "1daf105f-6ded-4509-a593-bc7c66797ac5", "comment": "Malware payload", "value": "58428d81dab5ddde27d35078c1a775dc6bffa4a815dad9779e9f6eeaa19dd877", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004403, "uuid": "03f4ae69-49f8-4b14-bd82-9cf7c7428605", "comment": "Malware payload", "value": "e580268cebc790fc7ec88cb019731f0c903a1a15", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004403, "uuid": "c0ed97fc-066c-41c9-be45-e4ebcc090609", "comment": "Malware payload", "value": "d3685612183f8c91ae9d1e2a42e350c9a186d846fcecdc0e483201c6a5716c8dfdd1a52a4ee0ca7ef9226bfb4173f0b0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685004403, "uuid": "5d9a019e-4d5b-4c6b-a5f6-c7d5a2482889", "value": "T1C8767B0A3AD508DCF8598F729B9407A833DD33336BAC0DD6B60805186B6DDB94E5DB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685004403, "uuid": "1a94a89b-f407-426f-8f4f-0f39b4b24db7", "value": "d14ac171253cf4e289cd276f47898b08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685004403, "uuid": "2341a59d-3e76-4376-a85f-0d3a5e4326d1", "value": "98304:Bo82lrwQnUKp8wut0BdTJAVp9jgeVpBiqLUBH76Pva0yTIpOmn2w9NAHr:ByfUew0BdaH3BfUKvac2aNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685004403, "uuid": "39652598-0863-43dc-8171-25b27ad3c1d2", "value": 7356928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685004403, "uuid": "6e3a63c1-7246-4928-bee2-17d4046dec7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685004403, "uuid": "d548fb00-9671-4a59-a51b-188283319074", "value": "M7R47913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36c055a-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997945, "uuid": "4c257506-e3ca-41f5-9609-843eb91604bf", "comment": "Malware payload", "value": "892cbeafb37623e2bac6a8ce1c537900", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997945, "uuid": "ef2f30f3-2f5d-4136-a264-0d46a838ad7e", "comment": "Malware payload", "value": "59559350af4eeed4ea5ba7150951268d77bd5062b86f3bbf77618116728ec748", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997945, "uuid": "b9ff8a2f-2ce6-48d3-ad6e-cb7aaeffaa38", "comment": "Malware payload", "value": "a2062c563a38c8c99875364cc3881ba8d593e7ea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997945, "uuid": "c31fe012-bc05-4175-9501-b5d15ad055d6", "comment": "Malware payload", "value": "8db6e99285cac701080874053799a20f0c08fb616ed1e57c2d92232d3e80cebb96d1badd52873c9cd45dee2f3272493f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997945, "uuid": "b6932dd9-cb41-45af-8916-bb2f963caf5d", "value": "T13E44A6804B1528A64B4B7F26B72064A5EBBE0EB8C2D4558FF05F7261FBDF94CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997945, "uuid": "f21ec262-7bd4-49e6-be91-a88b4297b55b", "value": "3072:DPjb9r29zO5H0KIn3nCHso6IbXGC2k4LM0Cwe/la:npq9zO5k3nCHt6k4I0pe/la", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997945, "uuid": "e74d96dc-3d02-479b-937e-d24a4ac9e4e2", "value": 277766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997945, "uuid": "db4bcb73-dc8b-4b78-9482-89869c49e8a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997945, "uuid": "a02531a2-ed0c-4ed9-932b-ac324dd717d3", "value": "Sporogony.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c821b9b6-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997148, "uuid": "64d94cce-ff66-46ff-a963-87ba3848e680", "comment": "Malware payload", "value": "55b6519fc314dce39daef84bee46e367", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997148, "uuid": "2057eab2-ac80-4feb-9701-213a60787323", "comment": "Malware payload", "value": "59fc0678c8b19288b2dd685052b3b22c84769ecd6c6d383fb2475b2492758858", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997148, "uuid": "c6920c98-c4c1-4106-a03f-f102312b68a3", "comment": "Malware payload", "value": "5e791803cf28d4e46722232312b185a4bcbaf0df", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997148, "uuid": "2adef989-5996-4c49-b205-fa8cb716b535", "comment": "Malware payload", "value": "e72bf9c5fc08aa1313bcf2848f9b922a722d58180dfacb913242abb4f0d972aabb1b3d170b57a4c2b870469fd13ca3cb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997148, "uuid": "ac7ae8a4-5d27-4f42-bbcf-89147be45525", "value": "T1535455804B1114B24B5B7E26A730A4A5EBBD1E75C2C8568FF45F3261FBDEA8CCCD1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997148, "uuid": "98a9879d-9b99-42dd-8912-4642cd35b5db", "value": "3072:Tivg2Y3lixDfYMvf0ZG7wzO6aKI6AW2+QMcLeAgwNNrxgzq:IClixDfbvfUGEzO6R8F+QNx3Kzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997148, "uuid": "44427a60-70be-4113-83ac-1d8529034f18", "value": 285903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997148, "uuid": "0e8aac74-de7c-40a1-ac80-f8b9d39e292b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997148, "uuid": "657205df-b58c-4fee-8266-04195b46d53b", "value": "minnesotans.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e1aaec-fb0f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685027965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027965, "uuid": "b17cb934-ef39-443b-b6c6-96fe4ea4767b", "comment": "Malware payload (SnakeKeylogger)", "value": "82fdc61cbb6ad4974f2516704a381e3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027965, "uuid": "18a0152d-1a40-43b5-a5bb-607e8915fdb9", "comment": "Malware payload (SnakeKeylogger)", "value": "5abf6521154eddd834066f4abe0af7c8802512e8384afe5fbe7ac23477764f08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027965, "uuid": "7d80e4a9-3e88-4afd-878b-cebd5c774d82", "comment": "Malware payload (SnakeKeylogger)", "value": "9d0bedf6cd75945afdd2639cb18835d6a65d1052", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027965, "uuid": "d64530de-fcea-49dc-96cf-360f21cd9641", "comment": "Malware payload (SnakeKeylogger)", "value": "6482486fda7c79b9920e011a561ffc2ac00825a9b9458cba199c95682e218ab5451a24b1eca0f702b4717b89aff9e955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027965, "uuid": "48a39888-da24-44a0-871e-f4609e594bef", "value": "T1D22523B4A266065AD16E0BB8051867F0636FCF4A3E72E29B9C0FF1C8CF04B4545867E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027965, "uuid": "0766d343-76ca-40ed-9376-55ae934c33a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027965, "uuid": "29a97fa8-00f0-415c-aa09-24b0aac4d75d", "value": "24576:GTmIt9BEP8FqpuwZLvBj7PpvKOe5Yr5Q7M4I5CbCqcn:GTbBe8FOZDBjtFeqV/jCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685027965, "uuid": "d0629323-5e6a-48b8-9ebb-d4bec75c5c81", "value": 1030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685027965, "uuid": "a80cf119-a55c-4b93-8273-266d77dd1403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027965, "uuid": "2dad36d2-1b83-495b-bcdf-1bea8588d802", "value": "SKM-kupni5572023 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc384e2-fafe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685020810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020810, "uuid": "733b8be7-f101-463f-9e40-afbb7735ec4a", "comment": "Malware payload (Stop)", "value": "60f82b5e89088d7eaa2705b50f69e04b", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020810, "uuid": "92d7627e-a916-47e6-a59f-99244ecc28f4", "comment": "Malware payload (Stop)", "value": "5ba27223e4bb62b41203c2ac966af018b97337b03d8513594ffc4680e8f938c3", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020810, "uuid": "7a7df1c1-3e67-44ac-a991-55b498e4eff5", "comment": "Malware payload (Stop)", "value": "f2fe995b66568d8eb0f722fb47ad2363dabcfe52", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020810, "uuid": "81364d7b-94a0-406e-8fae-b39a4b89de21", "comment": "Malware payload (Stop)", "value": "b8f45ac623bd66a6913cbdbb0a1fde14518f71963c4e4e169a4aca6a8e50503ea9acf583b535d968fafab7bd9ab07694", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020810, "uuid": "a1269539-0abc-447d-886c-f8d809e34acc", "value": "T1D705021277E09861E5524B314D7AC6F4AB2EFC614F2966EB33803F2F49712D2DA76342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020810, "uuid": "77acc635-18aa-458c-a313-c6d2b0389ae0", "value": "8522dc5d9d6a2a97002c24ca5ed58b85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020810, "uuid": "7f27c5f9-0fe9-4aaa-9b9b-5402853a3a44", "value": "12288:WlrjMX0WbEJ7PpdJ+8EIQ1Jfzks35vj4k05vC4y6cBk5bzqDb2/:WlsX9y7lRE/pAs3TmYBgzqDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020810, "uuid": "5d474932-975e-44dc-bc25-1b33891f7d47", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020810, "uuid": "21ed615f-8d51-4373-a4b6-da20e27d2393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020810, "uuid": "9f065ba1-4d1e-47cb-b24a-5c5a2571261e", "value": "08480399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659134ea-fab0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1684987104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684987104, "uuid": "c7373469-6b6d-4fca-b534-ad7e9da6f1c5", "comment": "Malware payload (ArkeiStealer)", "value": "c51e82e2c7a0f3b68d02fc988f764f8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684987104, "uuid": "e8a2298f-03b1-4fa7-9844-79c9c28bbd5e", "comment": "Malware payload (ArkeiStealer)", "value": "5cbcbf21e72a2a382039f92862cf3fd8364e0fcccda137c0eb1a57c6c3fc46e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684987104, "uuid": "e0faf5b7-43d7-4e19-9fbf-69ac4e6263af", "comment": "Malware payload (ArkeiStealer)", "value": "a2a764d002aaea3ec388f02c8ca0d82c22678ded", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684987104, "uuid": "9030f956-3352-4acd-95cd-8fdeeabdb8bc", "comment": "Malware payload (ArkeiStealer)", "value": "62db1d55df7fe49f301152ff9dbebf5288bc4b48b027d47c424630d860235a4ecbeeabe787f3d80c24516aee2b4bfb60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684987104, "uuid": "b96d1b1c-fe25-49e4-b566-cc9111f8c01c", "value": "T1DB36233723990195F1FCC83D9837BDE132F3236B4784987874D9B9C12AA15B7E627A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684987104, "uuid": "b751d711-28f6-440d-a16c-4c558f86a2ca", "value": "ee126499edcdda4d19e739d00cbb1b09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684987104, "uuid": "419f88b7-4c48-4db4-9282-278479dc92e6", "value": "98304:s2Ck1pncPKXnRwJgPRVPh1g09XjV4AIvLEazhyf6Dqo:vvncP6nRwJoVngwXjVLQ0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684987104, "uuid": "35349e74-0499-4433-9aab-aa04e3b12a14", "value": 4906504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684987104, "uuid": "003d495f-b8d7-4257-891d-56c951f82b68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684987104, "uuid": "680dbbb9-3462-467f-987e-8276b35e2753", "value": "c51e82e2c7a0f3b68d02fc988f764f8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1016e4-fb11-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685028752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028752, "uuid": "00eec129-7aef-4d61-ae90-5ab762c02512", "comment": "Malware payload", "value": "41ba12ffe39ba42527ceb4213b60aa1d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028752, "uuid": "3ba45b26-0009-47a1-b238-eb5b408f5741", "comment": "Malware payload", "value": "5d61788a62a191bab5c7bd50ac6e1550f7c6aee72fdd185709607bdaac194e8c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028752, "uuid": "ea3d06ff-4480-4132-9139-1278faa97319", "comment": "Malware payload", "value": "6203ee212de386ce91733c5ce9c7beb47969abce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028752, "uuid": "ecb06598-164c-4b9a-962f-1883dd8e044b", "comment": "Malware payload", "value": "7675fbe6b187499c96ca8b7fa6dee5cbf512d85450252794fcb031d04acd808e965a5c6081d8e252fc3d5a5bd485be6f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028752, "uuid": "b1f8e8cb-6b65-43f0-9ccd-f80475843dd0", "value": "T1E4D56E12A261553BC0775A358937C7A46C3BBF2026255E9F5BB43C4C3F39A81783A367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028752, "uuid": "6d1af1b9-df8a-41d3-a7f2-e3c20779a719", "value": "853da98d4246c150df826872dcf1c225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028752, "uuid": "e6fc1b42-58d9-4645-b16a-6fe140db58b1", "value": "49152:YAh75SU+X+4jQbBWCe++YM0aJoeTZTql5K:cwJeuM0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028752, "uuid": "051f91f0-e106-4898-ad7b-051a13e21a37", "value": 2829312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028752, "uuid": "12114a30-806f-48e2-b954-2a2a5e1c5698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028752, "uuid": "637e4288-678f-4591-969e-6907ce3a109d", "value": "SecuriteInfo.com.Trojan.SMSSend.1591.2249.29009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40651efa-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994772, "uuid": "97e661d8-55ca-4660-950a-456042391582", "comment": "Malware payload (Quakbot)", "value": "81ec55ee2093eba63042b6d028b5ca52", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994772, "uuid": "15291367-d778-4b08-ac54-bcb06d966480", "comment": "Malware payload (Quakbot)", "value": "5feca0198e0458f9cf2d0971d2d2d4a515668ecfb73ad057bc2ba363fbabbf78", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994772, "uuid": "b50f121c-e4f3-4a60-b362-d469d78deb8d", "comment": "Malware payload (Quakbot)", "value": "fc1553cb1dfe54003d66ab0f809f5ab4eb9327cf", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994772, "uuid": "08c0921d-73b9-4155-867a-fe4b8f828c9a", "comment": "Malware payload (Quakbot)", "value": "0c365a7dce969f07b1617de8588211b948b9ad69d27bedb6cb4c8bc061026a46d6c6751c139a21085c483e159df54c4a", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994772, "uuid": "4574bfeb-98da-40fd-abb2-648dc0f14a9b", "value": "T11B63286FA381133865620125250F5BD5F7A048786A76DBB4A44EC32A3322D75C6FFAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994772, "uuid": "dec0a1ac-304e-457c-a8b7-9423594474f0", "value": "1536:IMnGWP1xQidVMbL0OCFBXUzmLryka5bZLDU8nqU8nNZ68rtT:KWibL0OCDVyH/6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994772, "uuid": "7a684ca6-77f0-44b1-8a3d-7473834aa744", "value": 72711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994772, "uuid": "cb911c64-5bb4-45ae-b1a2-b977726b91d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994772, "uuid": "963814cf-43de-41e8-ad7d-0849e1d990c1", "value": "Claim_E764.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b4659e-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996768, "uuid": "6e6debf2-8f2e-4998-9210-2ea636c33d71", "comment": "Malware payload", "value": "ae5abea8fe6ebe21131c8d000cf0453c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996768, "uuid": "cc0a940a-fcac-4a9a-93c4-3cbd42556d30", "comment": "Malware payload", "value": "62efe407c6e9506ba75c0450de6a1df2001472844fc02d9ad70c120dbcdcbfd7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996768, "uuid": "b9ea1965-00de-43a7-a9ff-e44026c0e080", "comment": "Malware payload", "value": "42fda7759a3d872243fa2bdd547b490957c8bfef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996768, "uuid": "d2630cd4-4d2c-4542-b596-dd50193a1fc4", "comment": "Malware payload", "value": "800470b189590ebeb983cab7062670f0a455671eb9c35a84ff6932a0175d5cd7afae755feb2f314a4a4140c4a09860da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996768, "uuid": "6d9a7e9b-6c2f-48e7-95f8-24dca90aee1e", "value": "T159649780471524B64B5B2F26A730A4A5EBBE1E74C2C8598FF46F7251FBDF98CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996768, "uuid": "06e3ccf0-12ad-4b63-b452-e00268fac881", "value": "6144:qQVKM8drvju4GP+ENHDYZQO0LehDlc5iiZUyRJ5d7grEJWncCb:wMAUyEQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996768, "uuid": "7bcf5d5c-6a5c-47c8-aca8-523f48b9c09f", "value": 306692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996768, "uuid": "031a11d8-15b0-4e76-b7eb-be23563959c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996768, "uuid": "23d53e64-4d8c-452f-a1a3-3bf7ce08ce95", "value": "gravetteSetback.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f65b972-fa95-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684975470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975470, "uuid": "edfbdcdc-6634-4d58-a253-a436f4d39370", "comment": "Malware payload (RedLineStealer)", "value": "92ebf5bd9ca2b898b075a8da9e29042a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975470, "uuid": "42c6e127-f649-4b92-8af5-66858076b0b2", "comment": "Malware payload (RedLineStealer)", "value": "6313686a2a8a2b4d469c12db29b51ee4ef4c9208096d7b6cffdd89c955d244fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975470, "uuid": "0bce3971-f2e2-4d56-b903-2d8e46c67878", "comment": "Malware payload (RedLineStealer)", "value": "c1958d157a1e3bda2b191a0d01bcb8e34b4bff27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975470, "uuid": "5d950049-bbbf-4dca-8a06-c0809f0a6769", "comment": "Malware payload (RedLineStealer)", "value": "ea78afde34aeb50185b971bb99047baafa1642b66eaf0356d9fed284793a486ae44cbed61e54f8198fabfda12b5ffc67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975470, "uuid": "3e751e1f-7282-46ff-a13d-b72cc05583ca", "value": "T1A725230F67E840B3E8EA27B08DF617C70A357DB19D788B4F3285A9191CB2594683537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975470, "uuid": "57f059c2-6e58-469e-9aa4-e5884cfe0f92", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975470, "uuid": "2114b4c6-ccbe-4011-a1d9-58179d222417", "value": "24576:5yhZh4k9ARBRe/TG1jhJ2YqO9FAkf1vl9/YO:s7A3SGNhgGkKd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684975470, "uuid": "a272691f-6f78-4de2-a3c8-11674f8c9af8", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684975470, "uuid": "00e7e786-727d-49da-a3ea-a3f496cf1123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975470, "uuid": "247f3840-4db4-4939-9cdb-f65fd13c99a0", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e66307-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003699, "uuid": "23d20643-e673-4152-8071-f0c7db89dde2", "comment": "Malware payload (AgentTesla)", "value": "b01bd7afcdf20ba851985307bc947307", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003699, "uuid": "770cb433-3d75-4539-bbb1-f9bd9caeb5a9", "comment": "Malware payload (AgentTesla)", "value": "633cdb2f59d4836476806e7083d71714a34d831c854ec337cdf823328e5eeb58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003699, "uuid": "83eefe8f-a158-41fa-b9b1-7acce299c2de", "comment": "Malware payload (AgentTesla)", "value": "5eb1b383a11ae68d598b416fb48b7ef813075f6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003699, "uuid": "98259de5-b896-4cd0-9a5e-3de8dfdce81d", "comment": "Malware payload (AgentTesla)", "value": "2c80f928ee67b7db5dab2723635260f6657a3efbba0704473f95bafd05f0ee1c8857ceb3507948ff565cf2412573431c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003699, "uuid": "559c2fed-61b7-4302-8631-18fc2c57b3e5", "value": "T191A423F12E492194DA6AB031F2A4DFE23D22C0C25961895BA5B9EC10488DFD235FDD9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003699, "uuid": "1645d1e2-bb95-488e-8063-e3e71b5b2dd1", "value": "6144:nvIFUK2i4NJ++yEesX4MzcJ8/SmqmqbcRdhJdPY+kpA4riTJnr4BbRxxDqkfXI56:nvIfhExTcJ8alI5k+ke4FBbRx5YHe2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003699, "uuid": "cdd3edf6-3ceb-4b36-9c14-9402b6612496", "value": 450960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003699, "uuid": "613c5f4c-9041-4cb7-a58c-2b47db836a5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003699, "uuid": "cf3862cf-a17a-48df-84c6-f3248ad32679", "value": "anticipado de la factura 060296.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229d75e6-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003742, "uuid": "0742962d-c757-4e48-954d-8f4acfd3f940", "comment": "Malware payload (AgentTesla)", "value": "2f2b2b1922eaeb8dba3de3ce19d2e4bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003742, "uuid": "bdaeea02-dbf0-4583-91d9-c9753a0da173", "comment": "Malware payload (AgentTesla)", "value": "6578174a2b372576ffa310897c4baa4fd210b338efc9a92daa8c30abe9cc1017", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003742, "uuid": "a4432ded-7c2b-4493-84b4-2d62e323a8b7", "comment": "Malware payload (AgentTesla)", "value": "fa07dd14013f14b23b0978e1cd9027c825ce9f54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003742, "uuid": "1287bf72-23c8-4370-bb90-9a2f6d1563f8", "comment": "Malware payload (AgentTesla)", "value": "6d7695cda4ea7bab2046c212c572ff7961a63f346f0a77b24ca70360f760b626248bdfef7379ea61198ed8040ba5305a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003742, "uuid": "204089ba-2f5b-458c-be9a-91ff1f6a41b8", "value": "T1FF441225B7D8C1E7F5B503741E3B068A0AB6F46218F2A31743206BDE7935641DE0E7E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003742, "uuid": "9689d9b6-2b76-45af-8827-bb289da6a3ef", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003742, "uuid": "b952097f-43e5-467b-9576-6708980590d2", "value": "6144:PYa6ndeXzEspVep5mHSOF9uGap8PhpFDm6sR3ySZYitK7ZDS0FecSrH:PYd2QspAwSOFoGa2h3mDFmxecSrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003742, "uuid": "75280c40-aa62-4437-9e1c-cd44b0818244", "value": 272755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003742, "uuid": "fa35bc5b-e31f-449f-937f-e2bff56bbf9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003742, "uuid": "10ae9201-581a-46d1-bf2f-5e9176d30b82", "value": "PO-STS5492.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f65ff2-fb2d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685040837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040837, "uuid": "0af6ae32-22c2-4e47-9cca-eabeefb3a0ec", "comment": "Malware payload (RedLineStealer)", "value": "6ca99caddbb316948ed7757fca0d9d3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040837, "uuid": "7c9d92d7-d50c-4bf7-b2f9-f49531899cb7", "comment": "Malware payload (RedLineStealer)", "value": "6588306e4948753e6bb2b6b77ce88e13c7f08252cfeeebfd099395877fb4d647", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040837, "uuid": "ef292601-90f2-43e5-bc59-718fe974dc72", "comment": "Malware payload (RedLineStealer)", "value": "e8d3974d26162a2fec4dec375d122040abfea1ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040837, "uuid": "33ccc0f7-ff03-4dd0-9878-f394633c6359", "comment": "Malware payload (RedLineStealer)", "value": "865eac122cd2055ffa8c24f0c1a3636bbcfdaa57451d4c6903a497c8557511f38137cad8987565c4c013216c613e3fb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040837, "uuid": "f6e248f3-3ad4-40f5-b66a-ed997a384e4e", "value": "T1D3F42392E6D88033E97217B05EFA17974B3DBC118DB8875B17AAE84D1C325E0647273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040837, "uuid": "4d8aabee-6ad0-4931-9d6d-5fe3fc452ee5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040837, "uuid": "c957526c-5927-4e66-9bd4-70e51dde947f", "value": "12288:qMrFy90XCp6C46Ly0yeISy/vTTk6ctpDm9OkgGsn0kBAsnMLtIW+GE6HAh5:fyLcCPLUeny/6bHko0kesML1+SH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685040837, "uuid": "28ec51f0-8691-4992-83e1-97fef9bd2b28", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685040837, "uuid": "af2aba16-ad71-4d66-b305-1a47876f4661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040837, "uuid": "a2c1b608-0da2-4d78-9d5c-2f36e06115d0", "value": "6ca99caddbb316948ed7757fca0d9d3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e4b362-fae6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685010208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010208, "uuid": "9fa3c904-1217-48a8-91e4-fb861630262e", "comment": "Malware payload (RedLineStealer)", "value": "ee7e7f624b9f0e78346c4b8e0a024e40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010208, "uuid": "19ee5b8f-6b93-4ec4-9277-8a55cb44a48f", "comment": "Malware payload (RedLineStealer)", "value": "65ca1576d225175fdebfeb9bb381211a4c9943e79d29b75a1d83b98016dc6a62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010208, "uuid": "3f403b0a-47da-45a6-868a-c677cc385207", "comment": "Malware payload (RedLineStealer)", "value": "e7207eb7bbabc0a269f91a7a0aaa6429601a65b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685010208, "uuid": "ade34ec5-9efc-4a4a-bf49-2769c4e5f30e", "comment": "Malware payload (RedLineStealer)", "value": "17340fca6f914e17928b5336fc95bd0855a09e6e40dd2c226e1e9af847a258bdb7f0f569ea7a63c39470bf42d894f3e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010208, "uuid": "b73f88f1-00e6-4704-912e-8ae74b3e422a", "value": "T1F674E0213248C076F56724B198D9DA756AFCB8300B6FA6D7B7D406694F217E2BB3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010208, "uuid": "dd2eb81d-8c38-4213-be9c-01d976b91c04", "value": "c431c66e4e6df6a5b1ef02878d31af4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010208, "uuid": "88d91fbb-e9e1-423b-a1e5-c9bf8893887f", "value": "6144:M9zo+RHJd2i5jtZOTADXIMPvR2Yzyq5h8ezQM8:p+HJci5jtZbT0YzyqRzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685010208, "uuid": "50204ce7-a41e-49c1-a94f-6dd266ef51b3", "value": 360440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685010208, "uuid": "25a01aa4-1aec-4a78-9a6f-6f2a39464551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685010208, "uuid": "722e34e6-740e-4217-98fb-e701225699ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8760ed-fafb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1685019168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019168, "uuid": "984b40cc-0ce3-4fc6-90a1-98512348f72b", "comment": "Malware payload (ModiLoader)", "value": "13c07fcf9a29a18b34fdd79b9c1a3664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019168, "uuid": "92408c9f-6c64-417e-a65a-a58048d74c25", "comment": "Malware payload (ModiLoader)", "value": "676e1a8d1399e67ef813b4cdd79709c04c3134c9842b636ed3c73d73a05efdc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019168, "uuid": "aa140193-22b2-4c3d-a6ba-7866efbad32d", "comment": "Malware payload (ModiLoader)", "value": "2270ed5aadc869b0820f311b3d478faf056e1591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019168, "uuid": "8a2b97a2-aec3-4956-ba36-d17ed38fbd4c", "comment": "Malware payload (ModiLoader)", "value": "6d2f489aea96afacf638df4792080a00a2b8eb2c6acd97e4d7122776acdb96807a3df45f2a79ba01d484202eaef446d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019168, "uuid": "b246d422-e7b7-4880-9ae5-6fa1fe1ea6b4", "value": "T19635BE12B3F11473E12E1A385D6BE7A55A1DBE202938740A7FE23D48DF3A2427D642D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019168, "uuid": "c480aac3-3b9b-447d-bedf-6e1f3b3b51d3", "value": "b3b7f3046623191c43621fd310d374b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019168, "uuid": "bd6e9318-c2ff-463e-9592-6c0e0a75ea15", "value": "24576:SSWrMz8C3kJ+VnkaJ56TxIN84Mm/31fb5GJ:SS0o8YXMFIN84X31fb5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685019168, "uuid": "06c1ea3e-348e-47ed-9201-60517ac8ec81", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685019168, "uuid": "56548401-9927-434a-ae9d-218081a70c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019168, "uuid": "c990ff46-4a71-4490-91ec-1c59991d03aa", "value": "Ammended Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3355293-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684995072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995072, "uuid": "ed71526a-41a7-4472-abc3-936fd6145f09", "comment": "Malware payload (SnakeKeylogger)", "value": "ad66bdc4a2a0553fc82002767a38042c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995072, "uuid": "f66f8901-9008-4f14-8bc5-f044f4e95185", "comment": "Malware payload (SnakeKeylogger)", "value": "6852d72daa3cb833ad7303422696b68b2df654acab26f54f36732c3e97822cd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995072, "uuid": "085d608a-8ef1-4907-a5d6-93621353ea48", "comment": "Malware payload (SnakeKeylogger)", "value": "08d1aaec9e892645afbe169732d7e84e6fd1a7c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995072, "uuid": "3cc5316c-3386-44d1-9783-b16488cc1001", "comment": "Malware payload (SnakeKeylogger)", "value": "1c092bec9ffb1f19297a86571fa94d1f794920f296d2b266ada7b841d93c30b79a870b04f0a57f213f58af084860ab63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995072, "uuid": "41463537-7651-4a43-ac82-6fed65ca4462", "value": "T117D4028466BAAB46D5BF93F40000A6B8073D9C5B7632E3471D93B1DBA661B141F81F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995072, "uuid": "ecc86470-895d-4f3c-a187-25bc5ce446e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995072, "uuid": "2e87107e-f28b-4b8c-96ea-00174975efa9", "value": "12288:b2N8jiZ4zypIPsQtPplTY6RhKuyuvrhTjuGZQUUmI5bSy77TJR2kgIq:b2N8jiZ4zypIPsQJTDEMMGZQUlI5Oy72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995072, "uuid": "cf569f3e-796b-4315-8374-6881fb4d6b7e", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995072, "uuid": "66f68c05-7387-4b72-b72c-63bacd9d7f63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995072, "uuid": "5fa66a92-45af-4745-ac96-df6a871913a3", "value": "OMXoManVTAsK0WG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a8cf0a-faf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685018615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018615, "uuid": "eb91f1e1-719d-4676-845f-598969e914a8", "comment": "Malware payload", "value": "ac8cb958dfa0dced9e6d88b771366c57", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018615, "uuid": "6dde7363-49db-4a2a-b9b0-c1af23ebc322", "comment": "Malware payload", "value": "68b7ab08f4253bd01b7ebda3f92c726782d55f4530b22fc7bdd4cddd0f389990", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018615, "uuid": "a3080fef-bf48-4ef3-9518-6d31855bcfb8", "comment": "Malware payload", "value": "1be5cf1886462e10afbe9c7fe32e72b66cf940a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018615, "uuid": "d2399c2b-3be5-4a9e-ae77-5d9323463085", "comment": "Malware payload", "value": "527d73847d5c742791b4994c506dd55504397345faec9d2ee6dc5e78f4d16cdfff2c31f0525eaf8ebff9cfc9c333f962", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018615, "uuid": "320940d2-5da9-4885-862b-71f88bddf9fb", "value": "T16F24C8804B6514724B577E2A6B30A4A6DBBE0E3482CD5A8BF45F7260F7DE68CCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018615, "uuid": "84019d67-dc8d-4fa4-896b-04ec7eee42ce", "value": "3072:bKrryRFr4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:IykDqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018615, "uuid": "c79af094-f42f-488f-90ae-231ee1544db9", "value": 210964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018615, "uuid": "7901a378-7ff9-42c9-ae66-9271f2d8cf5b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018615, "uuid": "b735990e-542a-4fdb-bca7-11d136bac6df", "value": "Ecutmet.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb6eab1-fa90-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684973560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684973560, "uuid": "10f3433e-0c74-400f-aa54-c1b0566d588a", "comment": "Malware payload", "value": "2427dc12a5685106ea301efc43e99701", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684973560, "uuid": "d0ffb34c-d9e1-46a4-9bd6-d328a8a1d4e9", "comment": "Malware payload", "value": "68ec885eabd2ac076ea588d4cf827eaa83e518d5a4c0578ee73bf0daa4ef9b67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684973560, "uuid": "ea3bd5cb-24a4-40c2-8827-7f121ab10000", "comment": "Malware payload", "value": "7976057a0a0f404371f21d3a61f53a3c91437118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684973560, "uuid": "fb046d71-f2b2-4d9f-86d2-e3dce1c92d25", "comment": "Malware payload", "value": "f97b129c12e238bda9aa277f619207794883872d1439f240935a64cb71bc383fb0623a23e95280bf428039e8e8258ecf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684973560, "uuid": "f1ca81e7-cce2-48e0-9cec-efd7612a2cb8", "value": "T12EE65A07F89191E5C4AED230CA269252FA303C445F3067D73B64FAB92B72BD46B79394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684973560, "uuid": "0cdc1ba4-062f-452c-9074-3e6185477aaf", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684973560, "uuid": "d0573913-69a1-43dc-9580-2a08ea3dc76b", "value": "98304:WqvCncjcDUbAS+LZkvNxEAt/4X1bW8/hTe:WaycYDUG+vMvX1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684973560, "uuid": "ee7067ed-39ae-485b-bb9f-6c1015e0ce0f", "value": 14533120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684973560, "uuid": "f72c14e7-b6c1-45a6-b2ee-a9c4bc67b0a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684973560, "uuid": "5e390b40-dfda-4ebd-b1b7-4bd1a045e946", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8bdc4d1-fb49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685052930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685052930, "uuid": "13f7a1b2-7980-463d-8b3b-1619a6d1ba39", "comment": "Malware payload (Amadey)", "value": "5377a3816f5ada3fa323ddb6119a048b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685052930, "uuid": "71407b49-6f5a-44de-ad8f-e940e2d7ab10", "comment": "Malware payload (Amadey)", "value": "690b61d318b4be258927483082edfdb96bfd93e0045959463e4a79a4d081857c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685052930, "uuid": "bc9fa50c-c3f9-4a6f-9eb7-ce593977af22", "comment": "Malware payload (Amadey)", "value": "9dc7dc8bf55dcb4d05f81bc8232cc41e32d808fe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685052930, "uuid": "d3b6f7ec-16a4-4799-a62e-c759b894261e", "comment": "Malware payload (Amadey)", "value": "843d2b622cdf4ba67733668b655fa4feffb71ab1a5bd379701117f8174c990f18bb01c1e0d045be3d8163bfe38ba5387", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685052930, "uuid": "498f3185-b59f-4487-8969-03023e178d10", "value": "T140F41252EAC49032C4F12F309CF707570A3DBE62D97502AB2656AA4E19F35C5E87273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685052930, "uuid": "8d1f806c-b1d8-466c-aa59-8cd708d01d90", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685052930, "uuid": "fdcada0d-1f9f-4fc5-8e44-44ed33d2be60", "value": "12288:ZMrDy90PsFcF17Gm4p5okYPvgcOx3sBBXqbUqrn3Y1ZJ2+n0kBi+nMLtIW+mElR4:OyEsOz45fqvgVcBx/6+0k4+ML1+T4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685052930, "uuid": "93c8d305-aab8-44db-94fd-55632da1ed5d", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685052930, "uuid": "100c71d6-7efa-417d-b840-3f80ecb471af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685052930, "uuid": "2c351709-c00c-4b53-a2c7-40f95810f6c4", "value": "5377a3816f5ada3fa323ddb6119a048b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f2ebffe-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994770, "uuid": "4e9f59b0-5db7-4049-ae8a-0425908ca2b3", "comment": "Malware payload (Quakbot)", "value": "b6a8d80e33969ec42570f1dcca73b502", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994770, "uuid": "880ef0d3-569a-4e81-af80-3aaab4f50740", "comment": "Malware payload (Quakbot)", "value": "69aacba3fdd8e52ce39cd57260879a8b50d7ccda8f35a35acf595935396d0486", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994770, "uuid": "c2ec6ed3-b6be-47e8-8b73-7b1c8cc5c9d5", "comment": "Malware payload (Quakbot)", "value": "d32cb9ca810a4600facf6d982e6572438b88e2cf", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994770, "uuid": "60ed6cd3-17e5-4801-811c-d23cea2c1802", "comment": "Malware payload (Quakbot)", "value": "6625b440ae0aa8742eb2798f5ef678c2c9d49eb5b9fc349b4cc4c0164e8c4d88c23d66965b3e962c89c84108650ac33a", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994770, "uuid": "54ff9900-17bd-4650-83ac-ca25ea928cd8", "value": "T1E5832A5BE38013796A220235624E66D1F7A248387B62DB74A84EC3AD3311D7DC5BE5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994770, "uuid": "449e832c-6a34-4872-95fd-9e0e03db9740", "value": "1536:XbBJwivc4P1ZOV5wprpj/tQlotmg9zJ9x/StzMUaBqKMVU8naxE:LBJwE1ZOvwRpj/tQoFx/StzM3zMpaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994770, "uuid": "8e1a76d3-fdaa-4564-ab27-eb986740c76e", "value": 88348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994770, "uuid": "f64e0b1e-98b2-4388-8a88-2b04ebe9f941", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994770, "uuid": "9224765b-23d0-4dff-8300-7f98740b0991", "value": "Claim_F206.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3184be06-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685003767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003767, "uuid": "83b5645a-aeab-4df1-a3cc-e847fe88a8e2", "comment": "Malware payload (Formbook)", "value": "6d9f694106245ffca0812bf2fa57cc10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003767, "uuid": "41241474-44b5-47f9-9e33-98d2feed77db", "comment": "Malware payload (Formbook)", "value": "69b82b41a7cfa515bf64c0302089df4a7f0af0791ca5499b6c402c9638d68381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003767, "uuid": "b84dad5c-346b-4f21-bdc4-1348d8a9dc2b", "comment": "Malware payload (Formbook)", "value": "a4be34e9d61491e0df1474cbc528bf4cb9b68879", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003767, "uuid": "b6268f10-fe09-43eb-8329-da9dd4a8a0ce", "comment": "Malware payload (Formbook)", "value": "d99195c26b9d78e7cf27e889c347fb33c9c845670f57e1f1c8e47e7afa4db4e03f684dfe2dc0c01831f85f71b3945450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003767, "uuid": "a3ceb49e-4c7b-4b77-a365-f10130c88be3", "value": "T13B4412C9ABF48DB2E2D146324576C9622EB8AC355812834F5B44F96D7CF22D2990F333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003767, "uuid": "d928b995-26c5-494d-878e-44066d260e18", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003767, "uuid": "1382a03b-e266-4fe3-bb02-65f37829306a", "value": "6144:wYa65ksNVcvZYxYZjv0ae9GsIUOqpuuasHXa2rkbKdsDhKXUQ:wYLkn4OL3sIUOqpuud7r8rQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003767, "uuid": "21934105-9068-4096-8885-7323552285ec", "value": 270287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003767, "uuid": "12849fb7-4b4a-4211-81e8-dcb2a660864a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003767, "uuid": "83218074-617e-4bd6-ae62-8fe1c9b1191f", "value": "ZIMAS 50A-051A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306006bd-faf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685017079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017079, "uuid": "3e06d91e-0b78-44e7-9db5-85c2fead1899", "comment": "Malware payload", "value": "c9f7bd68ad5a8f35876759735a1d5cf6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017079, "uuid": "3ece7ba7-a0d7-41f8-b997-55a64b57b2d4", "comment": "Malware payload", "value": "6a0f48c1675f0f99f319886f30fcf42992891c56f17f125267931ed5f14f2b71", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017079, "uuid": "ef3da273-d763-4c8c-84df-4f1efbc94c72", "comment": "Malware payload", "value": "8d1f3ad11caac273a7ea1711c4fc0300097a07af", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017079, "uuid": "9f968aad-ea1a-462d-9f89-c30364a84008", "comment": "Malware payload", "value": "f53757245e0c0be76da2e75d62744884c98387a5306f65a99409aaefbdc545b13dd4f1988872e848e365d5949e0df0ad", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017079, "uuid": "09d56f38-6895-4d1e-8f60-3ef501372643", "value": "T115F2D8027394927AD7BED97824B045114B72740B7822E7DA3E99A1DD2F61BC09E03FE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017079, "uuid": "fea742e9-8faa-4ea7-9806-5b00b8663ab5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017079, "uuid": "77b4356f-ffe0-462a-9fbd-e9dd0b80fcdb", "value": "768:nPBA9UJXDf1D4BrFTwYVi7UYqZbxKjIDoiWXr8pzeVjjtYcFwVc6K:n5qUJXDf1D4BrFlUYY6bxKjIUicr8pzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685017079, "uuid": "c66eeef3-0c48-4076-bb8d-142769b1d293", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685017079, "uuid": "735eb36b-0dc4-4be2-8097-0ab3b59bdb65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017079, "uuid": "f12240f7-d6f4-468e-8d7d-061c435a123b", "value": "003665799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b10fbf8-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997797, "uuid": "46c2b7c9-bb22-4588-b096-37fe9949db70", "comment": "Malware payload", "value": "a7537f9e2cabaffefc5dbe5234c5779b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997797, "uuid": "a8285225-d563-49fa-93e5-665b15528cbb", "comment": "Malware payload", "value": "6a16933128f45c484f16cc8607c3bb541f29c987e14faadd7a5ec0e8ba32d044", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997797, "uuid": "2087e495-e039-4e25-a985-ddd4de670731", "comment": "Malware payload", "value": "63ee065d479f176d9919f565f37b6c64b9d630fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997797, "uuid": "45f36848-e150-4d3d-9338-a12f594375a4", "comment": "Malware payload", "value": "3c6101085eddb9eb6c65e846cf03c2568cf20870982d1eacf54f80363fff6d8bd2626642207133c5d1e50899e3c6ece8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997797, "uuid": "2f28edf8-a9ab-4727-bd8c-283b3032367f", "value": "T1B33476844B1129A24B4B7E36B730A4A5EBBE1E74C2D4568BF45F3261FBDF94CC8C1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997797, "uuid": "cb1db30a-2b19-4f7a-9f01-6895aa17bfb1", "value": "3072:rc02Uhpq4AVPDB3fluOj0AOZ5SGmCxKATbQjEKsP:Y02Uh0JDB3flXj0vWATbIDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997797, "uuid": "556df7be-4e0d-4162-a9a2-f0203c5b68ff", "value": 250061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997797, "uuid": "9b25855e-6a84-4a06-baaf-dc134bb6d7ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997797, "uuid": "7f902a16-1746-48cd-9b31-368b96f6f46b", "value": "Punkie.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f830257-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003710, "uuid": "5e8b6351-6912-47bb-b53a-16611d4e391e", "comment": "Malware payload (AgentTesla)", "value": "37f0a27fd856590a8af09ed41887603a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003710, "uuid": "11576842-59de-4632-89cd-cc01fdc7c4ee", "comment": "Malware payload (AgentTesla)", "value": "6b21ac723fcef1a13f74d9e1acfb5ba9f500d0d185bac33f862eb081b13835f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003710, "uuid": "57a4573f-f592-417a-90d7-3215d97d120d", "comment": "Malware payload (AgentTesla)", "value": "ef212ce659d4dbeb36dbb1b93bb87619ebe07cd1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003710, "uuid": "a2cb152c-c76f-4793-b4a2-ec2d3314f4e9", "comment": "Malware payload (AgentTesla)", "value": "985cf7099fe31db736ab3321ab82797f2eac26aedd94a1229eaa0d996cf62e624a931f5ae1fc99204fc50003be33a54d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003710, "uuid": "0ea34522-1947-4aac-8131-26de8f22506a", "value": "T117D4DF30509E4A81E02FCBF1A5B8FD72037270E3ADD9D9740B69E1C4CE66F542E8995B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003710, "uuid": "59a41127-52e6-4393-a015-068119ffc3ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003710, "uuid": "6a9257a5-3f1e-4650-a9e1-4c491f18f118", "value": "12288:OY6v5rQk2cb4IbQsL7S1rnhUuGjGVYou3t+IUlC0:2tQkDLcuuTCrt5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003710, "uuid": "8ad4fbbe-294a-42bb-8ba5-0c03133d0a1b", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003710, "uuid": "8b0f0d57-37da-4a45-97f5-6b4670c12643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003710, "uuid": "05e7bbd8-94ea-46df-bcd3-318074679f29", "value": "DHL AWB Packing List & Commercial Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d076bcf-fafa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685018872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018872, "uuid": "da83697f-f979-413c-b73d-a41b46225ce0", "comment": "Malware payload", "value": "4348dec57a6577d794aab23a0d659a49", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018872, "uuid": "6d2198ef-dc94-49f4-b96c-bf3160b601c2", "comment": "Malware payload", "value": "6b2decb524600d4d6e736b024f0fffac0be1e8fcda30a52fa78f22591aa69313", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018872, "uuid": "0532246d-dd51-4d7b-bfde-b83ba3177ea3", "comment": "Malware payload", "value": "cc1d2d358b1f062539b30e0342458e1606c4362f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018872, "uuid": "5d78ca4c-6162-4002-aefe-6d09ab760b8a", "comment": "Malware payload", "value": "3c4a6d16a8dd98c86b2f6e7fa35e0c3391d3f79aa54c9e00793229b7ce5fedf5744d6f37baf9d9ea1b403fb2ea2350fa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018872, "uuid": "1d93ccec-66bb-4503-b83d-4b6e8e9d32fc", "value": "T1DB14B7804B6524724B577E2A6B3094A6DABE0E3582CD5A8BF45F7260F7DE6CCCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018872, "uuid": "e8c2ef8e-7325-45b1-8ddb-4418fb016742", "value": "3072:t5hr4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:uDqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018872, "uuid": "3efc25e2-a3c2-4502-a326-e8d4c45fa4ac", "value": 203930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018872, "uuid": "42155c5a-1eb2-485b-8e3d-1f3352b01c9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018872, "uuid": "8bf40860-22c0-4d84-8c3f-6b24ac615c83", "value": "Qnugkr.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c97b91-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996748, "uuid": "3d7f5bca-0879-424a-975e-63e0ab149c02", "comment": "Malware payload", "value": "141ee3f730adb0f13a61294946a17969", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996748, "uuid": "e2ee094f-2762-49d6-ae74-ef535392fdd8", "comment": "Malware payload", "value": "6b7a273d70c9c2d3081aa27e1d5d4c50dee893b2a7bf7dcdabffad63edadfd1c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996748, "uuid": "71489258-c273-4772-ab6a-fed243a41715", "comment": "Malware payload", "value": "720e4f5d6d30a36c7697fd41562f5ff1e0cfb4a0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996748, "uuid": "78a9309c-75e4-4226-a44e-52c5ac95318e", "comment": "Malware payload", "value": "47e68177e4e76414b331c03babec7811c27260769e6ca242016b26d08a1a77d1469ba989259a29ee8d6dedce10433162", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996748, "uuid": "fab4d0cf-4310-41bb-a922-b570e758440e", "value": "T171748580471118A24B5B6F36B73094B5EBBE1E78C2D8598BF46F7251FBDE98CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996748, "uuid": "9fadcf18-02fe-403a-845d-b3c6a3145b55", "value": "6144:J1hdCNRuZaInWfpzcpUjDt50LTd/+4J3XoAh16lcW:raDuE3dFYJoQs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996748, "uuid": "bddc30e4-99f2-4d7d-ab00-cea4a48acaf0", "value": 364914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996748, "uuid": "aaad7643-d20f-42bd-a313-2ebedba2768e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996748, "uuid": "44ef81e4-6e69-44b1-8c41-f4bc3b2ae1c0", "value": "galvanisedPolya.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90530149-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996625, "uuid": "756b805a-f913-4a7d-b95e-898bf08fa14a", "comment": "Malware payload (Quakbot)", "value": "9827153675ca8b62079ed54540fd22b9", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996625, "uuid": "62432919-0279-43ca-b62b-b5ef5d0c31e8", "comment": "Malware payload (Quakbot)", "value": "6bdbf9dfc2d2b76f62ba7a2037e3d86a889a9cef80c21323eaa228078a58e489", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996625, "uuid": "a98b6807-1ee8-43b8-82cb-652277cd09b6", "comment": "Malware payload (Quakbot)", "value": "3ba6c12b227409966ce8263454852c32655977b2", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996625, "uuid": "d6d12ce8-9df8-4b28-b343-d93bf6b5b0ff", "comment": "Malware payload (Quakbot)", "value": "2a4509e94621504d4ff5b1e0ad6a8469403bc8004bbb3db669e4165c9ae3c534fb72dfa215d49ab5734dbc7f280b1bc1", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996625, "uuid": "3732d9b9-c027-4199-b28f-1b78e227a47b", "value": "T11C43195FA381133DAA120129910E56D1EBF54838AA32EF38E84DC39D3311969D6FE5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996625, "uuid": "5e811e2c-f650-4c8b-9761-64d7b8e22a90", "value": "768:8I04vjFiD61ZOWTnF266GzhHBmcSkTwoJobTT+xIQMcbp6p8p6W:8cxT1ZOunF2OPmcScdJM3gZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996625, "uuid": "ccbd3f26-08db-4a24-8999-1c74a0464868", "value": 60570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996625, "uuid": "8a0dc8f6-c3b2-4029-982b-22e8c909cecc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996625, "uuid": "afcd8ce9-9237-4802-849d-7e4a892bec7e", "value": "Claim_B210.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35ac191-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996683, "uuid": "131bb348-7173-44d8-b465-a7082df464e7", "comment": "Malware payload (Quakbot)", "value": "4a3cc6a6b7d742359ee5c10502d4c16e", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996683, "uuid": "c2770455-2e33-4974-9cd4-3e5e9a05b8f1", "comment": "Malware payload (Quakbot)", "value": "6beca5ccf0ad4551f6d8ffa5ac7666a3fd257222b46b376d736dc509d15e07da", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996683, "uuid": "0f25a42f-5d9c-4f66-a66c-e2fd5e8c0a14", "comment": "Malware payload (Quakbot)", "value": "be92a407a1352e6c2ea3eb80fa487ab1479466ed", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996683, "uuid": "7fad126b-6b8a-4243-819a-1683bb2247cc", "comment": "Malware payload (Quakbot)", "value": "ff467955b9d845f48d5d214833bdeed783a90a959987890532cb8ef92ecb9635206600504e7ac57d6ad0a20d7d161ce6", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996683, "uuid": "f5506542-973c-4320-b201-3fd72a11e45d", "value": "T1E183196BA341133A15220225650F5BD2F3644878BA76DB74A48EC2693312D39E7FF6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996683, "uuid": "b56f3468-bfab-4af8-b0b1-3bdd2f42c6e8", "value": "1536:Yx3vr8ymw8n2UWzYWhmRC8IRAX2tJtJtnqZlDCod4T3DbqMfDb2MdMGbgujI7x4H:YDmyYjCXRAmtzolDC2MbVbhb+trFk+lQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996683, "uuid": "7aa4b542-c096-4b6d-9cac-cb364bc4f452", "value": 83568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996683, "uuid": "38a62257-371a-4aad-89e8-314bd93db77d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996683, "uuid": "6617dce9-0aa7-4b58-81f5-5bc13769306a", "value": "Claim_D372.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a742340d-fabb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684991939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684991939, "uuid": "8f76ddfd-90d7-4366-848a-e4c9e8feceef", "comment": "Malware payload (AgentTesla)", "value": "5edd109d2160c17f787bbfcd4048c377", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684991939, "uuid": "a0242912-1ec9-404d-8812-69fa5c8a2270", "comment": "Malware payload (AgentTesla)", "value": "6c296b3c0eded366084694b19f503a3e55cde24e9cab6d152765e8779daf01d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684991939, "uuid": "e32a4718-24d7-4c8e-b2b9-6c2717da8322", "comment": "Malware payload (AgentTesla)", "value": "38bcfc163036392b2f34fc015a38330720759cf8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684991939, "uuid": "f61c9ef0-a176-4f4c-8333-3329b731fdc1", "comment": "Malware payload (AgentTesla)", "value": "518da46f0ae3ab2eb17925a860dc60c5621801eaedb8bda891ee2c1240e0f78831eec3ba79a50984a373881ab2b3bc62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684991939, "uuid": "8f372500-0b41-4821-886e-4c93d5bc83b7", "value": "T160F3182993895E52D72D40F4C7A0010B16F3E143561BEA5E4EED9EFA3F067C3362E8A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684991939, "uuid": "8a5652ec-be25-45a1-a59a-e72799ad8f6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684991939, "uuid": "1aba6fe3-3005-4358-bff8-17fe6bccd9c6", "value": "3072:NRBRDIDePUe6cz10+BW3E8WjJGslTOY5CpPccDHYtCc+F5uk1kiOcxg:NRB2MPFZdBW3LWtDU0cdcMQYTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684991939, "uuid": "86b52ee6-2aba-43f9-ab7f-3a83c513b72c", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684991939, "uuid": "87b0d97f-0ffa-41a6-9917-602807acc6a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684991939, "uuid": "88ccde03-a4f1-4c6a-8184-9c05a72d9dbc", "value": "16849919371e063b608d997678acf85079ec79638d51fb59bfd508c98800ceed8a8e4d16f2242.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76fe3b4-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997979, "uuid": "2dfd4b84-4596-4c5c-bf3e-0f532ae99283", "comment": "Malware payload", "value": "f7665df9fb88b4685a690e5e006b845d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997979, "uuid": "658c9bf4-f291-4fa4-8a73-361c39094c64", "comment": "Malware payload", "value": "6c65679d912096310efc1c770f4f2dd76803645d3c1d93f9da2e08ced7d3b7eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997979, "uuid": "407dc9f1-84eb-4042-8eae-efef6a07cf2f", "comment": "Malware payload", "value": "f30419bfc61163f8a86b28e5687b2662285436ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997979, "uuid": "5aa04deb-d5e0-4009-b0a1-18f02bc8b81c", "comment": "Malware payload", "value": "2ee9092c13e4aeed9f5b9d8d17c57badd30c1c8d7d955703d683d5e844e3331816d91cdff0631977d09fca56f3cfb3a1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997979, "uuid": "f3bd03a9-9225-4210-85b5-0f8792dd0231", "value": "T158649584471528A24B4B2F26A730A4B5EBBE1E75C2D8598FF46F7251FBCF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997979, "uuid": "1b45675c-b3af-43a3-aab4-10ec9bf0b1c9", "value": "6144:yGpXbiD2i60JjSTl1COgLG6TDjj8nTQeachsTkW2PYy:yEgTI8JXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997979, "uuid": "3827a05c-9e7d-4692-aa0b-9bab01cdf187", "value": 311273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997979, "uuid": "11764e84-7c4f-4ee2-87ec-d62260db309b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997979, "uuid": "61178e5e-8fb9-4207-821b-e64595a59119", "value": "SuperrenalAcety.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5b4225-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997235, "uuid": "74fb12f4-6f84-477e-89b9-c1b162d1385e", "comment": "Malware payload", "value": "ed4c205d8487094a6ccbb8f16e84c73b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997235, "uuid": "9891935b-0ebb-46f2-b2ad-3c87e39b10e5", "comment": "Malware payload", "value": "6c7a6577079dd001b6e4c72fa8c894ad93aabc2589f143800905d6d8fb8b4fd8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997235, "uuid": "764edf00-724b-4343-9330-c1a94f26df01", "comment": "Malware payload", "value": "617eacdc297df5293045fad966df83ee2e801d9c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997235, "uuid": "82ef8f25-419c-418c-b327-16e54fb2680a", "comment": "Malware payload", "value": "310daf454a2ac4e443763ae48e50e2c3cf814fbe4fa5a146d9cadfa5247425ccc214b37d8432188104ab0af86c80bea6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997235, "uuid": "3fec3723-b838-45d2-8aad-605c8c8e4c4c", "value": "T19C5467844B5529B64B5B7E266730A4A5EBBD1E70C2C8568BF45F3260FBDF98CCCC1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997235, "uuid": "bdf1b123-d33a-43eb-af3a-e2d45f06f346", "value": "3072:bBJ+A181z1IXpdyZ7ndYz3h+preshWlqTzUvgpW:FgA181z1Iu7dYzxNshKqTzUiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997235, "uuid": "f5c8cd99-4095-4a1e-8a40-3fc1929d137f", "value": 298775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997235, "uuid": "8f813b03-099a-4261-8c75-f1e458bef832", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997235, "uuid": "15d2f03f-72ce-4fdf-8214-dfa59b7b328a", "value": "kenspeckHappens.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2bda923-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997998, "uuid": "8c115299-f250-4345-9dcd-1e390693b906", "comment": "Malware payload", "value": "68d8e0d050d35005da18363c6017a1c1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997998, "uuid": "57122d67-cb97-4090-914a-49f722de02e7", "comment": "Malware payload", "value": "6cd859e2bce10431ffdb7bac5cec9f9a772f23ac8c0f291d690acea9b1dd9e4b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997998, "uuid": "3eba03e7-4d08-4616-9db2-33c11a4ebd1f", "comment": "Malware payload", "value": "0fa727b90d4316eb4eb19c3aead9ad9de968f8cc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997998, "uuid": "332d676d-f7cf-463c-8dfa-35c62ada9b30", "comment": "Malware payload", "value": "092715bea3654d513cf9493eab540cb0f0948ae4a6fbde45ab81f79226b6c62d87bffc89314121e78385aa2a4efe5951", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997998, "uuid": "e4195f23-dc37-47eb-9a1c-24b01d8d3d6d", "value": "T13654A684471529A24B4B7F22A730A4A5EBBE1EB8C2D4598FF45F7251FBCF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997998, "uuid": "a04896d7-3b50-496f-aae8-96db555c8d06", "value": "3072:158ODhmlvqBkjj9ota0VU6u8Y4L4IgU3c8wiOtOj5p218e9LC:9hmV1otad4LaXOlEiaLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997998, "uuid": "39a74d6c-1845-45b1-b0a3-a40ea7913a57", "value": 295119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997998, "uuid": "0dde401b-15b0-4f31-a53c-cd736eaab10b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997998, "uuid": "390d352c-0463-4e86-bc75-06f87dc2f97f", "value": "Thelphusa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a763fc-fb10-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vjw0rm)", "timestamp": 1685028178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028178, "uuid": "9ef2641e-5495-4ab8-a65c-8763dd56ab54", "comment": "Malware payload (Vjw0rm)", "value": "7fc3ab727001bb3f552bee872b7c90a7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028178, "uuid": "cf986c0f-f3e8-4c02-afbd-bb9a10e0505c", "comment": "Malware payload (Vjw0rm)", "value": "6ce2e7208cceb1b481306e5ccd7e8a8622567926cb3e8cdf442a4e2b94d8d97a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028178, "uuid": "8cb82a8a-4734-42c6-815f-9e37293d7416", "comment": "Malware payload (Vjw0rm)", "value": "f0fa0bdb338ecb45308bc83718559265077b9a86", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028178, "uuid": "89b7cfbb-3449-4ebc-b97b-5a65a6582225", "comment": "Malware payload (Vjw0rm)", "value": "a693870bd98c69c7e640572317b25e68084afa6dfed9dcf82ba0dd501d57a2d12ce81c6d8d0d589ad4c648de36fb7e62", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028178, "uuid": "a55fcf2d-5ae1-4ea1-be55-d4911881785c", "value": "T1F9152BC125F87906E762F664C321F122ED74E9233DD711D179C83E4AAE76C406EBAE24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028178, "uuid": "9107f538-b159-4872-a083-64ee0dc80a50", "value": "6144:QQ5r1A7G9u13eV4pO5SolqKCvOZYuHYKq/ofQZvN0+QPJkh3dqYB2r8YOdchB1VF:TJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028178, "uuid": "1a7faddf-03a5-4500-a9d2-860f13f12b51", "value": 920867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028178, "uuid": "6086372d-b23c-4260-a434-fff83357153c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028178, "uuid": "af7351bf-d3a9-4169-ba4c-9f034202d9b4", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7da5a70-fb0b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685026326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685026326, "uuid": "3577de9f-2319-4798-aa12-5a9f6592c0a9", "comment": "Malware payload", "value": "f8954f37249c5d737143889204d1bdd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685026326, "uuid": "0170859e-9f75-4885-8984-d0d39fea26b0", "comment": "Malware payload", "value": "6cfb72a65aa613f9b1978b7397b78b0a69eb8247bd4a43e60cc67afa204485b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685026326, "uuid": "cf30a0ce-3145-477d-bc90-7d5c7fd57bc0", "comment": "Malware payload", "value": "8da180d2251a308cf778a4a23318727bbcb0b6bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685026326, "uuid": "bdad5360-e74c-4c87-a417-bc40aa664841", "comment": "Malware payload", "value": "372b88a7346900815b081525ff01cafb338e3ae2eb19cd0b4f3afb82bda23a661c5e138d74d9bbee116d3030532361ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685026326, "uuid": "257129e2-3158-44c9-899d-0c9d24abb75d", "value": "T116673348746E0ACAF51828B67D07E2E3072AAC887FE761BD05BC43B9327177647529C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685026326, "uuid": "6fcb19cc-eb82-4b21-8b1d-03606968f59b", "value": "786432:pbuFh0X2B2PVqwBYDiWOMyMZ+4knCeDsu/RjvhhFhaLvr1y:IFh82BdwBYDifWGjsu/RT5hEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685026326, "uuid": "1e946add-014f-4277-8807-a28cc51917b5", "value": 31139566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685026326, "uuid": "1cc95e49-3f95-4c46-8ccb-c3970755cb1e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685026326, "uuid": "ebd5adcb-9e51-45c9-a457-68c86e0e00c5", "value": "Brawlearth.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408e236c-fafb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685019254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019254, "uuid": "d7ea9ace-4e2a-489c-a9ca-70ea2377fb24", "comment": "Malware payload (GCleaner)", "value": "0837b113c5c34a669e0152706b8c2e18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019254, "uuid": "dfe5f8d7-50e0-49e4-98fb-5325393e8f38", "comment": "Malware payload (GCleaner)", "value": "6d2016e9d9252c1025080f601edbd0709b99066c87550206914dda9cea247c5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019254, "uuid": "80b2fc55-ba41-4ffb-9960-62ddde2d7add", "comment": "Malware payload (GCleaner)", "value": "78df15d15e884ce84868699ee80b32f5bc5625ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019254, "uuid": "f5acfe9b-6351-4ab9-af07-4eb899cfac91", "comment": "Malware payload (GCleaner)", "value": "4ca0d616fa9b29a0357c481427a2e88056890ff0cf206ddbc4220e6b24ce282df74b69b88e81f2d78ca83e2ac657a71e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019254, "uuid": "eaa91d14-8941-4e53-83ca-dae987c02927", "value": "T16664BE5356E13C61FA7A96328F2EC7E8361FB5934E18775A22285A3B08701F2D17274E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019254, "uuid": "a3a86a71-2059-4266-8b37-ffe09a59a9d4", "value": "a2a50468f2f362e6d5d07749761bf2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019254, "uuid": "ed721485-bd1d-4a35-b369-273992c9ab2a", "value": "6144:m4Nn6UY0IrEykmebULBBBVIGwZAis4Vz1R0utVZT:mQ6UxIgyqQBBBwjzImD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685019254, "uuid": "8d76095b-3a1d-4a8e-a459-bf96050d40e7", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685019254, "uuid": "0424a3a6-5f89-4839-9556-29371b2ceaaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019254, "uuid": "f39392f2-1ace-414c-9ae7-6e8f357d8c9c", "value": "0837b113c5c34a669e0152706b8c2e18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c789e9-fa95-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684975427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975427, "uuid": "3ed44795-a526-49b4-b134-1da65089d11a", "comment": "Malware payload (RedLineStealer)", "value": "10e707035196c7305ec23eb7e23cab1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975427, "uuid": "1cb168ae-4343-4111-a052-dbaf8cdf4b8b", "comment": "Malware payload (RedLineStealer)", "value": "6d2d3b51c142e27d4d5c2559c68e36f8e5835171b28dea64c2b239e1d0cc0d1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975427, "uuid": "e4a2f2d1-c636-4458-82b7-4a1ad5ff8411", "comment": "Malware payload (RedLineStealer)", "value": "cfe1cabdd1aa43657e8067fa5f260a1b1db32150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975427, "uuid": "49fcce7c-8351-4771-9dfa-452e0908e9c2", "comment": "Malware payload (RedLineStealer)", "value": "7a3de0ab5e3a3611d4bab1abdbf16104da7a1fa8501a648a1de732b682ea090aab6b18a9085d366289b5814cb1c5ed6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975427, "uuid": "1b4e9671-421b-41c2-acc6-572d7ac14cbb", "value": "T1BB25238BDBE801B3E8B617B04CFA07D34A79BCB59838CB1B77449A991C767906435363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975427, "uuid": "0fdadcd9-4755-48b9-9f1d-273f18ecb8d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975427, "uuid": "c0f9d30b-b828-4f36-a7f6-82430e0289b7", "value": "24576:dynw93AsIdGTGNZEIOHkUFFTG+lhrsGghI6q5F4kfCOtnO89Q:4cP9GNFOEqGMhrsGgCBgOnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684975427, "uuid": "cebd7399-f9c9-400a-ba63-5717368bd964", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684975427, "uuid": "388fe60a-86a1-4e3d-a8db-47b5a5208da9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975427, "uuid": "5e8fbf8d-600e-4874-b7fd-11f6fc4a99da", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d4948e-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996786, "uuid": "caf22fca-8794-49d4-8623-20d50ea38d4d", "comment": "Malware payload", "value": "cbc4fd0936294f258afec7f38a3bd691", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996786, "uuid": "d3230192-ee4a-46f1-90b7-5fb3fe894556", "comment": "Malware payload", "value": "6d611dc30342567b19fe75896f32498e8a7cc843c06aa0983a1763cfa816f392", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996786, "uuid": "b27b5b3f-a3f4-417e-a136-8096ef0fd4d7", "comment": "Malware payload", "value": "51620f2d87431b2d592202c0ae917864db765e9b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996786, "uuid": "d8577268-5702-484b-929d-80d1e9631054", "comment": "Malware payload", "value": "a7feac99b1ca2d1db30f2ce04fd58e8af16d2c39cff22bee1124987c99ca6caa2762c7fd8ecc160a7ff929244fa554bb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996786, "uuid": "2426a41a-06ae-469f-94da-f7f4516f151f", "value": "T18C44A984471119A24B5B7F36A72064B9EBAE1FB9C2D4498BF46F7250FBDF90CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996786, "uuid": "ddac300e-7a56-493b-80dd-67480301fb68", "value": "3072:Bi05MlWRjlXF8YRl9w5fxrZcTm4vvxL1yFU3o7ahgBB3h:ByMRV/AfXcTBvXoeU3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996786, "uuid": "25489779-cb1e-4285-a188-86ab9eb15711", "value": 273548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996786, "uuid": "ab491793-ddbd-4527-a774-e218175a39d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996786, "uuid": "0d7c3981-092e-4859-8033-fd8ebed9e783", "value": "hexamerismPlumm.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e471c2d-faea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685011895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011895, "uuid": "2de8cc90-9dc0-498a-a0e2-7e64dd4a1c50", "comment": "Malware payload (AgentTesla)", "value": "74c5b56a3f4d94656064b13823355f98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011895, "uuid": "59ae1eac-acd6-4e53-9026-308b5f45083b", "comment": "Malware payload (AgentTesla)", "value": "6ddf5058c73b0024c0d43b1b886aa3de7454944643da1f95f1ab52d97510535a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011895, "uuid": "e69db92e-7519-4501-a131-4ae146e52d6d", "comment": "Malware payload (AgentTesla)", "value": "d958376fd3b54b70ae781a95ee26cde55c1907c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011895, "uuid": "521392a3-80c3-465f-8c0f-e1c65801c2d7", "comment": "Malware payload (AgentTesla)", "value": "f48a49383bb7c7f17118d9999054f0f8abb19e50b83edee6732d9cda32709c89b0c355a458f0b5e4f928d543edd4ea48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011895, "uuid": "7a5f29ea-d165-4d6f-ab7b-343d61d33436", "value": "T15EE422A4A5466B64FABE07B44894B3F105AECFD074B6C7274C0BB0C9D34EB091C9179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011895, "uuid": "85d1dcf8-a7d8-469f-aa13-ee9126bf5236", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011895, "uuid": "12a19b62-4b45-49da-9252-8ba13ef7cbd9", "value": "12288:+aWIm6lVvtzZBEP85ot47OhyUDPzISJlY0kybDaGy6hBUMVhgdq8hesa6w2Xtim+:fTmIt9BEP8jSh1PZlYoDdh/UMVDsag9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685011895, "uuid": "3a1db458-0e8b-4b57-a649-700151b06605", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685011895, "uuid": "97dfce2b-574c-43eb-be64-7331caa45ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011895, "uuid": "13d74748-0daa-42d1-b8a1-d61154897ca0", "value": "002726199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132801fb-faf7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685017460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017460, "uuid": "38c75e57-4d3f-4a37-8bad-3da6524ac5d9", "comment": "Malware payload (RedLineStealer)", "value": "f24c8da1db49e28ec73c957a26032a02", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017460, "uuid": "b0b11619-3ae4-4b23-97f1-9c3275d2c168", "comment": "Malware payload (RedLineStealer)", "value": "6e269a095530a0de58be207ed368a8821681c879fe9e63e5d4c5d057ec308585", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017460, "uuid": "6fb66b1e-5d12-412b-b116-c1d49004c8ab", "comment": "Malware payload (RedLineStealer)", "value": "b279d41bec6d50120568f9742463afd060cf9209", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017460, "uuid": "540bed98-3f13-4756-ad29-cf47dfffd4f0", "comment": "Malware payload (RedLineStealer)", "value": "55024d39324ad910333636579a881545297efc096a31fd7b6dcce48ebd1e17156aee7a312c2c4c78895c90d1f1a8dc9a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017460, "uuid": "565f99d8-6ad0-468e-80cc-5d1dba1fc4ae", "value": "T1C3352317F5DC5431FCB52B709DFA03432B39BCA11AF0878BA385AA991C726C4B86175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017460, "uuid": "d7795f7b-1672-443e-af6d-8a596af3b28e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017460, "uuid": "c14ca12b-ac5a-4d7b-95b0-327aa97f95a1", "value": "24576:cysrGCU3eH6ZM/JTA4lwacAx/8Lg+0lfn3:LsHHxJT/lge/Qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685017460, "uuid": "4a404a90-2c4b-4420-85db-39e54cde1c5d", "value": 1072128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685017460, "uuid": "4b7e31af-9be4-4a66-9c4a-8474470aafab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017460, "uuid": "0a78e623-2729-4991-bb04-462e2d36ba99", "value": "03012499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f89b7f-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997902, "uuid": "0582629e-3133-4602-a529-d7dd81a676cf", "comment": "Malware payload", "value": "4004d43b8c39fa5e4e8f19b4e4d3f4e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997902, "uuid": "1471fbcc-ab58-4d49-9dd8-4d36e0fa65cd", "comment": "Malware payload", "value": "6e6d9a9edc52d15e054087d92cf87dcf820d40f66d41111a071b38cdf5d95f42", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997902, "uuid": "e19f1440-d6ab-4e34-9798-c40dc3a57d6f", "comment": "Malware payload", "value": "508d25f1c4207675b39c8a26b36d26fad0be83ef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997902, "uuid": "f19241af-ccda-41a4-a230-75bd91af418a", "comment": "Malware payload", "value": "d7c361c9e86e89f8107935223c6f6f145929a13a584d248c48078eafc7e64bc7ed6e53f1bfa925ef7a2aebdd8997b6ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997902, "uuid": "6e678934-d39a-4bfc-8e97-784609b87dbb", "value": "T154748680471128A24B4B7F36AB3094A5EBBE1E79C2D4598BF46F7251FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997902, "uuid": "9f3667f2-7eee-422d-9ddc-65c706ce5eaf", "value": "6144:d9Ig99U8vl4U0jxk+BYz4Zfk4ZLE3dkNRKw+kYaOlQ:d6Y9ujpOWcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997902, "uuid": "fa1fb7dd-ddc4-4a2c-a54e-b7b5f4ab9d2e", "value": 344416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997902, "uuid": "78ab6949-8811-4a1f-8927-2ae70c8b7a26", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997902, "uuid": "e3511600-fdcb-4ff1-b280-0cbda6422fd5", "value": "ShantymenSwingd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d87816-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996909, "uuid": "67ae064a-9e46-4756-bcf5-977da2937467", "comment": "Malware payload", "value": "ebe0913c77dd71024bd8bc0e401bdfa6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996909, "uuid": "ea5a4ca2-aeec-41d6-9956-c6ae41d81530", "comment": "Malware payload", "value": "6efd1f22b836f3043d0ca20e7cee633f92dac08511af3da10f2ef5b475d53075", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996909, "uuid": "7172a583-e258-4a3f-85f2-50ff9776dac4", "comment": "Malware payload", "value": "d44a08ed9d858bf74598c039a3f5074c5137e108", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996909, "uuid": "37624284-d1c5-4813-bbb3-34c479b9c962", "comment": "Malware payload", "value": "2aed44d6ecd99f877a13afe7193d530bea02e893b4bae7e35752d2acd0ad3bd18a578576aee7bb9771cb6818078b33d9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996909, "uuid": "5a73f5af-7086-4430-8f4b-85d19c1c50f0", "value": "T17854A984471518A24B4B7F26A73064B5EBBE0EB8C2D4598BF46F7261FBDF94CC8C1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996909, "uuid": "b379801c-db2d-4664-ad4b-785e5e7d891e", "value": "3072:z1eQXJ4n0Y0yiDfkmtCVx4UmEqkxTUb4LViUwPVGP0Z+J9YvfvPPUxeP3UvrpP:rwurfkx4cVfAdNGsT3PUxePkvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996909, "uuid": "e9a6fe50-f5f1-45f1-8cdb-347ada3eaa8f", "value": 288696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996909, "uuid": "9b39e1b8-572e-4e2b-a641-66d40d34a2fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996909, "uuid": "da140120-c21f-4bbd-a834-106e3b16dac3", "value": "jaquimaVenenous.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4307c775-faaf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684986616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986616, "uuid": "2f1000ff-35ae-447c-8782-2957c09d3f5e", "comment": "Malware payload (RedLineStealer)", "value": "af11dac22981c82303014e1e5b378cbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986616, "uuid": "ff803204-14cd-422a-bb29-a08ed86c7fa8", "comment": "Malware payload (RedLineStealer)", "value": "6f764da136f83d2bdfe74954b520ef7b778e253acde1cafbe12aab50b547f317", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986616, "uuid": "e4a03af2-f7e2-4fc3-a79b-01ef0857498b", "comment": "Malware payload (RedLineStealer)", "value": "f84dd810fcac4b7e25301793ec80cead71719810", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986616, "uuid": "5d379bee-b1dd-4912-a6f1-4bb3f9c04ba6", "comment": "Malware payload (RedLineStealer)", "value": "ee1cb5bec999eb06e7ab9e8a73f671aff2737ee3f3ab7edb695b594e6de3ba6bc15eea339c6129d48b2e779b4c49a016", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986616, "uuid": "5b27f7c9-f5e9-4015-a5bb-f6420ea8f0db", "value": "T1BE648E237686CCFEF42F14729BEBA9A04A54353803FF27FFA7C1066907217D2952651A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986616, "uuid": "49720bea-e210-43f4-a559-f3e90cffd59d", "value": "4471786e05fb13e777dde9c491d1e164", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986616, "uuid": "8a30d544-55e1-4a28-aa6e-b186dba82869", "value": "6144:ZV9SHeF4OkXiDPTwH0iE4TiG8JckNJrOvyeIoxij8:ZvieF4OkSAH0i3TizJckNJrOqXob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684986616, "uuid": "00b23137-fd07-4f72-85d7-34756ecf6356", "value": 335864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684986616, "uuid": "7e7c4a1d-382e-4b75-b721-a0c917aa7035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986616, "uuid": "c4b3676f-34a7-48b8-b5d3-d1e2f8828208", "value": "af11dac22981c82303014e1e5b378cbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fc4a9a-fb28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685038812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038812, "uuid": "dc312ccd-d838-4de5-a83b-58a206a213bb", "comment": "Malware payload (RedLineStealer)", "value": "3d5d7fb7529a491fe236eaf1a20593fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038812, "uuid": "66fe4d7c-c2c7-476a-a894-5f5c6d4bc594", "comment": "Malware payload (RedLineStealer)", "value": "709d182c1093d86ad17405324ed77220aa6923785c1d28a589fb464179b5fbcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038812, "uuid": "9b0e6e02-9b0a-45aa-98fb-e9a6ae4d0f80", "comment": "Malware payload (RedLineStealer)", "value": "d65f9606c31216b98e9219437e874ffb57bb072c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038812, "uuid": "7678fe76-406e-4f86-90f0-cf014b67c3df", "comment": "Malware payload (RedLineStealer)", "value": "f1c68e32e17f55031a7dbe2f9005498c649e6fb5def872f05f949dceb31e6e882a3e5176e0765ada6806b1599e878e9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038812, "uuid": "241a09bf-c542-43b8-b288-36ad63af284a", "value": "T1733523436ADC9172E8B613B05DFB13EB0A3ABC51D9BA56732345EA6E08B25D4113433F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038812, "uuid": "f6f06e1a-bc2e-491e-8d3e-341a4d59988a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038812, "uuid": "8e06c2f2-79a2-491c-99b9-1edf65cdcd23", "value": "24576:OyFHJVetwSMmTHvZtV1SXmQLz+BWSWmTsDh/Mwvlf/sxC:d/MIEVAXTwWO4PBkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685038812, "uuid": "1ec1a149-924f-414f-96f8-0c7b46798920", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685038812, "uuid": "365c468f-4697-4ef0-817e-3463c9c9fad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038812, "uuid": "acff3bf9-4fd5-44b4-98f3-c31d30d5d81a", "value": "3d5d7fb7529a491fe236eaf1a20593fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fd0275-fb03-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685022944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022944, "uuid": "33939660-f98b-4661-8e6b-5af14909d84c", "comment": "Malware payload (Formbook)", "value": "a25c65d290427a4498293640f2aeca31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022944, "uuid": "8c6d11a0-b71a-47be-ab02-3f14108dbe26", "comment": "Malware payload (Formbook)", "value": "7100eca69ee44d96dd9a5b3ff0070d2a2778e827cfdabbb6fe96105d149b6426", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022944, "uuid": "938d142f-cc98-47aa-af0e-2837f1dd31ff", "comment": "Malware payload (Formbook)", "value": "0823196a685cb002fe0ea3338d3f16c46ed30c45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685022944, "uuid": "ad6b52fb-eb17-454c-a788-73d35e9cd9c4", "comment": "Malware payload (Formbook)", "value": "ac519df14448fe70f7fcaa1483f405104d5eccbe2f83aa867cb4bd766052544df146872df063b57cb069035d8d411511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685022944, "uuid": "2a7394a7-eaed-4682-867c-836ebff0c1fe", "value": "T1233412983730D877D4220770BE36A7DB7BE64A212879439A6B2077493CB3692D90F357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685022944, "uuid": "7f2c81e7-2edc-4249-889e-688c4174f77c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685022944, "uuid": "cf88d69c-8f20-4be2-9a65-2cf2a2725e08", "value": "6144:/Ya60dzowP6v4nrWXB6HSGWQ6cAPH8rUx63:/Yq3PHrWXB6l3Ix63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685022944, "uuid": "35bb85e4-25d6-4f95-bdcc-8e7c15f326f7", "value": 242552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685022944, "uuid": "3fdf56eb-7635-42e9-a969-35d318eec5d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685022944, "uuid": "3162adeb-9d68-4434-9f7d-2e28d4485311", "value": "PO-1322820232505.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60429e0-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997949, "uuid": "03743cf2-d094-4fca-87d2-5ad11d59aa57", "comment": "Malware payload", "value": "1fa4fbb014d94d22b275596badb340d6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997949, "uuid": "7d77ecf8-be15-459a-9ff3-f81b9e753801", "comment": "Malware payload", "value": "7229de8962380eb30b718ae9244644e8137c11d441c67c13a290fd8208929f64", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997949, "uuid": "375ca553-464a-4991-8748-5728e3f6c196", "comment": "Malware payload", "value": "604d9f2add3229cf0768238ed275ce2b4dcc443a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997949, "uuid": "24db1da3-16ed-4c56-8a1e-0d09aed63aea", "comment": "Malware payload", "value": "8bfdc6e8134a8a54f5859cbfe429a0372cbe873558847320724e179ad01455a2254bcc011960e6f00950dfa10dd2b156", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997949, "uuid": "79fbc6d0-39d1-47d5-939f-d53d9d375a43", "value": "T1F934C7844B1529A24B4B6F36B730A4B9EBAE1EB4C2C4558BF45F7250FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997949, "uuid": "74afe39d-0228-4f4b-b860-d83893c819ce", "value": "6144:nuZRCtz2smoVB+tfsaoeGn55suKCBCpPPzSqYBsq/toCTjSOOjLs6JPvwCCbsUGp:P4q1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997949, "uuid": "34d0908a-90f0-41ad-84fe-8112cb9dd9af", "value": 239867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997949, "uuid": "85f6b57b-dd38-4b3c-bbfa-bed86dfcbdca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997949, "uuid": "4ef79a92-ab48-4ebd-b6d4-c63871efe989", "value": "Sprigs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f529fa-fb1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685033411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033411, "uuid": "c20df49f-9ee7-4514-b5e8-46a8a94efae9", "comment": "Malware payload", "value": "70e2098acfdc24f9812ce9abe9d5ba86", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033411, "uuid": "e51a8dd7-03d2-4e1b-bf13-ec17731f9276", "comment": "Malware payload", "value": "73bc302906aef2544f8508fea3b9fa2e0a148ee4466872ba9e74ef23978c80bb", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033411, "uuid": "1e2db51f-a480-4d5c-a8cb-474c29eb4b65", "comment": "Malware payload", "value": "a8d31bd54f70951b8dc61695d357f36d3fd23397", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033411, "uuid": "d2bfcb68-5f23-47cc-bf39-2397003e0218", "comment": "Malware payload", "value": "06fee3e7ba37fba6faff045863c43672a5cdbd4844a0d537b690ea4e9092e946929d05842d23100eeefd07b49d818e27", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685033411, "uuid": "bf0b8935-fd4f-4526-bfb0-ba2d5d8f58d4", "value": "T10803A5CE3F81F8309762A477AA4FE0E9ED1E6C51658841EEF625BC54F5E821DE233418", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685033411, "uuid": "157843eb-fecf-4680-9cb2-1d18e6e70a5d", "value": "768:Yn4dQJxwT4mBPKY7QZqDXSTKL0gskkYiDQBymAc7X7:YnbxAxBiSxDXEKL0//YymAu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685033411, "uuid": "a3b6e9dd-1fc2-44be-bda8-595f444c6338", "value": 41149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685033411, "uuid": "40ff6c69-fe76-40cd-9c52-cd99bed599a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685033411, "uuid": "a00eb914-268b-4f08-8903-0b20cfedcee4", "value": "1_IT0_05_25_2023_01_21314.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51802e0a-fb32-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685042905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042905, "uuid": "429d1091-3a40-41bb-bbcf-251d9e1bb30f", "comment": "Malware payload", "value": "7b6678a1c0000344f4faf975c0cfc43d", "object_relation": "md5", "Tag": [ { "name": "CosmicEnergy", "colour": "#B3EC67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042905, "uuid": "eac719b7-4ea2-4ed6-99ae-fd441f92fd32", "comment": "Malware payload", "value": "740e0d2fba550308344b2fb0e5ecfebdd09329bdcfaa909d3357ad4fe5552532", "object_relation": "sha256", "Tag": [ { "name": "CosmicEnergy", "colour": "#B3EC67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042905, "uuid": "3f6bcd47-605c-48b4-838e-55209c01876d", "comment": "Malware payload", "value": "6eceb78acd1066294d72fe86ed57bf43bc6de6eb", "object_relation": "sha1", "Tag": [ { "name": "CosmicEnergy", "colour": "#B3EC67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042905, "uuid": "7505293a-793b-4237-9927-e4ba033d1e31", "comment": "Malware payload", "value": "98944e15a298839a6dd89a9f6c9a9bc739452b80780a736aaf3bb75a48bf2c1647a818f4cd8bba5884830c600c1b8d6b", "object_relation": "sha3-384", "Tag": [ { "name": "CosmicEnergy", "colour": "#B3EC67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042905, "uuid": "fc7a36ff-13fa-473a-b6fa-d82ca9466a99", "value": "T17BD47E87F746ADB7D5025BB568F2032B932DD380931FD72F1D20AD3C5B162985BA324A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042905, "uuid": "dbd975b5-b236-4e6a-8c45-59bf372c5f91", "value": "c64a4f7de217c725ccdf4e851ef49b8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042905, "uuid": "cb162374-6489-4025-a592-53dde8cb276d", "value": "6144:8qWmZxqq8D8NTeP5D6O9df6h/1MWfWqEhmz3mW96BacA2y/iXWuNCTVto+Mid9:vW+zRaDl9AhqtHkLF0QSHGpTvDLd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685042905, "uuid": "bd5e3756-9d57-4715-9c55-126862e0e89f", "value": 607569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685042905, "uuid": "690b2d5f-1cd5-4ad2-8176-a1e5c7ade47e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042905, "uuid": "5d941253-3734-4551-90f9-541c36c2f83f", "value": "740e0d2fba550308344b2fb0e5ecfebdd09329bdcfaa909d3357ad4fe5552532", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecb3ee0-fac3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684995199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995199, "uuid": "3831f21f-2f9f-4932-8557-4c0dee967f32", "comment": "Malware payload (Formbook)", "value": "e71127f57d110a4ab4b766a4ed2bada3", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995199, "uuid": "ea0e4321-7d8a-4884-93d0-8afefac26ac1", "comment": "Malware payload (Formbook)", "value": "7417cbf823e1318517ba9b0f02ce10a5b75cd778cde237dc4e4f32f385521617", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995199, "uuid": "0dd2a11b-16e0-42f8-a03d-d8b3d2429549", "comment": "Malware payload (Formbook)", "value": "2d9baab03d9b20f831a8e87b54e28c94d7377ba0", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995199, "uuid": "c9403963-e346-4d80-b8eb-fcbe2bf8ef5d", "comment": "Malware payload (Formbook)", "value": "6c45a65c1d69a0c79de20a48464e65d45483ac89f6af8f9b0292026a482fe974a703273687ff4389ae6d18edaa7ac9b0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995199, "uuid": "956c7c9e-95dc-4455-a9eb-53014acee005", "value": "T1D8E4029862BEAF06D8BB53F404449278473E9C66B132F3471E93F1D61A58B445B82F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995199, "uuid": "7136bfa5-2821-464a-aa46-d7eec0807805", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995199, "uuid": "89644368-34b1-4dba-92b9-ae964fb03eb7", "value": "12288:H2N8jiZ4zypIPsxtPplTY6RhKuZh+ozNVZEbQYJ3X6Uam8fuGYL4z1Xf+iEwfdPE:H2N8jiZ4zypIPsxJTDEWhPh4L4z1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995199, "uuid": "c03207f5-01de-4e03-ac73-a63892bcdcda", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995199, "uuid": "ba3de8bd-2683-46c1-acf3-78fbe99fa5ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995199, "uuid": "4b981c22-aa4a-4a1e-8e8b-e68d70fb2fcb", "value": "DHL Original BL PL CI Copies.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "644c9da3-fafb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685019314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019314, "uuid": "7262de26-d502-4b9c-b0a0-ca197f724faf", "comment": "Malware payload (RemcosRAT)", "value": "716a372d8a0343c423732da5fa3a50c7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019314, "uuid": "3c3d7332-a1f0-407b-a823-da33e5f5b6ec", "comment": "Malware payload (RemcosRAT)", "value": "753ef6d7fa74308e69b73f7c17770ef4dc9995897c0076df011a24e0e1bc5d59", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019314, "uuid": "7f8b5112-655d-4445-9ac8-742ddaec1e37", "comment": "Malware payload (RemcosRAT)", "value": "13a7dda55e1b3bfc2bd65c620b5b83d7f6b65764", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019314, "uuid": "c64bad44-0473-4a16-a3a2-56a8b207e298", "comment": "Malware payload (RemcosRAT)", "value": "defe8d3b0ebbc8d4e07c6212d1c348780702c423211ba14ed3cc19bab4524570fa5097c4dea91ed337aa10607f8aa8e8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019314, "uuid": "92f0ab05-cf1a-43cb-a9a7-3657684eec80", "value": "T17375D00794549F87D11983F8BE233D981B0E7F1AB2C429DB355D3B4B6F31AA658CA24C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019314, "uuid": "6952beda-1efe-402b-b27b-e9b4f74792ab", "value": "49152:9LKjQmmQ30KQmmQ30wDp+MXW+MXDjT/lschqFBg8:xQpmQkKpmQkbEZEDj/hoBg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685019314, "uuid": "170d676c-76b0-4a39-9246-4ce977ea0c5a", "value": 1658880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685019314, "uuid": "74935e5e-c1b5-4a13-8f61-14951df21d67", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019314, "uuid": "9b389e82-74fc-41ff-bfee-d9a678b5b607", "value": "Modis list.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0bd537-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684999706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999706, "uuid": "aab2e4d3-ed11-4ca2-844a-74d7f236309d", "comment": "Malware payload (Formbook)", "value": "04e2bf8bad4d45271050d4e610f421f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999706, "uuid": "7776d63f-6837-4b34-b90e-548fe40c9d76", "comment": "Malware payload (Formbook)", "value": "76541f045182cd4f956ea38e70aac522dd8cc95bec94eb16ff435ac732da3b97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999706, "uuid": "915822aa-2ee8-4f61-915a-dd90a130c16b", "comment": "Malware payload (Formbook)", "value": "8b48651990fc7151f5cc9911f9fa4e18d6503297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999706, "uuid": "197c672b-a85d-4f7a-b262-845a54a62725", "comment": "Malware payload (Formbook)", "value": "63e7f988961783422b83e623c17e47588357a6c3e4253ce036893ec8508c6e3e0b3912cababffcf7bce4311911f1c0ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999706, "uuid": "1d04a46f-0e6b-43a2-98c1-9b0ebfa6a9ad", "value": "T18AD4232DAA56638AD8B74BF209114279833E5D46F833E3074D66F2DDCE66B052B11F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999706, "uuid": "4361d15e-a6d4-47bb-834e-b0786a0db608", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999706, "uuid": "6f83ab6a-8615-4b42-aae7-fb54ee6059be", "value": "12288:s2N8jiZ4zypIP0tPplTY6RhKuvW3kwi60jSa5lzAWTJMXmad93AHR2IhSbYiCROV:s2N8jiZ4zypIP0JTDE060+clzAsy1AxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999706, "uuid": "fcf2994a-0585-4a1d-b90b-8b87e5d7894e", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999706, "uuid": "ebc31452-5162-4b05-a203-ee8d7261eb22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999706, "uuid": "c99c28d7-7071-4c85-b5d7-a519992ef768", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae43e83-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003756, "uuid": "dec03123-00be-4392-8e06-38f5c2b6c168", "comment": "Malware payload (AgentTesla)", "value": "510410c48c720b4a41c069547c552c7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003756, "uuid": "486a5560-b476-43df-a74d-feb7fa151b40", "comment": "Malware payload (AgentTesla)", "value": "76ddeb0e4ca4680da43525457a82035c66b7150603b628c66d407421a55077e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003756, "uuid": "4c3e061f-6202-4161-b874-42a1e2337bdf", "comment": "Malware payload (AgentTesla)", "value": "0fb10e164477342f4dbb7eefb1bc3fc5efdbc5f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003756, "uuid": "deafc3db-7b3a-4b07-96e9-c2ab6e01b1c0", "comment": "Malware payload (AgentTesla)", "value": "446f5439a7e479e6b2d314953e08cf029abcd585cf63b4cf7d358187a535ce56c25ec34d153780543b73d8e77dbe7818", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003756, "uuid": "e3cf2bbe-78e4-467c-8f00-68888db78bfb", "value": "T17E05A53D09A58AEBD07FC3E49BCC4957FABCD837B655D96F28C603422241A4E61C219F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003756, "uuid": "f247b722-196b-46f6-b1bb-c1e22b7f8465", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003756, "uuid": "73072bf3-1de5-4658-aacc-fef419c96fee", "value": "12288:QHLhSljSM4cl+l2GfTbZ4e6zIURw537F5M3DPdy8J:QW14q+2GfTSNIU+FWLpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003756, "uuid": "ad332aed-496e-4e28-8cec-2f947bcac569", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003756, "uuid": "bf48b3a0-83f0-449e-8d8f-9a1f7634f13a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003756, "uuid": "305d3fe4-78a0-41e5-9bf3-375abbe9e4f1", "value": "shipping order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a64bc30-faf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685018465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018465, "uuid": "9efeb327-880f-4913-b9d7-7fbf6373bba6", "comment": "Malware payload (RedLineStealer)", "value": "081ad57920225bafe70210a8b86d76b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018465, "uuid": "b11af5ea-aa03-4c84-ad4e-5a2134da5c33", "comment": "Malware payload (RedLineStealer)", "value": "773809001679cb464145b2574114cde28af5e7f544c2b4b71c02ca112117c003", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018465, "uuid": "9b7fd2f8-7fdf-4394-ab40-98ee41d61cc6", "comment": "Malware payload (RedLineStealer)", "value": "00dd3aa13499bb42caf3a16cd7f6f67453c984a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018465, "uuid": "5475157b-fb2c-40c4-9d09-e50daaf7858b", "comment": "Malware payload (RedLineStealer)", "value": "b58885850fbe1da92fd2b5ec42d24e7d0de54bc9db97aef1d4da8a20ec42e74de5e596a6e698da0c11abf564eb9189cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018465, "uuid": "0283096f-8bc3-42be-9094-cb6e4bd877be", "value": "T1CF352361E7DC4072EEF41BF014FA03931F7A7DF19A64875B274A9A4D28726918433BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018465, "uuid": "783d956e-f184-45be-bc33-f4f1b5fd55a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018465, "uuid": "7d6d933f-5a59-4b8d-9500-b2d7ddb69cc6", "value": "24576:2yRwpBFLe8zwU6PfrtCBAQWuI1VCxMi00uf7C:FSpBE+KfBc7bK8Mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018465, "uuid": "ce6ac04b-a12a-49e6-bdff-41803d06ce8a", "value": 1072128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018465, "uuid": "30e1132f-1d4f-4e3c-8283-4e40fc60c3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018465, "uuid": "4d3fd3a8-d121-455f-a1d2-b511a43be476", "value": "081ad57920225bafe70210a8b86d76b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b07605-fa95-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684975526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975526, "uuid": "c5a0c964-13df-4973-ac19-12f61eba55e9", "comment": "Malware payload (RedLineStealer)", "value": "a7667cda0c19536b9903947efef9341c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975526, "uuid": "6face9dd-8dfb-4726-8573-b2e93934fb96", "comment": "Malware payload (RedLineStealer)", "value": "780b3a578a4af4848d0bbf94def3dc57b0180d5203d3c00ad97495be5f70ac44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975526, "uuid": "20967e2d-80da-45d5-ae8b-8950eb6e27fd", "comment": "Malware payload (RedLineStealer)", "value": "9c677425b0dba42f412d1d9ac60af616f91d3fb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975526, "uuid": "9432b4cb-b254-4871-ac71-77aec25c918d", "comment": "Malware payload (RedLineStealer)", "value": "8b694de9fc4aedf994db4ce2423159898def877ec84ef5102f25c18ba0e320755259cace9f3a795d67b09b89cbaccc31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975526, "uuid": "42f6285e-4bd4-4633-9816-d5fa38e234bd", "value": "T13E252382DBF480B2D9F217F068F607934B367CB5C8685B5F3789AA594C726D0A43172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975526, "uuid": "3761c586-403f-45d9-9a47-d5bde958ee70", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975526, "uuid": "b38b63e5-dd42-4699-afb8-9064fb1f9f5d", "value": "24576:oyn0YHTzsja59CTTG1ChzjL5F2kflCCttpkO:v0YHns+5WGMhzvukCatpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684975526, "uuid": "c7d870ae-6e96-48d3-a3e1-7db96d3eb04b", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684975526, "uuid": "808425fa-9ec2-4417-a454-d76484c8bfb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975526, "uuid": "1a14ea91-a0a8-4657-b3f5-9568a1ae5056", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7b0a41-fb11-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685028755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028755, "uuid": "64b9e2b1-9f8d-411c-b94b-ebf68e0c51a8", "comment": "Malware payload", "value": "0ad76700045c1ef4829347be25430c98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028755, "uuid": "b5fb6f0a-6841-47f6-a8d2-57bdc46ade2a", "comment": "Malware payload", "value": "78197822471b683e0732c3db00430d06a6533df416c9630adb4fcb70c94e1f0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028755, "uuid": "457b6a6d-b748-4d95-9dc4-e80522e0ec80", "comment": "Malware payload", "value": "65b6ec5fb90b11297039226366a8ea21aa834b46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028755, "uuid": "7e7e4fac-6e15-4f9f-913f-c059884b1ab6", "comment": "Malware payload", "value": "b0eb8dd226f211e78294e617bd6866d95ed973bdc3890fd54ef0fe2ad927c2f019c5285ec55ffd3dc50bcdd0778bc9e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028755, "uuid": "25f121b8-33d2-4401-ac7e-b169349c2b76", "value": "T13492CFF28127C261F84AA7368CB1CC84556C6C0DD0B7D64662C8CEAF7D8A254FCE65BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028755, "uuid": "4abc6b77-0c7d-4f70-83e3-aaf2dd85a0f5", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028755, "uuid": "6f67b961-e50e-4883-badf-8093487fa2d7", "value": "192:OAU3mdBKIgweaoROSEc+DasmN6Ic/loyvUWq3jx2UAOw4vGdeOxOkQ3D9SeZpVUc:OAU3SsOUOkEdRkxUkGNS3G5p2zOgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028755, "uuid": "f9deef68-0cda-4f87-8a55-0e54cacf6350", "value": 20229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028755, "uuid": "3de01f20-efd2-4dfe-aaa7-6fc95f91732f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028755, "uuid": "bce709c5-74e2-49a7-a5d2-d40d3f8c7fc0", "value": "SecuriteInfo.com.Trojan.Generic.6379214.4727.1313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8127fb43-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997888, "uuid": "e2805441-520e-4d05-94eb-17c2bbc7033e", "comment": "Malware payload", "value": "6c49f070891c49aeebd1ac4038ce5889", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997888, "uuid": "99914bfb-289e-466c-9bbf-de0717711741", "comment": "Malware payload", "value": "79119baa6c5a9729f0b7f9764b16ef962cb2bb7d85cfa5df7fbd3164e0106ec4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997888, "uuid": "18edc33c-5f71-4c29-b04a-8440af96ddb3", "comment": "Malware payload", "value": "251dbd4de18cc6e29fc8c45d69e1caac045951da", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997888, "uuid": "93c90f7b-3f9b-4b5f-9b45-776372d5d78e", "comment": "Malware payload", "value": "20acdd0ba31e3e96335a18d611b908f235dde3ca49a26eb7e7ad831ec80c28602e0d84b87345d2a8d6cad6a11b526677", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997888, "uuid": "2cdb2383-b193-45d9-9893-b059992bb590", "value": "T1E5745580475518B24B5B6E26A73094B5DBBE1E74C2C85A8FF46F7250FBDEA8CC8D1321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997888, "uuid": "0438f8ac-b3fa-4a3f-900d-599f5561a605", "value": "3072:qgoDYQSWu30r2HtDyZAofnR/TPAZqUmlWNaubsafE09E4PHirxs+d+rEfK9FeaeF:jnQSWJoyLfR/DAZqkNautwxZS98aeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997888, "uuid": "8599c75a-a46a-4e67-bdc5-b1cc3b3d59ab", "value": 346877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997888, "uuid": "66913b2e-00fd-41cc-aa34-9566209a431c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997888, "uuid": "f9c8c15e-8355-4d0e-91dc-6093bf3d6a07", "value": "ScrubgrassMyogr.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd52145-fb04-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685023222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685023222, "uuid": "1e9cd8b9-a8c1-46e5-bb96-8885dbc0882a", "comment": "Malware payload (Amadey)", "value": "982c4df8d104b4ffa3d4a714c7baf3ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685023222, "uuid": "ceeb5ea6-c0f6-42fe-8831-847be356994d", "comment": "Malware payload (Amadey)", "value": "792d7d64fc9fe208039f91e6dd9c3d5d23d49c25584af81ae88b803e22539eda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685023222, "uuid": "fe416ba0-49f9-42db-9102-9e553f229a1e", "comment": "Malware payload (Amadey)", "value": "fbb403c8b08987a5db0636d40d2c462cf3cd8a0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685023222, "uuid": "3d617f96-7085-4240-a6a0-04a4d130ca3e", "comment": "Malware payload (Amadey)", "value": "386d31912b3289dc9b78ffa3cf42c289c928c7065d0f800b87b3493c0d14b7f1035fc1b5fd3ff23bf3939a7070cf7d88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685023222, "uuid": "853f7fe0-b8d6-4edb-8c44-a1f6de07f25f", "value": "T18735221BB7E44077D5F627B05AF702930A3E3DA099B8479A3F016B6E0861EC4693476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685023222, "uuid": "972bfdad-24c2-4c86-95d7-a0de142243e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685023222, "uuid": "1b01be82-92b9-4850-9ab6-ddd316e7be15", "value": "24576:6ymzHez2PRjgzsL+1o8L442FQvkqDIXjJAXPo3u6CU0+Ao0qf44m:Bmz5F6sKoQvkpVmQ3ul73s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685023222, "uuid": "f0ed2e17-8888-4325-8940-a8c40df30710", "value": 1070592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685023222, "uuid": "c6b8a7c1-27d4-4e5b-a08f-2f3724b543dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685023222, "uuid": "eab6bdcc-8532-4b7d-814d-f48efa6c1527", "value": "982c4df8d104b4ffa3d4a714c7baf3ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc00c605-faf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685018602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018602, "uuid": "87df9739-8b02-41b4-b576-055f3b32a5a0", "comment": "Malware payload", "value": "9f5ea8055dbc6602043f53b45e535f4f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018602, "uuid": "c12b201e-0839-4823-852a-9929725ffe04", "comment": "Malware payload", "value": "792e5408c786a313af18184c7129f1b367f9e629105eef42d48dcb92eb45d1ea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018602, "uuid": "d776a859-56b4-402b-8113-e34a16fbe6b5", "comment": "Malware payload", "value": "f318c9d7d4ba669ea49d9c7555fc17a3b3f58009", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018602, "uuid": "9761a5f9-bfd4-43a3-96df-b0188ddef238", "comment": "Malware payload", "value": "6b335966ea1072433abd809b0ada24b68540ee606c28d9d2523cb73b8b5d5bd8fceac6ab7e9898f96cdedd867ee1c252", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018602, "uuid": "bf81c71a-97bc-4ddb-91e1-ce71bd801312", "value": "T1A914B7804B6524724B577E2A6B3094A6DABE0E7182CD5A8BF45F7260F7DE6CCCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018602, "uuid": "86365bd2-4659-49a7-a733-d99c44008963", "value": "3072:TwE2r4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:TlzDqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018602, "uuid": "e01ed5b3-27a9-44ff-b139-caa285608301", "value": 206311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018602, "uuid": "6cdf9124-e7bb-495a-a814-c302536446c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018602, "uuid": "293902bb-424a-430f-b610-52f508e892f5", "value": "Hkjgcae.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5f2bb0-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997772, "uuid": "ba01a835-ab37-4a78-bf35-c78d401c75b1", "comment": "Malware payload", "value": "9c5770a310b8776628b83523a76a5769", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997772, "uuid": "88460e2c-12af-4cf4-a4fd-97aefe3d6a31", "comment": "Malware payload", "value": "79426f268c54065d53fc4dbfca61837113f013934d0a02e7d5105733e79284e6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997772, "uuid": "941baf1e-ce93-46e6-af8e-71d0d2424e76", "comment": "Malware payload", "value": "441c10a2c6de5e5311878c8297ea0cf0054c5bf1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997772, "uuid": "910eb344-fd59-406f-af2b-c5a9f8a99866", "comment": "Malware payload", "value": "746015dc3985d9a64a58e39fcba06714ca379702c21eb82abe085954b58a0717b2c6f425b687f5b85802d9003e94b0f1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997772, "uuid": "4838bd3a-6787-4fa6-8d97-1f8bc59b1bde", "value": "T1095454844B5524B68B5B7E226730A4A5EBBD1E70D2C8568BF45F3250FBDEA8CCCC1721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997772, "uuid": "cc6574b1-0254-4e2f-8373-1cbb70f7f13d", "value": "6144:KOk0G+61XSitvXkTvqqAjlxUD5YKBfl7Ly:KKcb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997772, "uuid": "2cc5f2f1-73aa-4a5e-b40b-cb661e10119e", "value": 294068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997772, "uuid": "87c6bf29-cae5-458a-8eaf-ed1fba2801e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997772, "uuid": "42cc6fda-9916-4f6a-84db-fc465321fb94", "value": "Pretyranny.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530ee07d-fb1e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685034317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685034317, "uuid": "56e739af-c7e5-4586-8c9b-4b19e7cc9a0a", "comment": "Malware payload (RedLineStealer)", "value": "6776981cc7b2c93b27631d7369426eb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685034317, "uuid": "56186e6e-aace-4653-8034-01dca461b866", "comment": "Malware payload (RedLineStealer)", "value": "7956680e9aad7b46e62433e2c1cf52e81524daf0eab3aab7d59c5f5643b92284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685034317, "uuid": "284e2be8-cc24-41fa-8428-6d5a773d1198", "comment": "Malware payload (RedLineStealer)", "value": "47723d7975384344d3adabbc69c7ce3906d4bcbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685034317, "uuid": "f49165ab-86e6-4f6a-80b0-452486ab98f8", "comment": "Malware payload (RedLineStealer)", "value": "7c9dd754387f9aa6aca074e08c168615fe981ef052e73b017e69c1750698f30c53f3ec8b944ecdd76dcb24df44ce668d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685034317, "uuid": "dc00ecb3-0f62-46e4-9b87-24526edbcee8", "value": "T117F4125266C89273E8B52BF44DF217930B35FCA398B983A726456A5B08732D4E53433F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685034317, "uuid": "17a207a9-6916-48dd-8a35-41d31958ada0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685034317, "uuid": "2d9d012e-7fa2-4980-be8f-b0fbfabb57f6", "value": "12288:6Mrey90GPGAjYUbcj8M01qpCqOFSnulDgViqfL6TWo00pgS+fkavfsjWSEuH0Cd:YynGkbcXpC0ulDgZiHlpf+sSsjxH0Cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685034317, "uuid": "c65cd96f-acaf-43f6-9e11-c6f299606c3a", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685034317, "uuid": "558d8d7f-ce78-4625-b1c3-95dc8b649cb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685034317, "uuid": "00aad267-e6f2-47d7-a8a3-8be84527fa74", "value": "6776981cc7b2c93b27631d7369426eb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc40a085-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684995007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995007, "uuid": "a24329c1-b181-42f4-939f-4cfc63b7f2e2", "comment": "Malware payload (RedLineStealer)", "value": "8cc2749b78923f11e35c539e30d04e0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995007, "uuid": "1a2f5bcf-3115-47f9-9a96-383250155bab", "comment": "Malware payload (RedLineStealer)", "value": "79d2f93269453b71768984d7f1e4c17d9a3b7d935a92d97f8804280fcb2582fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995007, "uuid": "9522dfc1-3198-4e27-aab4-5459fc4dda48", "comment": "Malware payload (RedLineStealer)", "value": "93defc5f70c996758fac624260d1f3bd1b7299a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995007, "uuid": "b21c3e00-2aa2-409f-8929-90fd688e45b6", "comment": "Malware payload (RedLineStealer)", "value": "1d80db60633d9e67da11fdcd0a7f5ce0a544e283f27a347b9bb8c0e17d594ead3cbcc985e977520a1d2c54b73ec82a7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995007, "uuid": "e51e31d9-cadd-4de4-86ad-45161b709001", "value": "T13064CE217691C032E196A9315971C7B54B3BFCF29BA15ACB37943A3E4E317C18A78B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995007, "uuid": "ff470b0b-1f4e-4e69-a929-4f56a16a1654", "value": "761a416c92dda0b5d3a5091999204e5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995007, "uuid": "d1f9a7dd-487b-4ab4-853c-858b1dda164f", "value": "6144:ZGsHjm7Pus1vIIyCIJqVGOWoo5ugD1Fe0x40:ZZmDuSvIWqqVG75jd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995007, "uuid": "1ba87f46-e224-41b0-a115-82c061a66013", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995007, "uuid": "5d37c5e4-cb1a-4b61-91fb-9b6b03f37e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995007, "uuid": "1880de80-cfbf-40fb-8683-f7a525271dc3", "value": "8cc2749b78923f11e35c539e30d04e0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d35748b-fadf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685007142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685007142, "uuid": "521b24d7-950e-4aff-a83f-fa6ede1cf168", "comment": "Malware payload (GCleaner)", "value": "04dce8156d5dc12c1f0bfafbd54bdf27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685007142, "uuid": "16ab095f-d466-4576-b355-9f963b09bffa", "comment": "Malware payload (GCleaner)", "value": "7a2fff49016b637ad9c189b6cca86f90ed1e96a76dec9aeaa27a9427eacfc0d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685007142, "uuid": "4c0b632f-8ffc-41c9-a93b-4db652200809", "comment": "Malware payload (GCleaner)", "value": "d0d5a63b7fcd222a90394a86dbec5bfc147dbcf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685007142, "uuid": "a47058b0-2a3d-4e0d-bb80-38ee4184cb0a", "comment": "Malware payload (GCleaner)", "value": "8edc90702d27bad3a7c5024c33880a8e0afb346a268808d583da20147696e07c2bc478fc7c5abd949f22fd399d325e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685007142, "uuid": "926312af-862c-408d-ab83-0600d4fb4631", "value": "T11CA533F7F296C832D2F2C7751C895AEA99533A276822A1C877745DEF8F272528C11307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685007142, "uuid": "c1babdc5-31fb-4c83-ad30-6b2f1ef10429", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685007142, "uuid": "dad0128a-a861-4f55-9785-042693653875", "value": "49152:6iFhfRzSC4zOVn+V3TYq4a6nuqGPuN/pucdu/3s8wua:6izfT4qrqAXrlduU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685007142, "uuid": "2fc4e659-e1b9-4e47-b22f-3173f08c0600", "value": 2167941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685007142, "uuid": "4a04443e-b293-4121-8682-bfa0c86e0dbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685007142, "uuid": "c770defe-c2b2-4aa9-8203-d584af73137e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6a940c-fae3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685009023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009023, "uuid": "ca18adf0-366d-4329-8b52-b18597dad0c6", "comment": "Malware payload (AgentTesla)", "value": "da2f64043cecb69c61f6dd1c1ad97203", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009023, "uuid": "9d1d4c98-2c35-4176-a824-3bdd1a1b630a", "comment": "Malware payload (AgentTesla)", "value": "7b4f4bb85d378df87ec73afe52a197d70aa69924ee29635bb22275778ac765a2", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009023, "uuid": "8772f08e-500d-470a-aba8-44cd10caaab8", "comment": "Malware payload (AgentTesla)", "value": "bdf931c8f89100a2d5b28b046ec595bf06166caf", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009023, "uuid": "4ce312f7-6747-4a3b-a01b-e0235e12fd75", "comment": "Malware payload (AgentTesla)", "value": "d440d2528fd8336fd4c3b93c6bdb2e4c3339c40d311303c90a6c6a0290941cd67ba9634009ffb8c5678ef2d311a9cba3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009023, "uuid": "ddc918bf-b3a1-452c-af5a-63a4c576732e", "value": "T189D43338ADF9704C6D5D1F380A1DDBE629D4B04AA1C0B273D493AADF58531667B0CBB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009023, "uuid": "560db90e-2086-4b54-ab56-a6023a7feeca", "value": "12288:+O97swkGrhagDIP4ztrYin4vOwvWYd3lgB1OZXiE6xtBfNWlL4:dnkOhxcIrPAZd3lgrnttW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685009023, "uuid": "f99e4714-5a91-4b83-a8b9-4a2e0a543905", "value": 623129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685009023, "uuid": "1cfffd18-8465-4014-b6f1-93b82ff3764d", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009023, "uuid": "2430d875-806e-4b0a-9b4a-7b45b95ae43a", "value": "PO451033200_1.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee5a496-fafa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685018875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018875, "uuid": "16ba8f31-951f-4c45-8b19-5251443d1418", "comment": "Malware payload", "value": "3e740819f52e361b586ceecb778ca1e2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018875, "uuid": "ec61a539-673e-469d-935b-5495c84b751e", "comment": "Malware payload", "value": "7be210604d9eed1889c6d1d32caf913c02757a2e80c9cf0301e5a19ae64a5823", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018875, "uuid": "a717f043-7078-4025-888b-f7e5258537e6", "comment": "Malware payload", "value": "ebf7fb20660bfb690c92f94a5133fd60ce9a3550", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018875, "uuid": "07c10f63-1a2a-48aa-a911-6f096a8a6238", "comment": "Malware payload", "value": "9825d163eeda1ad43b4f3b44da857c387d8d137ea6077ba7eec7f193726bd9356d1321ff2e6f0e273206c4ff7c8eafb0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018875, "uuid": "cd9faee9-9f14-4571-bb48-a770fec859a6", "value": "T1C614B7804B6524724B577E2A6B3094A6DBBE0E7482CD5A8BF45F7260F7DE68CCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018875, "uuid": "844dab31-4177-4c14-86b1-658bdfc8f843", "value": "3072:+eplmTQbKunr4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:LA0EDqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018875, "uuid": "539d39a8-297c-45de-9540-d6d0c12ae7ea", "value": 208877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018875, "uuid": "0acc22b3-a311-4944-9c51-3e5e80ca4526", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018875, "uuid": "a2cd4e70-281a-43f4-9fde-ade217d8d2ec", "value": "Dnunw.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4bf64f-faea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685011865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011865, "uuid": "03f936bb-ff22-4b0a-a562-c650199cac26", "comment": "Malware payload (Formbook)", "value": "804b6dd6fd511e782e84ccd44f3911fd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011865, "uuid": "24d3d80a-9446-46a0-b3b8-b16bd01089ef", "comment": "Malware payload (Formbook)", "value": "7c2f8999d0fa499714b0bc838b03c197a5d09bd3c2df296cec2f254c4e3184a4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011865, "uuid": "d3d1f449-0725-4733-863c-ea89b1e2f8ad", "comment": "Malware payload (Formbook)", "value": "beebe347f5ff6a34341cdd66b047aaf2838ac506", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011865, "uuid": "a95dc678-453c-4f61-8598-1e94ab9145f0", "comment": "Malware payload (Formbook)", "value": "cede6624e7d9d513154fd1a9301c3427600d5300f4c55c746584b59d92adfa89c49c8946934d9adb54d4c3e87d36ef29", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011865, "uuid": "5e7de35b-a542-4931-854f-384bde6c60c4", "value": "T14014AF32D641C070E2B251B5B6BD177B883D0E347695A0EAE3E616E16EE09A5F03D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011865, "uuid": "9e7b6f50-f9b7-4f29-9fac-49dd484f04ad", "value": "3072:cowhoXkTZBHyfi3B1zekdRwrCEAkf6xLRG9D509SKPDY:UHmUBZekLwrCEA7xLEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685011865, "uuid": "ec2b31d0-d6be-48d1-a6f2-9fb2b4646348", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685011865, "uuid": "447fd119-4c36-471a-a5de-e67eb4690573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011865, "uuid": "d5982249-478f-4864-8d5c-68f0b32796c1", "value": "001996499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce741c0d-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998017, "uuid": "64a72011-a234-475d-b968-44943b95fd86", "comment": "Malware payload", "value": "959132bc020f9a2f3ad98532b511ec8a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998017, "uuid": "6c85e964-ab8f-401f-846e-901c0eb8db9f", "comment": "Malware payload", "value": "7c409a00cf0f4ad01a5056929dbf552dda2a55f62435ae5ac2cfc453f109e991", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998017, "uuid": "a1d5157a-9a2b-480b-8bff-d941c8b65749", "comment": "Malware payload", "value": "7de893bd3a05839ae3fe445b3600900c27e1382a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998017, "uuid": "51d962af-02fb-4998-8d96-e198fd24bc0b", "comment": "Malware payload", "value": "ee8f3d6c94b1677b3d8dbf61d216dbd4bdab0dda2b78282b6f1eada1fc954714657b3035ae4cecffde4c2eb96cfc0a90", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998017, "uuid": "dd3e680a-41e0-41ef-86b9-f7f201f8ffc5", "value": "T1D754A780471528A24B5B6F26A73094B9EBBE1E78C2C8558FF45F7251FBDF98CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998017, "uuid": "73e709fa-85e6-4d74-868d-00034fda3aca", "value": "3072:0KGatAv3xjy4aYc73glC+xtDVIISRy2dPq4O0DCeuy7w3LlF:hMxjy30lBrD0HmeuQcLlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998017, "uuid": "dff1d3b3-98ce-426c-8544-5883fd192e30", "value": 283317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998017, "uuid": "1213a83a-a16d-4f21-9879-7c7102b92c5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998017, "uuid": "4d6ef8ec-15cf-488e-be73-6d6a5a123627", "value": "Trachycarpous.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee353c91-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996782, "uuid": "6c7756f7-3a06-4e2d-b81b-fb28822167d2", "comment": "Malware payload", "value": "b5f5cc99b6351b619daf74d5da251246", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996782, "uuid": "24ef74d4-581a-439f-bda8-7319df468036", "comment": "Malware payload", "value": "7c731a5e77b037b0afa4e2908f2613bfc09d7cf6ca810f0b7487408b7ba7be4f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996782, "uuid": "2646de44-e023-4d21-8bce-d33bafa269a6", "comment": "Malware payload", "value": "86f2c4df1b8347943b99ee6fd92f5a00353c4ee7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996782, "uuid": "7ff506e9-0c4a-4f1e-89fd-cfec09b8953a", "comment": "Malware payload", "value": "93de0cd25f5081fe14f5afc653ac14d4ca105326734a51bc02b11901fd1cf5bbfbf9180ef25aa11ca6becb39f9e4e573", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996782, "uuid": "74eaa69f-bed9-43ee-9b6e-3e56ebea5fe9", "value": "T1866466844B1128B64B5B7E226730A4A5EBBD1E74C2C8568BF45F3261FBDF98CCCD1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996782, "uuid": "8539a278-3250-4583-bea1-8085aa389e40", "value": "6144:GR5uWIQBv4/Cae4OCgrhhIwsaqBqaxjfCM8wMBCUl6gSwBrJgWkGc4johKwhKSj1:8AqxhYnakwBtvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996782, "uuid": "e12d29fa-ab37-4fe2-ba8b-fd68e675024f", "value": 335431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996782, "uuid": "ef5dc650-7568-41b0-8111-2f8f1f55de12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996782, "uuid": "0a0f7336-069e-4c50-8f51-298541027600", "value": "havergrass.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971c4943-faee-11ed-b3cf-42010a9c0076", "comment": "Malware payload (MimiKatz)", "timestamp": 1685013816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685013816, "uuid": "3dd53d17-541e-4c03-acb0-e5d725e41ef3", "comment": "Malware payload (MimiKatz)", "value": "db34ce686d2b911589667cbcae3a920c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685013816, "uuid": "8b05c581-05c0-4474-8401-195f2a992d9a", "comment": "Malware payload (MimiKatz)", "value": "7d7ca44d27aed4a2dc5ddb60f45e5ab8f2e00d5b57afb7c34c4e14abb78718d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685013816, "uuid": "f7ae7bf7-9c82-4829-be98-2fc9ce0fad94", "comment": "Malware payload (MimiKatz)", "value": "052c8587aed8dbd775f179f670e822da4d2a1eb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685013816, "uuid": "c325c315-76e4-429c-857a-8a14d5c2d16c", "comment": "Malware payload (MimiKatz)", "value": "2184e213c2e4eb7b298bb80a85c4c9e19866ffe9624215429840723a6516052b6f8f586291bccc11846451ab407a93e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685013816, "uuid": "fee46306-7aa0-4e59-8173-2eab19c46731", "value": "T11CC412146F7020F8C199473654F61A32E771FD063679526F9348028A1FF6B845F6ABF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685013816, "uuid": "a7d48def-2845-4027-ad4e-362af495b0ce", "value": "e02d9571d7c7b402bc895567492e8392", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685013816, "uuid": "7d209d46-03e1-4d7f-b7b5-a391bb51af13", "value": "12288:rQPxmNKeQjoluIuMBOo7Y7YgUGB51pFWWcRQIBtq1P/vZyvsoDG:UMlH87Y121XWrVBs1P0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685013816, "uuid": "b556b5ec-ec74-4d97-9ff4-6a78c19b18ce", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685013816, "uuid": "e2da3d81-b01f-496e-bfef-c24dc14681de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685013816, "uuid": "ee4ab5d4-8e0d-46d1-a85d-369f3df9536b", "value": "7d7ca44d27aed4a2dc5ddb60f45e5ab8f2e00d5b57afb7c34c4e14abb78718d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd92bf6-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685003707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003707, "uuid": "d87987cc-1939-4545-8a09-eda99bd885ca", "comment": "Malware payload (Formbook)", "value": "d1f94ede2c3acb6e6b434cd2eb4c01d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003707, "uuid": "a9fe8a69-91bc-4b58-af64-28ff1cf9e428", "comment": "Malware payload (Formbook)", "value": "7e730ca7f92fd178c170d14422fbd34ea085e602dc22597d4aec331df1d55d0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003707, "uuid": "9060f616-74b3-4476-a92f-50de11d5419f", "comment": "Malware payload (Formbook)", "value": "c564a70ca54a98b7e296c94593845f4aa72dbb03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003707, "uuid": "069a2295-d160-43ed-9653-c80541c4ce52", "comment": "Malware payload (Formbook)", "value": "00bccf728dbcd16ca3c141b3cef60a254a037840786bc0a1e2de0727ad57e01adc471baeb59afb96b4a53888e3facb39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003707, "uuid": "0c1b01b0-4dbf-4b7e-a81c-d7ebc151fd3f", "value": "T13C4402E42FB8D523D561897149378B266EB49C361068834F4B94B92EBDF27C2990F337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003707, "uuid": "42787860-e52c-4397-b5f8-c949a41ec74d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003707, "uuid": "c6e59524-f5f0-4b8b-a171-9ab82ab4689d", "value": "6144:wYa6E0/puzGxv28q18NbYLs2Br33jOJlDYCu7cHI:wYq0JZ28w8BTlkD7co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003707, "uuid": "9a12365d-06c0-4e96-bd7e-95bdc4f22131", "value": 269943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003707, "uuid": "ecf973bb-5265-4382-9578-c4a7f4d6f53d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003707, "uuid": "e67fd193-3736-4044-a9f9-3b0dc3abc69b", "value": "Current SOA 17..05.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf485d0f-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999710, "uuid": "e298e5d7-3e19-40f0-b435-e24a03a2b983", "comment": "Malware payload", "value": "d4030d03a7c72a58f9e91b02f6808c5b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999710, "uuid": "71bd8182-9e82-4977-828c-10f8ea63984c", "comment": "Malware payload", "value": "7ee533f42d432a824b67878460dc397a463408080985a65f10b2278097a2c059", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999710, "uuid": "4086fe78-42a1-45b8-bbc1-c17517910946", "comment": "Malware payload", "value": "5d330153af47716940e68e29589e9ee2cf8a905a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999710, "uuid": "3a3da533-0fe3-4c6a-b139-89afa2041d54", "comment": "Malware payload", "value": "920c37e91a6be5727d9698ac95bf71008b6d25bed6258f3c2a0429e43701a78e37986d594a22cb9f10bf7307d78ff42f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999710, "uuid": "430c26d1-569a-4480-950f-467c5754d192", "value": "T16D6464804B5514B24B9B6E26663094B5EB7E1E7582CC5A8BF45F3260FBDEACCC8D1331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999710, "uuid": "44978f3e-a808-4497-83a9-edab39e7e606", "value": "3072:6E6lXgX7R38U8vKWcWEZVtZGFtYvlAf7WgbqRUDYVRAwFK2fL1:OwF3ivKWgZ7ZOMuf6gbIwmRAkpfL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999710, "uuid": "88539f53-aeac-466e-81ba-aa059b81a992", "value": 314138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999710, "uuid": "d8a28eeb-6c83-4b19-a942-52cfe7548a78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999710, "uuid": "6849af5f-f275-412a-84a0-c0a59f91cfb0", "value": "galvanisedPolya.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44010fa7-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994778, "uuid": "9d8976fb-7a33-4240-bac8-977641b283aa", "comment": "Malware payload (Quakbot)", "value": "d22badbf20fd9d2a2e908a1fccbf0d2c", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994778, "uuid": "7f74608f-478c-4ddc-b5af-f8611db73857", "comment": "Malware payload (Quakbot)", "value": "7fa481aa73ea128cc7e89e56b966d9706727a73f37b55e64597ab9f3a2d4bb63", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994778, "uuid": "4909c790-577e-4beb-af5c-073fd685cd53", "comment": "Malware payload (Quakbot)", "value": "e3477903e8e9e571f677eecbb680347042cb84e0", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994778, "uuid": "dd8457c7-a287-4342-a2f8-38ee5504cb1a", "comment": "Malware payload (Quakbot)", "value": "01bec65247f0685d8b69e0d08dbd89640c4dce19e61a0b15f7018d7287b4cdac314c4868dd9ef4d7870d6a743d7dfa2b", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994778, "uuid": "885adad9-8931-412c-8e1b-250aa12dd476", "value": "T1E5631A5BA3450339552201185A0F5BD6B7B488787A15DB68B88EC3AD3342DB8C7FF9EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994778, "uuid": "80ccf84e-4ecc-4fa9-a404-a5b59f8eab3f", "value": "1536:3JwLkwiv9j/tQlcTK30mvg0Zop9ZQvMRolDCZ8YbNbQ/TC:3JwYwaj/tQ+TYueopfQURolDCZHbNbQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994778, "uuid": "2fc4dfd9-6738-427f-974d-69f9d04771ac", "value": 67971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994778, "uuid": "4e06aedf-ea66-49b1-bc41-6c70d1fe9628", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994778, "uuid": "315eccfc-45b4-42a2-b8cf-03a69722402d", "value": "Claim_D816.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6378b3-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684999415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999415, "uuid": "c9ca1ce4-b52e-4172-a0be-fb5987a1b7df", "comment": "Malware payload (Formbook)", "value": "8edc42a2925f2e7b89017920bba0692b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999415, "uuid": "1700970c-63a4-4b44-aa5f-d3e08a5c332e", "comment": "Malware payload (Formbook)", "value": "7fa868c908374d9a48101bf8ed26b2f2c762773594106f176bd4ca279a91932c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999415, "uuid": "b403ac3e-9399-4e2c-a320-cc7ff2179df6", "comment": "Malware payload (Formbook)", "value": "a62493a29bbf11eb89f0c5e88941b4589d6be344", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999415, "uuid": "718425d3-52c6-4e84-9179-424992ceb7f8", "comment": "Malware payload (Formbook)", "value": "8955294098c448f55029485ab136cd1e9a2b13e02f63346e8dbbcb4f40ac0d85f139c25dbea0d0cd9667ad7078199729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999415, "uuid": "1136ab5a-f409-447f-ae95-318a4b1adbfa", "value": "T1CDE401407A6CEC67C4AACBF805185274533A5AA2B962F3CB5DF6B5CB59C6BC103C48C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999415, "uuid": "1d100573-fd00-4c73-a605-9259b278b1da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999415, "uuid": "5d8fb312-9fe7-4917-9460-62dc7d2ea35c", "value": "12288:RWVtPplTY6RhKuM7FKIIUnRhxUHzbuMD/6XONXSW4blGZxdtQYDoF6:cVJTDEP73nRhxUvXDPNXSWmlOtQYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999415, "uuid": "dda8c84b-74d6-4a1b-a06f-a39b896f100c", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999415, "uuid": "3f4e5570-13a9-40c9-a66a-0074f07e286a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999415, "uuid": "a5343fba-bf97-4894-9c52-f61756706c97", "value": "PROFORMA INVOICE PI160256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ed2072-fb08-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685024736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685024736, "uuid": "34fbd98c-253c-4a5e-be3a-afdff8da976c", "comment": "Malware payload", "value": "3a4f304ef54261049aacc4ff4935362d", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685024736, "uuid": "185d2a73-236b-498d-9346-07a46bc2ac2a", "comment": "Malware payload", "value": "7fd59738f8f4f8bbf0f56ce5346ecb03dafc9ed3434c0cd23ab0c5d45d7ab6a6", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685024736, "uuid": "0510f02e-728a-4086-b439-2bbfa1aa5769", "comment": "Malware payload", "value": "66974f6f4014121e4aa8bcdd144d1fa9b9c6bc86", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685024736, "uuid": "7d8d3326-ef70-42cd-a915-7d2da97bb6b6", "comment": "Malware payload", "value": "e7a9f563ef43f1f6b697190e2bea497db76181eb94ade19ba4efff9b904a04c1f50730bb4ddf9a4b028a8772c95858de", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685024736, "uuid": "c5f898ff-d574-41d6-a945-3fbd57e745df", "value": "T1EA33E179E7460928E8CBD71694693B5C18FDB21A4ACC6442715D8F834BC0C18FF9EAD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685024736, "uuid": "c2516ef2-5d68-409a-aa78-52504516fbb3", "value": "1536:XaUrKMhRpwWnBh3NkiRUwqt++BiC1mvAyfrEs:F/hRe2h3No+WmvAoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685024736, "uuid": "f8a215b6-1402-4b55-aaca-f22bbd9ed2fc", "value": 50134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685024736, "uuid": "de4828a8-29b9-461b-a38c-1472af015ca8", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685024736, "uuid": "2992bda9-dcb0-42d6-94cc-7dd31dfddd21", "value": "comunicazione1.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e8b0cb-fafc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685019766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019766, "uuid": "4aecd16f-dfca-4871-9ee9-7cc6b23e2bc1", "comment": "Malware payload (AgentTesla)", "value": "f483998d4a4b658f1cb999c8a98cb563", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019766, "uuid": "6db9a456-a47b-4ead-8647-9966716d4c82", "comment": "Malware payload (AgentTesla)", "value": "8005c1f11765b2f062b741afe29c062901a5603959d8334ca14421a3426d7526", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019766, "uuid": "849ae12b-c05a-439e-ab88-fbc00fc663b7", "comment": "Malware payload (AgentTesla)", "value": "d1f71afd4297729d2877ff37acccea5c61fc33f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019766, "uuid": "603498d1-5951-417e-87a1-336ca65d354e", "comment": "Malware payload (AgentTesla)", "value": "2234e0b4339a5431f45040f325d50e4e9e951d9fdfbc0175f085c023fa799e90edacf4bafe5a32e8c08a4d41203d4038", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019766, "uuid": "609c1ba3-0054-4972-8555-52a6ea0826b4", "value": "T1E6E41290362C7F56C87AC7FD84303A7093FAB86B3173E35A2CD3A1D662A6F1145119A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019766, "uuid": "60b7c314-c7ce-4740-8c03-8e455c470fe1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019766, "uuid": "e52f9e1c-c6e6-42ea-a0e2-426d492ba28b", "value": "12288:lW0mzZBEP85D91Fx69tccdIAZto2TkCob/7w6PPlEpE7:M9BEP8J9XrHAZtMConw63r7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685019766, "uuid": "b9f5e5ca-7dfe-40b0-8c8f-4b3ac18acd51", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685019766, "uuid": "53556e4a-26b6-469b-92c7-7b634f715305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019766, "uuid": "562f62a3-7c99-41bf-8d2a-986aa37b904e", "value": "9CNELGT7BK7qyUE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e3448b-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999718, "uuid": "f65f3ea7-99c9-454b-b028-50e756bfe1e5", "comment": "Malware payload", "value": "58e67008368c9e2758dde0757b491e5a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999718, "uuid": "632c9d39-70e7-4da3-8c06-3bf9c129ae61", "comment": "Malware payload", "value": "80ccd1438d129ee1c7239f49188ee46bcbb873c4d21fd7031d4f465be2a949a4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999718, "uuid": "800d296f-ad89-4cf4-9d2f-1772b8236929", "comment": "Malware payload", "value": "1786d68a55e00ab8510df4bd0684e504f203af72", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999718, "uuid": "6aaeaf7e-aac6-43c7-9f3e-0f3cf8049eed", "comment": "Malware payload", "value": "24aa3879bffb0ebd6a1bcc4d745b974655830d9e78531726c308dcdb1b1ee55457d6a3ca20ae9999197976307db61a09", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999718, "uuid": "313292d7-a32f-4dff-86f2-12e3fcaf024a", "value": "T1C454CB84471129A64B4B7F32B720A4B9EBAE1EB5C2D0468BF45F3261FBDF94CC8D1521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999718, "uuid": "0f8003d2-89d5-47ca-94cb-38f41e6a0559", "value": "3072:pvOzKPxtOhoPgwFPnkvc75j6E2AUcufJ6Xwu7MAcB7wm1yws2LavV4i:pvR5QegCPkvc1j6xlcuf9vyV4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999718, "uuid": "7468c0e5-9102-42c1-a8a4-6c315b88d5b3", "value": 296082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999718, "uuid": "d5252334-354e-4231-bf24-ae660c9c51e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999718, "uuid": "3abb8753-e6a1-4bb3-9299-0c8df3b27865", "value": "hardyheadIrrita.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f98016a-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996596, "uuid": "16bba649-6fe6-4c36-8bc9-bb763a6c9ed1", "comment": "Malware payload (Quakbot)", "value": "9b28ad9c47215e3881a903d90d08ef13", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996596, "uuid": "5c3f7276-45bb-46ae-85f8-74de3fcbca13", "comment": "Malware payload (Quakbot)", "value": "81c67e3762fc626e9225a09a9ddaf89494661ca5530c4073d03d2344c5ac39c0", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996596, "uuid": "17e0548e-92ea-453f-8eff-1cc7790d539c", "comment": "Malware payload (Quakbot)", "value": "fc3ac08415454822dbe1d80d40166b0a51cd89aa", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996596, "uuid": "3ce51a87-1c5f-4269-b301-d4819560c549", "comment": "Malware payload (Quakbot)", "value": "b4eef52e039683e3fb3d1db7132877e60a4463e3868ecf2f6c2e58893444120147ef5b1ecd945c4d0a57bc55c31b4087", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996596, "uuid": "73d29f86-79f5-4807-b280-5095ad8cbf18", "value": "T11783185FA380133CA5214225654E22E4F7A149387732DB78A84EC3AE3321D79D6BE5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996596, "uuid": "f3cae4cc-de7e-410c-b4f5-699414c77a99", "value": "1536:ajBvlM7xBMaB/+ZFyTmxcjPShI5/+b3I5KZOVqtQlzzTW9:StM/v2ZA3F/+U5KZO4tQ1zK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996596, "uuid": "b4b165a6-3c2d-4751-93df-692d108c3f3f", "value": 82318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996596, "uuid": "5d9c93d3-bc9a-44c4-8672-cb34db126d60", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996596, "uuid": "20a75c61-6450-4aac-9886-56a1c172ee10", "value": "Claim_A594.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b52850-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997845, "uuid": "10bf5005-70f7-43ca-ba67-bfea70b7450b", "comment": "Malware payload", "value": "1e17a08e152326cb918bb90a86ad1d46", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997845, "uuid": "d938aa70-e4c7-4597-a656-ee0e0e54b15f", "comment": "Malware payload", "value": "823c53482d27c390d4011578e22fe58527dede200613a6d9e70878d4866fb05f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997845, "uuid": "d73d52f1-4ef3-40ee-b296-cf80fc9a9eef", "comment": "Malware payload", "value": "e936c39e68a384761458fe2b6f4ea0eafbe3833f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997845, "uuid": "14a5e3c7-edfe-4552-ad3e-2c19b16dc46e", "comment": "Malware payload", "value": "cb2f4021e204eea7e7d4ca97b6d544f9a6885cc6fef97e36d364189845bfe0a5dcc0f08b8bb4024bc6f3c9c81f7fb29d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997845, "uuid": "1d4a8b99-a93f-424f-838b-66253fb4b30b", "value": "T164649680471128B64B5B7F26A730A4A1EBBE1E74C2D4568BF46F3251FBDF98CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997845, "uuid": "52ebab9e-ad3c-4271-b997-e90bf468d0d9", "value": "6144:dtZWDKALDzzZ4lefZPf2riWfGuZ74FGkvRJ9+NB:BvX/PidwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997845, "uuid": "f4050bac-f63b-470e-9780-a08cb468b9b8", "value": 327933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997845, "uuid": "15e83669-5c3f-4f61-8026-3bda9189528b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997845, "uuid": "414e280b-ebb5-487a-81ec-6dbaa3877606", "value": "Retread.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5640dde4-fafe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1685020579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020579, "uuid": "e59dda3f-7656-414c-8b41-a99bfc73aee7", "comment": "Malware payload (IcedID)", "value": "a86b0aa800113b3f5b3202bbaad07c4d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020579, "uuid": "7f29a25b-b17d-42c1-a1c8-c00e3eb1b5fb", "comment": "Malware payload (IcedID)", "value": "846dab665df0dd1febc5244482b955bf39dc92b80cee4561e0747b3d3c88a12c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020579, "uuid": "b48cf1b7-3c12-488f-b6f1-575cbe80ae33", "comment": "Malware payload (IcedID)", "value": "7bc51b83dc97da81261257c27cdecbcd1fbbb495", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020579, "uuid": "74b43f5d-8567-44a7-9e91-f3647dd1c329", "comment": "Malware payload (IcedID)", "value": "f5576b33e278b9737470f8f8e104e1699b0bad43737419f2e9f58b48ca91ac054373ad8a23300024b9e7667d19920534", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020579, "uuid": "93b6a2f1-67fb-4a4e-b138-741584ea96ad", "value": "T16AD37D4BAF1BDCB7CC024731A9E643080337E6611BC66B0F2D258D794A577B4EF8A685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020579, "uuid": "8514206e-2e63-43b8-806b-cc46fcc3996d", "value": "c0db22558d1245a720459dbfc128cdf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020579, "uuid": "4086bd99-592f-4d2c-a445-6e899174bedb", "value": "1536:b3V4MpcYHJq25LuuDzCLNgLU18+NzeNbwnApqzPO3I12TMe4vaMzPzUKUvMWHnTv:Z4Mrq25aGzsZYNgG4kj4va2UiPJT/Vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020579, "uuid": "6e362c04-555e-46d1-b70a-3cb86ec80cd3", "value": 131680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020579, "uuid": "f0b34635-0ad2-45a0-8af2-50e565fe3ad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020579, "uuid": "4b8789e1-0114-456c-ac25-8fe476d160fe", "value": "05387199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ecc044-faf8-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685017953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017953, "uuid": "a30b77d0-76c7-442f-9494-d5a6e52c0c40", "comment": "Malware payload", "value": "3dd829fb27353622eff34be1eabb8f18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017953, "uuid": "f7a0ec73-d05c-483a-85d0-8ca0d8f7c532", "comment": "Malware payload", "value": "8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017953, "uuid": "ca6318b8-603a-4de7-a945-c5ae05547201", "comment": "Malware payload", "value": "22c9da04847c26188226c3a345e2126ef00aa19e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017953, "uuid": "77cead44-740d-40ad-b385-c220c6c765c7", "comment": "Malware payload", "value": "8b7c7e79e59d90d04f92744f9bea5580b43e68c7f5dd7982f328083028fb0f62a6d3fecd447c1490d1deec844b13e849", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017953, "uuid": "ced2ab5b-7472-46e6-8e61-b60ee056141a", "value": "T16E45BFFD61983348C01F4D345133AE0AB2F5551E46D984AABDEBBEC06FAF411EA15F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017953, "uuid": "bebb544d-564c-4419-9c7a-5234e6da28bf", "value": "65ccc2c578a984c31880b6c5e65257d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017953, "uuid": "372ffe52-f34a-4d9c-8aa8-9038bf8592de", "value": "24576:f7qw+pdSSxflhy0rypmL+tM4qT3wdsIedwopg+cKJTNQq0zSaYJDoJG3UaVAH62f:f7H+pdzjF2pm6tMNqMpgCJTuq+SvJDop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685017953, "uuid": "21927957-9ba5-4c3b-a556-10981833e8f3", "value": 1187384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685017953, "uuid": "a154bebf-406b-4e3e-8590-7267f95da31d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017953, "uuid": "ea14f54e-0d36-4fcf-a33a-e175e936818f", "value": "8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a88a5d-faf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685018586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018586, "uuid": "93d8a237-4a20-4af1-adf4-bd0521d7eae0", "comment": "Malware payload (Quakbot)", "value": "d5450a71c48f8ff148f3440e125ae7dc", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018586, "uuid": "ca6c7513-e992-456e-9f35-991a1f81fa56", "comment": "Malware payload (Quakbot)", "value": "859dab460382b4b7a805a3a6b32e198b92d1ae3e18c22934fd8deeefe52a5d74", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018586, "uuid": "1d68b04b-602e-41d8-a190-86ef575c8f2b", "comment": "Malware payload (Quakbot)", "value": "512b6fb461d575df7f4e1f2f1114c6ad195d2e7b", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018586, "uuid": "3401893a-b829-4d16-960e-9891a85ca423", "comment": "Malware payload (Quakbot)", "value": "87c03f5cadefb595d1abe90b9cb6f7048dfe29c3e9af5ea049844ad6c1f1b815677ef12eb8ac64b09483fa17ac504f9d", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018586, "uuid": "94fd7357-182a-4391-962f-adee40318af5", "value": "T1BB630B5FA38113387A214136244F5AD5F7920938BA72DB78A85EC7293321D39D5BE2FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018586, "uuid": "eb832ccd-d74c-4633-a99b-9bfde2f665e5", "value": "1536:IaBFZc8npNU8nVP+R2mrPk59sKK2xFMLfxv0:TjHQVH2Yfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018586, "uuid": "079bd8b0-dc94-4173-a714-583510b7b9a3", "value": 68502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018586, "uuid": "a4a3fdc7-b611-4bba-867f-72e9ca9def4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018586, "uuid": "e9b193eb-694e-47c2-aeca-9e6d0294c288", "value": "Claim_C039.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef981aa5-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998073, "uuid": "88b6fe55-7d33-48dd-ae16-533d0869596d", "comment": "Malware payload", "value": "b9d5a3c6cd5860dd0bd4f1e78ee76a55", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998073, "uuid": "f1ff9698-8d60-471e-9218-0b42dcf9312d", "comment": "Malware payload", "value": "865ef5bfd52ebfac4b8dc4094caa6a1b64b25211359d98c371fb432984e2a5a6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998073, "uuid": "249c857d-306d-46f7-8b3a-b9a9e3672a05", "comment": "Malware payload", "value": "325383c5e3681d273d622674ac6fc9fe5e627ec7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998073, "uuid": "0a17bd73-dcc9-4f61-a9bb-8cd873a1882a", "comment": "Malware payload", "value": "8f369568d386dcc80fb9318a5eaec7abf2ecac3a77e4047b9033525ecaf4f0bc0447ed40dda6eb027bbf12c72d7dfca3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998073, "uuid": "5c18cdf3-c76d-48bf-8ef3-c175319a1f7a", "value": "T1C9648780471529B24B5B6F36A73054B5EBBE0E79C2C8598BF46F7250FBDE98CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998073, "uuid": "bea17124-c186-40fc-b125-62fd66dd8ce0", "value": "3072:RoCsunbVkYtoOf1R/5acYJv5OYatTlJGSQndb1o8Qp0GS5u2ZfAjKq:RoCsYtoOtB5aciaplJGSQp8p0J5u2ZIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998073, "uuid": "e5bfbaec-aef6-4312-a8c0-0de1bce798be", "value": 317778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998073, "uuid": "306dfed3-b5b3-4bd2-84b6-d3266bc37f90", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998073, "uuid": "33e852a3-f2ef-4a62-9b53-cb63534525ce", "value": "Unbiased.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d9c546-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997892, "uuid": "19fc0358-d7f7-44a0-b07c-7f4378d6821a", "comment": "Malware payload", "value": "007f867263db5dc16f238ef7268b8425", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997892, "uuid": "143f8a28-4d59-46ca-a80f-f85b8a863675", "comment": "Malware payload", "value": "8682736d898627c2b0337fddefae482307186da50e025bac3cec297a639e619d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997892, "uuid": "769fdc6c-c292-4209-9c4d-75489d5cc7d3", "comment": "Malware payload", "value": "f7aba63e24fa33722a2445d50413cb5bfd072398", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997892, "uuid": "9d5fc1ea-3c8e-4769-9852-8f7c50dfc065", "comment": "Malware payload", "value": "ca723c4e6a25ded22e63e62e82bf34c2694414c32b6278b52527e911417be0d9c09c6678120399ae285f79c7a33c2bee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997892, "uuid": "5d3e8004-53eb-46f6-bf94-6455815ac0c3", "value": "T1FB5488844B2129A68B5B7E327720A4B5EBAE1E74C2D0468BF45F3261FBDF94CCCD1521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997892, "uuid": "55689ff7-75d5-4a5d-8e15-415b207751e8", "value": "3072:54A0xxNBZu/QAfpJflfjl7N9JdG5VE/p2l2nhJlJ0BE4g:5LoxNBZyQAhJf53Lik2l6hXJ0q4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997892, "uuid": "b5b401eb-43fe-41bc-acb5-6785c44fd8d4", "value": 287830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997892, "uuid": "a28dde98-88fa-4428-84eb-92c04f71ca47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997892, "uuid": "a055aff5-aa62-4406-9a7d-94df52e0b8a0", "value": "SecuritanKingsi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a40a1e3-fb11-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685028746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028746, "uuid": "18a33f9c-6712-411a-9fd7-c9ba55dae468", "comment": "Malware payload", "value": "491b72ce80b8c99d044d8a077b853616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028746, "uuid": "1215a757-fdeb-4982-9bae-f23d3c53475a", "comment": "Malware payload", "value": "8685d354c551261d36d207ddc6dae473826a45b293e00244403a252f1d6059e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028746, "uuid": "826ace7a-9ab7-4680-893b-ced9235aaafd", "comment": "Malware payload", "value": "c1a76be5661be81b6fd255aafcbf06b1a074cad1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028746, "uuid": "146b3f9a-071c-4e2d-b23e-3e267e33cb52", "comment": "Malware payload", "value": "fbed3d320797cec2fd187178c263a36e5cb2858e3b40eacd123aba298e9e07e0102722ce05ee7b405cfd63e9a9d7441e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028746, "uuid": "7efd9020-b5e1-45db-895b-1af826bfcea6", "value": "T16D036D7617E6D4E3DA5010F1C306529FDABB63A031B3BDCA9D50ECE05DA8534483D62E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028746, "uuid": "b45756aa-8bde-46be-b40a-7c73bac12475", "value": "96:nPvruCtimr49AKTaZh5HFloWGa1EwpDCxRjoSjTHmqEIyBrmPsWWA:nbuCtr49AKTaZpdGcEwpux6tIyByW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028746, "uuid": "04ca52cd-2c50-4e7c-81f5-2a16f239ac3b", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028746, "uuid": "a9648a7a-993a-4033-ac06-0ccf843f818a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028746, "uuid": "3c968b45-83af-4ff7-8b95-81027f673674", "value": "SecuriteInfo.com.Win32.Dumaru.AA@mm.15070.6629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b596d7-faf2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685015350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015350, "uuid": "5e2ac31a-696b-4d28-abba-e89c9cc95190", "comment": "Malware payload (RedLineStealer)", "value": "88d421f15fa0fee7022c56d3fa81d231", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015350, "uuid": "8c6c2929-6122-43fe-8178-bf4df740b5b6", "comment": "Malware payload (RedLineStealer)", "value": "868ab65788336aa2e91e5b440d3356f3d693315e8d9a878263541ab36c757f23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015350, "uuid": "8a6a10f7-ff2f-4edc-a6c8-8aa62422a8d1", "comment": "Malware payload (RedLineStealer)", "value": "8e5635cc52cfe7aa5905f27389a287484d611c93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015350, "uuid": "e2eff507-96e8-476f-bf3b-4e750d9b1687", "comment": "Malware payload (RedLineStealer)", "value": "e9206ed5c549aee7133f9dbf384bf241bde96f800e06474b21565bedfdd671e6555097a1d7c5dc35a62c1fff0372cf5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015350, "uuid": "3c86d2ca-c018-4bf6-a123-b3fc88fae017", "value": "T11E35232EFBD84572F8B11BF069FA03970935BD915838C36B6791CE951CB2AC661B1323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015350, "uuid": "3d256c88-3a34-4e5d-8c02-4198cd313cba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015350, "uuid": "1be903b4-4c23-46cd-9bb5-5081c0cfb713", "value": "24576:6yTnyZF1a5eCwHKGnI8WNAdL8TROc0MfeGeMV:BTyZF1a5bYrYNORM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685015350, "uuid": "091b49dc-2d73-4ec2-91da-9a1c0a225ced", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685015350, "uuid": "d2721114-196c-4463-b0ad-603370f458b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015350, "uuid": "48fb6f3c-a788-4009-b846-9af8ac75a6fd", "value": "88d421f15fa0fee7022c56d3fa81d231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7136154-fab4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684988985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988985, "uuid": "d6c63508-970f-44ea-8ea9-838fb2bd7a70", "comment": "Malware payload (RemcosRAT)", "value": "4bbbad7edcd5cd1e3e8b298236a94ebb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988985, "uuid": "324c2c5c-4848-4aa0-a31c-e5ebd5f76edd", "comment": "Malware payload (RemcosRAT)", "value": "87216060e8612f76a973916a50c96b8066c2891b3d19e779cbe122019e48157a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988985, "uuid": "8f5472d0-34e5-4e06-a091-dd5e9baad87f", "comment": "Malware payload (RemcosRAT)", "value": "9729563a21f53d8f3dcf5948d43fd4450406c50f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988985, "uuid": "accf52a4-5522-40f9-a62b-9fdd7ec9a92b", "comment": "Malware payload (RemcosRAT)", "value": "d0a3fc75b90be4b411631e2d72b7b65c92cf407c3d144450e6dfde272ecc6358f959c6430389fe54761124fcc2c455c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988985, "uuid": "bc83fa64-39b3-4f48-90d0-85f3d10301b5", "value": "T10016DF3702D7FCFAE7E22975C9023B542CC468F7931E5298FE5500BB2DB4458AA9C8B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988985, "uuid": "792f1e82-e9f6-4b56-ba81-e9826ac4819a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988985, "uuid": "3e55472a-4f13-4cca-96bf-274d6a753b5a", "value": "49152:XzMzjIaffWVT5mi/P/kzA0hmzGKNV4s59rq:Jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684988985, "uuid": "5f52a0d1-18e9-4258-92af-549d3765b674", "value": 4030464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684988985, "uuid": "27c726de-6adf-46d9-a635-5fa70ec6099f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988985, "uuid": "d764c172-d4cd-49a0-b458-f406318ce4ba", "value": "4bbbad7edcd5cd1e3e8b298236a94ebb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a1e5a9-faf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685018595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018595, "uuid": "8cd03ffc-fa14-47c8-a0b1-7c3ea1de6226", "comment": "Malware payload", "value": "2b76a8d86d8bca2ae2ffaa82c6ee4d48", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018595, "uuid": "c878fb1f-dd4a-4990-bc8a-754909b4d081", "comment": "Malware payload", "value": "87ff27cb9021fa0c81497bf465f30100006baad60dbb5fae7cbd4e5989dc636c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018595, "uuid": "c58f2815-8c4e-4cd6-9e30-bba8eef41a5c", "comment": "Malware payload", "value": "ae3018c3f91f9739d139975e00b54799850baab0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018595, "uuid": "7df6ad85-4f3a-4303-a014-9f75eb5aa245", "comment": "Malware payload", "value": "74fa66f02d840689bb34acbedcfedc74214edb28c7d8acdd0c7292dbca25e70422086019fc027f6327c48592f1e62039", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018595, "uuid": "52c155ab-7a97-4263-b58d-43edbfe9ead8", "value": "T18824C8804B6514724B577E2A6B30A4A6DBBE0E7482CD5A8BF45F7260F7DE68CCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018595, "uuid": "be077148-808a-444a-972b-55e2bbbc4436", "value": "3072:CTs88Pr4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:C4HMDqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018595, "uuid": "2066e751-909b-41c5-a1e9-1452fe7e97cb", "value": 211517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018595, "uuid": "e3983d58-295c-4317-8330-52474574874e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018595, "uuid": "07d4f7f8-60a9-482a-94ae-84f0babcdd6c", "value": "Eazkr.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cafbe8-fab2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684987809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684987809, "uuid": "63365dc8-87fe-456b-bf5d-db7a1d00900c", "comment": "Malware payload (Loki)", "value": "7447094bb2e9b833a84f37fd9025e1c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684987809, "uuid": "48a3d378-647b-4b71-b392-3e56d7827494", "comment": "Malware payload (Loki)", "value": "8864cda7dd32332bc079f798ade7ffb9f999b658ae8a49df2cad97ee1ed6cbcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684987809, "uuid": "7c01f62c-c0a6-46ed-b9fb-e3e76dc2f1f7", "comment": "Malware payload (Loki)", "value": "f743a43b599f4ba09cce6e9addc7caea2a2c39f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684987809, "uuid": "9abd7fd5-feb0-4412-8018-b8147e383b11", "comment": "Malware payload (Loki)", "value": "bca79074359a3bef368b91e93af23548605fbbbadd788dbc4a0b1287bb2e0106c62e93d0e120c5c3604f63144d213552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684987809, "uuid": "a6e7f83e-8246-4511-99f6-e1777b136d5f", "value": "T1C2946C4123FC4245E6BE97FE84B805128FB9BD22A43ED71E859560DD1CB2BE1C887727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684987809, "uuid": "6c0f768f-a9e8-40c6-8dbf-f149d35aa417", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684987809, "uuid": "6fb02d06-0884-4464-92d3-2c6c9c7adc5f", "value": "6144:uXOEVLlSo+r4ZF0LaOy/D1ZlsHflKSpOtGV4elYeHS+guYAoqo8M6PEnEG/:klS0rBn+KS8JelY1+eAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684987809, "uuid": "6db3427a-95d8-4f5f-9a1a-095e51c0c38d", "value": 447488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684987809, "uuid": "1baecb37-fecd-4110-ad73-8012f6201d60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684987809, "uuid": "f5c46ef6-a1f3-41a0-b735-0188247323aa", "value": "SC521097IOP3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c302d71-fafb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685019193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019193, "uuid": "97691b4e-662b-4728-918d-bca41c8702af", "comment": "Malware payload (RemcosRAT)", "value": "8a4b25fad86c1369e690eb37b68300d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019193, "uuid": "e5a4c9a4-fb4b-4050-9ea8-1880d8824b0b", "comment": "Malware payload (RemcosRAT)", "value": "88c915fc9b19666779df6aa7bf4be92a7bc293ba9a00269ae1e83f2605a54f50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019193, "uuid": "e1832629-f0a9-4c98-9f4b-ca2c1932085e", "comment": "Malware payload (RemcosRAT)", "value": "6c547762edae1d2e6cbb856a987b5fdf8604da6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019193, "uuid": "45fc0406-0aa7-4447-b24e-c14bc749a143", "comment": "Malware payload (RemcosRAT)", "value": "5bd1ef9ee7c063c895ca8e74e9c1b794d1ffd73022fc65c82f71563569c3a3ccc8f46e9f14424a5feb0443d4e2bdfe21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019193, "uuid": "d6be2b97-a094-4f42-be17-5db32a24dbca", "value": "T12D25229536786F92C6FEC7F48434307453FBB9AAB472E3450DC7A4C722A6F825402A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019193, "uuid": "faca1ff7-343c-475f-b652-4e25360527f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019193, "uuid": "94bb55d8-3561-41db-8689-51c5f61ada24", "value": "24576:F9BEP88Xlp3mYUwfiEF3cBMPR8jJOg7B9:DBe8mlp9Uwqa3cBumpB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685019193, "uuid": "35bd9e85-56d3-4182-a8b3-c2f74be5a0ac", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685019193, "uuid": "da3dc38c-cebb-495f-a553-3203c60c059a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019193, "uuid": "f03e1eef-1c10-474a-89d2-e5422d617726", "value": "PO 543-35017173 - 07.58.14.509.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206096ed-fafe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685020489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020489, "uuid": "11f98fed-57d5-46c9-ba5f-cf5bd91cac0d", "comment": "Malware payload (Gozi)", "value": "29882a5867707b532b99a19df982de58", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020489, "uuid": "28503bc9-0b1f-49f4-9321-5f02741e3664", "comment": "Malware payload (Gozi)", "value": "88eb87f67aefe33b394ba0eb9f50177b9feade449c5960a972a771bdde985f0f", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020489, "uuid": "d529354c-4ad6-45a1-a866-34f979ac0ac1", "comment": "Malware payload (Gozi)", "value": "411dbca8616af404bb7899fab1f2f03c00dd6798", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020489, "uuid": "06224dab-97e5-4e24-b29b-0a2080223799", "comment": "Malware payload (Gozi)", "value": "e7b7a6a7d9e34905db6019a772a30c7bb983a9e3667dd9601d5d5cd66ddc04e8867fc8092db633148083f96a3388fe6f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020489, "uuid": "e6334623-e24b-4a92-960b-d792abe307dc", "value": "T19323D06EA2F9A44DC08619B6D86534828A4CF336BED014D238ED4CDF9B04C68DE676E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020489, "uuid": "98e4f375-2e0e-4f72-9013-87111f300b06", "value": "768:doTv18zXUbOQDr1tl83MLrNXZ6B6vySz+2HSvjxn3prfQGnhfD5xq3HMLsrP8NkP:dorh1tl5HRABZS62HSjtlScL3kP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020489, "uuid": "5bcd23b6-0244-4ff0-a7e1-4c42f456dd34", "value": 47273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020489, "uuid": "e27dd26a-4606-4aa7-8463-219560c3948c", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020489, "uuid": "88f7681a-226f-4c4b-87d1-24eb6ffd54de", "value": "comunicazione(1)(1).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d32a0e-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003695, "uuid": "88e299f6-4a2e-4875-866d-bcef459bb398", "comment": "Malware payload (AgentTesla)", "value": "98b016c3c7fad0532505dd0bcad40fd1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003695, "uuid": "367e61ec-dfbc-4f79-8c96-eba86f55f1d5", "comment": "Malware payload (AgentTesla)", "value": "88f9b8e7a6bed0659b87c3b48f41122f2c1dc4ffd276e88ff468c2b08513ee15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003695, "uuid": "713de49f-0887-459d-b833-538bae297c15", "comment": "Malware payload (AgentTesla)", "value": "1a964de2843021d03760a4ceb1824987788dd5e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003695, "uuid": "f512ef0f-0757-4ff9-8e67-dfd2f932e066", "comment": "Malware payload (AgentTesla)", "value": "eac1493c294bab60df67fc29b5ae036c400949209ea716102d1d90fcddc12595922bb8a8c36138642e0430cf9714d8e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003695, "uuid": "da557237-7e02-4bb2-8ed0-34d72693a36d", "value": "T127F3186862994D11DF3E4074C7B111080AB2A377966BE75D0DB1ACFA3B1E383F73A865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003695, "uuid": "b026c4ea-6d27-43a3-9745-3f7a5d776a79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003695, "uuid": "a01da8b8-17bf-4931-ab1a-c6f21e25bdf0", "value": "3072:XTA19eF9k57xuOVjeonQZp3Pv5stdzabzi/8uwoukjs7Bk:0LeM57xuOVaoQZNitNo2/8mukAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003695, "uuid": "03f79193-2c2a-4284-81d4-72be64587ac8", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003695, "uuid": "a8b80c07-15ec-4cdc-b54d-8d5716972718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003695, "uuid": "936607a4-a7d3-44ca-a4e6-134ccaee0c16", "value": "88f9b8e7a6bed0659b87c3b48f41122f2c1dc4ffd276e88ff468c2b08513ee15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd6666f-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996892, "uuid": "00aaf676-513b-4eb2-a33b-ee988dcbce1e", "comment": "Malware payload", "value": "1c62f3f210f16104a672353d09ad96ac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996892, "uuid": "3bb825cd-1d95-49cd-820c-9f27ce427f3f", "comment": "Malware payload", "value": "89e5b8fa2d2fe3db8588f209853aa593a4afdd9441370db1736969e472d8549f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996892, "uuid": "7faadd40-b0dd-4bfe-8353-b9f16c7d4ccd", "comment": "Malware payload", "value": "b5f1c08e131612e4126d96e1d4e9937e2a47b44a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996892, "uuid": "d18b6905-4c97-480c-b1f9-9a9f541b50d2", "comment": "Malware payload", "value": "f1f843d65b7b2b888ed511cd6ba848720a1e9e7674f9f4ac44fc5a911257223e46361d3ef15b7f22fcb3f44859877a46", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996892, "uuid": "a84aa59a-9e8c-4793-8dad-f4fceec5464d", "value": "T1215464844B1124B64B5B7E267730A4A5EBBE1E74C2C8568BF45F3260FBDE98CC8D1631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996892, "uuid": "8d6a5dee-eb30-4c9a-926a-a09434e51a04", "value": "6144:0VWb+Rp4WwvyBJQ5dd3SS3a6URW28olW4ajQ1U:YWCDkok4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996892, "uuid": "ee23a11e-94b0-4715-86dd-90164efbd127", "value": 293562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996892, "uuid": "e6f6c555-4e42-4a84-9341-77e5d29f6f3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996892, "uuid": "d2bc7d87-1a04-4b4e-8763-619b6df7f9ac", "value": "interplait.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4390d2b5-fb25-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685037298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685037298, "uuid": "fdc2d6cd-0310-4f3e-ac75-f82db36a3b04", "comment": "Malware payload", "value": "874d88dae0610f6bb5af09ff1372fa8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685037298, "uuid": "cbba1f43-c945-43f3-98c0-070c3467eee0", "comment": "Malware payload", "value": "8af32f3ea4635d8b35ae555aeb954d087acbf0225580d8bf929adc7426fe8932", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685037298, "uuid": "f6f96d2f-8dfd-4de0-90e6-acf40f667bbc", "comment": "Malware payload", "value": "d225a8cfa472089f6b63edbd4d6d0174eb043429", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685037298, "uuid": "270ec52a-0d56-4b21-9b81-bf5ec87d0921", "comment": "Malware payload", "value": "422a3db6474fd5a13aa69c04ba42b125567552a005cabc99f424d862b4b5584f5f977bfd013143f3fe87e5a8648950cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685037298, "uuid": "2e500131-89e1-484e-8e39-8ca36fb4ebf6", "value": "T12DF42213AAC44031ECB46B7048F623D34B35BEE5CF3407630B55ABAA5971AE8953277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685037298, "uuid": "a90bd504-009e-4041-81be-0be22b7cf612", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685037298, "uuid": "734e0f9c-1690-42c0-84b0-97cf45f0e7da", "value": "12288:DMrDy90Z1AHfCvx2cBxxX6NvcQ0r2riIsCHcLEvkggS+fKavRsjWjEJUk:ky7HfCp2I3KNk52r18mkgf+ymsjbUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685037298, "uuid": "9c66cc35-aab5-43d0-9b17-465240bd73db", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685037298, "uuid": "b6609e33-eeed-4fd9-9281-b6f6b819d079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685037298, "uuid": "72e2fcae-fe47-4c52-9764-a6dfc1fca4da", "value": "874d88dae0610f6bb5af09ff1372fa8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b7b23b-fb56-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685058434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685058434, "uuid": "63a9cb5f-6488-42a0-ae31-699b495d52a4", "comment": "Malware payload", "value": "113c60fb98c614a5fcc6569e93a155ee", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "cookie-stealer", "colour": "#312B5D", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "skyrage", "colour": "#744553", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685058434, "uuid": "8b42d31a-f55d-4db1-8603-6e08bdb16df8", "comment": "Malware payload", "value": "8b62ea1481392a33e391f9c723ba1f85841ae112d3412a8b0e92a5993c97a34d", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "cookie-stealer", "colour": "#312B5D", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "skyrage", "colour": "#744553", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685058434, "uuid": "660038cc-9223-40fe-88cc-0d667a88cc93", "comment": "Malware payload", "value": "0ecc3c227ff402bde5135387d04b38e6367283e7", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "cookie-stealer", "colour": "#312B5D", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "skyrage", "colour": "#744553", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685058434, "uuid": "18b0a234-7a74-41e7-9e8a-ec8f028f22e5", "comment": "Malware payload", "value": "0d399a1cd8ca1ecd72ab92596291a47e25970218bd7ec3b0928e0fdb2ec930cb8aa54ef94095a562917f84ca2ac2caa9", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "cookie-stealer", "colour": "#312B5D", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "skyrage", "colour": "#744553", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685058434, "uuid": "095847d6-914d-405d-8b10-263e91167696", "value": "T168C3F1FF3D44C26AE05FA53A05918427B53808DCDCD5941706B6B94B04A7FCA1B53BEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685058434, "uuid": "d41b9859-9cf9-4814-9343-e4c63879b211", "value": "3072:sSqEeWJa/sRXQHpTRuEZLtIBXcxxA6/MAbviT6EWy:JFf4EdQnuE9tIxcxK6UAjdEWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685058434, "uuid": "6efceeb7-9423-429e-9786-19480ce86803", "value": 125362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685058434, "uuid": "88101396-9039-477f-8288-60db2fd35f1b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685058434, "uuid": "4b0e3218-e0e5-48a2-aca5-35e86656e403", "value": "mvd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc3b514-fb18-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685031810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031810, "uuid": "963523bb-8f8d-4d91-9b31-dc4f2a70536f", "comment": "Malware payload (Formbook)", "value": "6991d190933968b416189fe78bbb2d8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031810, "uuid": "23299190-79a0-4e88-a850-442d283221cc", "comment": "Malware payload (Formbook)", "value": "8b9641ea4b07a7e2e48a7be9f45a20b7c0663838d5430c90b452729843f4ea21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031810, "uuid": "d0142ae8-2b7d-40af-8c0f-b351ee9b78e3", "comment": "Malware payload (Formbook)", "value": "046a63283cf4eb75656bb4f4c99413fbd0f86e3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031810, "uuid": "c2b47e42-1d90-452d-bf71-6907977f3d7b", "comment": "Malware payload (Formbook)", "value": "2c169870b0445f654efcd66476ca02d91e63c77f062552a8729d9b66c135b09c2edf006517f52711246fc3367cf62a71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031810, "uuid": "5da31bdb-b1df-47a5-aec5-85b48a5f28f6", "value": "T101F4024437F96B56E67E87F9293055B447BAA9ED3079F30A0CC3B0EA5661F004A80F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031810, "uuid": "5eb764e0-5a06-4ca3-a7f0-178f5418b0c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031810, "uuid": "0d317a64-7f43-40d6-aad5-5f241276bfb3", "value": "12288:9uzZBEP85trggY+9nmp35FVk9V7Sm3Ucu3eL8Xt1O6ctdWv0bO0lGbw:Q9BEP8wgYOcw313UcuuIXtNc+v0b7oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685031810, "uuid": "9280f4fb-85c8-48da-9fff-1d67ea6b8769", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685031810, "uuid": "f25321d3-0edb-4ee2-8f64-0390530b4d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031810, "uuid": "c2ba0f7c-9db7-4841-acf7-ab4326635f89", "value": "602QN20427-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c55aa1-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996801, "uuid": "956d9842-4893-4101-9f98-4067a0d31b9d", "comment": "Malware payload", "value": "18e3b119954a8eba98d0ca899cbd5750", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996801, "uuid": "7877b707-b9bd-4275-8cd1-87dfc428e652", "comment": "Malware payload", "value": "8c0238088db34c08159347ff98e73bbd05d8fc06502c64f23cfc45ebd5925a62", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996801, "uuid": "02bb4a4d-a830-4486-a034-45418caa94e5", "comment": "Malware payload", "value": "98b652725b8587b2d7b6d2dfb99fdf79ecfa11f4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996801, "uuid": "cbda6cbd-9aeb-4094-97a2-b12d99385f4c", "comment": "Malware payload", "value": "4b4823da503435e8d1d9bebcb52877bce282892ab57137d1d60fcf7f2d9b69967fc1d5796e5453715b3ea91384d8a448", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996801, "uuid": "e6246557-bf25-432a-acb3-f9d8cc687c80", "value": "T19E64A680471528A24B5B2F36A73054B1EBBE1EB9C2D4598FF46FB251FBDE54CC8D1222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996801, "uuid": "006e2e81-1b20-4e1c-a47e-da02d0f9a4cf", "value": "6144:a+BjKEsRRjxm4nZsRucYF9AtvC3RJoCWG/ROlak57OAC9/5:a+0Rjznq+oOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996801, "uuid": "a9759957-2425-4364-a162-397cbe4cd289", "value": 311905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996801, "uuid": "32c569c8-c954-4b32-9b32-4308ea9aad2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996801, "uuid": "19578855-c7d2-4ded-8f30-bf535fd0b920", "value": "hyperdelicious.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd584c7-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996704, "uuid": "cc96662b-d762-491f-9e90-f000e67d5d45", "comment": "Malware payload (Quakbot)", "value": "baaed506a50cb98a5b052c337ed9f78b", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996704, "uuid": "474592f0-bb1f-4f0b-85ad-587533f56b57", "comment": "Malware payload (Quakbot)", "value": "8ce99e647fa4bcf5601da794613717a869d84a62b94038bf78e9aa9043e729fb", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996704, "uuid": "fff3802d-831e-4a25-ba7b-592679d83121", "comment": "Malware payload (Quakbot)", "value": "4524159ef02145b61f40749750a7ed482101d7e3", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996704, "uuid": "30279dc7-df02-4211-9373-41b70679b058", "comment": "Malware payload (Quakbot)", "value": "4af056377e1163740624e0a405e1ed48e8d1a14618602a94a97a5347e75fc456f7f434159d6153557321f5111a572ca2", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996704, "uuid": "788dc11b-9471-477a-98ca-1d3a5e2db47e", "value": "T1A473295FA3801339552201256A0F57D6F7B48878AB73D734A44EC2293362C38E7BB9ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996704, "uuid": "d4a1d836-1331-4a85-a72c-660eab616b6a", "value": "1536:g3NlDcEDFESlmDMdac3Db2Ih7v3bmjm/oba9VJV0dUK:g3NlDpBFlmob2IhWm/dVJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996704, "uuid": "45216916-305d-4e3e-bf59-d36211d4c453", "value": 75015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996704, "uuid": "3a74134c-2478-442e-b51c-9edfc3e94a42", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996704, "uuid": "4190c52f-c0c1-419b-9d9b-3c745c7214ad", "value": "Claim_E931.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95229372-fae3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685009088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009088, "uuid": "d7a7379b-c6fa-445a-9a59-31c0e5d3b560", "comment": "Malware payload (GCleaner)", "value": "36d85f78ce8e87aebad9450af03783a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009088, "uuid": "574aa711-f98f-437a-bd68-79e6804bf9ba", "comment": "Malware payload (GCleaner)", "value": "8ddb444a5b5a31dd099160ed187e83d12597cf0b2f4f48fb3e1c143a6c51d7f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009088, "uuid": "6e286c35-ae9a-4a7d-b222-bb9ea758e952", "comment": "Malware payload (GCleaner)", "value": "6a27c1d2adf49116e2b81a5444d38944b7760491", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009088, "uuid": "d1f9fdcc-2e30-4f9d-b1d3-7fbd13b638c3", "comment": "Malware payload (GCleaner)", "value": "aec0514da7b9cd04ca9eea2ed1aac3dd5e905b2dd794930c7369c9898429f0475ee45fec678096f8e74f4c803fef21e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009088, "uuid": "b441858f-dc59-4efa-be4b-bd64989911bc", "value": "T1EDA5334AA7E3903AF193C5718D2B40F1E5B5FC330C18199977A92F8F261B2C8D997792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009088, "uuid": "cb78baf5-45a0-4910-8111-186e95e3cf0e", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009088, "uuid": "7d8f703f-ec61-4f57-ac8a-9ad32dfad110", "value": "49152:CivRazLjb2xSjOoGxWAYsQohDW8MeBxo5Zs9QMDdEeizeak8s8wuN:Ci0Ljb2xkTGxWAYjohDOeBxo5Zs9Q0d4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685009088, "uuid": "536f4cb8-cb9a-4b01-beb1-0ba24a7ccf7e", "value": 2189099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685009088, "uuid": "45a9f169-7bd6-4846-886b-9b29d40c57a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009088, "uuid": "8179d86c-c371-4a29-b34e-9730d616f900", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdc0aa3-fafe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685020723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020723, "uuid": "92bb3675-b6f4-4e35-960a-43cb0c81eb52", "comment": "Malware payload (AgentTesla)", "value": "4b62cded4bd964e8d53d3787e4c35e74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020723, "uuid": "c2dafcbb-974e-4cc9-997a-e31e2b5950cb", "comment": "Malware payload (AgentTesla)", "value": "8eb1f5551a27d2fe1366393c4fc787ebf70dd0d394e1d229bd8a5ba34f418bb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020723, "uuid": "c4f6e349-91d8-40ff-b0ab-3cd5e06acca3", "comment": "Malware payload (AgentTesla)", "value": "b76cf14bdaf01ea6139603ca2f236191e1585980", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020723, "uuid": "ab2f0b99-7178-4d47-9f07-0310cdff6c11", "comment": "Malware payload (AgentTesla)", "value": "31a78f765c469820a7786c8ab1fbdb192fadf45d2d8d240a99732c4b864e9e8a3df9f8d3bead6b64423e99953ab5e13e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020723, "uuid": "9544fae3-6625-4ece-8b06-b3c1e2b9746b", "value": "T156052D7D15AAC9AFDA30C7788FE0F16FF225972375494E2640C6136F090A826B7C252F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020723, "uuid": "91552ece-e98d-4b10-9c9a-b1a32f37685e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020723, "uuid": "58404ba0-52ac-4880-8bde-a14121a94ca3", "value": "12288:rk5FKCbLN0TH93TsFad92nPDo8kV3z7fPyscC6Qm0CiTB2Qw:Y/DeHNTsFnnNafP/xRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020723, "uuid": "c8a27dcc-e69a-4626-9dc4-18cbcd2cffb1", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020723, "uuid": "15b16b11-8967-4813-82c8-e44577e19b69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020723, "uuid": "0edea9ec-a877-4e6f-b23a-4b51eac746ef", "value": "BPP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef964cd-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997240, "uuid": "6229d0a9-a32f-4b83-829e-09276dca2eb2", "comment": "Malware payload", "value": "2b6c04bc108d91c3c8109c9d5f2b1926", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997240, "uuid": "112ac7bd-17a5-4ffb-b07b-abc4147b6ff3", "comment": "Malware payload", "value": "8ee8c95445f7ea9313516a1389bff169a9ad85ef7dc9f16927379bc0e175257e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997240, "uuid": "c4b3ed58-a01e-4162-88e4-3505c6a01691", "comment": "Malware payload", "value": "38491db66d4d9072c469305419c4d2758c756231", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997240, "uuid": "19e92977-9b62-4bd4-b6c6-47d687fcd179", "comment": "Malware payload", "value": "21ceffb193cf1a7bc3afb273ca32c477f36e8d80dcdf750f5e7a1e1b76d226e76bd47962f5cdb1580c7ce6431c064aa5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997240, "uuid": "a336e7e2-7ee1-4e5b-a42a-47fb6d002f82", "value": "T1B75487804B1129A24B4B3E36A730A4A5EBBE0E75C2D4598FF46F7261FBDF54CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997240, "uuid": "d7a51740-d2dd-4986-ae0d-ed80cc13fcc1", "value": "6144:lakYe5YvF6y00S39M7zfylvpBIMK6wwkoskYmIh:lg8x8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997240, "uuid": "b8251905-a84a-4f90-b0ff-bdedf396f3ed", "value": 294939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997240, "uuid": "4a922ef0-98d8-42c6-beb7-06c6426dec93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997240, "uuid": "aff4e62c-d1f9-483b-a37a-df84b7c468af", "value": "jerrycansSchedu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6930e12-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996796, "uuid": "a6ab2e3c-03a1-4fb5-80af-b29c60e292c8", "comment": "Malware payload", "value": "23f98d6f26ff689e1358e61e619e0271", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996796, "uuid": "09024730-d28d-4872-a740-f199e8b430cb", "comment": "Malware payload", "value": "8f03ae9cd8d834273aacd82e1a061793f46fcfa029ece4d795126d84496e9801", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996796, "uuid": "1d7fb0c3-bf6f-4eaa-b2fc-02b116dbaa3f", "comment": "Malware payload", "value": "d6be9134e07c289891dc858b4040b286c2a0b0dc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996796, "uuid": "53dab2f6-64ac-4bca-baec-906cd05e077e", "comment": "Malware payload", "value": "4900ddf702faff0316d591065994711cf51275f50f31dbf57267d58dfa8977e660048f56c3c8717d74604757d49bce09", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996796, "uuid": "6bb2c0bd-fe6f-4274-bb9d-7ff54a33305a", "value": "T1DF6495844B2529A24B5B3E367730A4A5EBBE1E74C2D4468BF45F3261F7CFA4CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996796, "uuid": "8c962aac-e875-4703-b5f3-1fe45e396b0f", "value": "6144:bL/qk6EYZJheKqGn8iMpzbMSYj9RJR53Gy55/7:eUlbGfRsyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996796, "uuid": "6db45465-fe18-4b3e-90a2-7107dd9dc475", "value": 331878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996796, "uuid": "8b36e362-aee3-4cb7-8c8c-c503c5486e74", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996796, "uuid": "6dfcfe57-bc5e-4edb-be83-94aa6cc785de", "value": "huurder.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661accaf-fae3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685009009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009009, "uuid": "27f48b2b-2422-410b-bfc6-8250f5fa544b", "comment": "Malware payload (SnakeKeylogger)", "value": "78d04abf940272c6e87c34c900334593", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009009, "uuid": "d69816df-f444-40ae-bbdb-df4e9458d69e", "comment": "Malware payload (SnakeKeylogger)", "value": "8f20bdb154e0b846f6bce5668f2aaa941dc8705a0d689e5d08a9aca7875129ed", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009009, "uuid": "84db2d2b-ef4a-4142-b53b-3cd17118c0da", "comment": "Malware payload (SnakeKeylogger)", "value": "bb8c371456c1bb5f935c0851c1c711da0899f543", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009009, "uuid": "f510c3ab-c159-4f23-aec5-adbd29ae5f52", "comment": "Malware payload (SnakeKeylogger)", "value": "0ae2d4801c695d66eb3dccf4c83a602ff42b62c081e38d4ff1ceb4cd9ada9ec59675de0fac32b87f3d51a7d8175044b7", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009009, "uuid": "6c608140-03e5-4a8d-b56a-d47e4d9eb8a6", "value": "T155D4231907CDA41745D6C9C2E2C26499AFB69532C0CA386CE4D6F68EFE313713ECC6A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009009, "uuid": "7bac4488-0afa-4ea6-8565-c20dd6fe3863", "value": "12288:dkgg/s7ALoA6+VHyRMpP5L7FI8dwuoz4Nmga/4ugUKL5XgjTy:acyiMpVqbuokNhQ4ugU0ZCTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685009009, "uuid": "1dd26dd4-5bc6-4229-b8ff-1ceaa5c210db", "value": 598334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685009009, "uuid": "e03f6329-1e89-4ee8-b905-7c0a61ddcb1a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009009, "uuid": "8d40113a-0905-48a8-a342-b3c3dfa31165", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf_1.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad2f983-fafa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685018869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018869, "uuid": "8ec1e53e-7341-4430-a66f-0cc92ac41b76", "comment": "Malware payload", "value": "3b7153499a8699457c64d594774d641e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018869, "uuid": "5b31739c-b88e-46de-8cb4-6023c1c89acc", "comment": "Malware payload", "value": "8f897e53edc3150f4cea76ae2f610e3e55e6a141fd7194396f26fd98398aa505", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018869, "uuid": "d43c0700-90b3-415e-ab39-aa9a6344be71", "comment": "Malware payload", "value": "cfb3ebf583e0651ed6abe81b509b21d93df7b60e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018869, "uuid": "b089abe1-b79b-4006-bb53-e330208c4c54", "comment": "Malware payload", "value": "2c73bb6095dffe1661075e26b03221c9b81dd83682f43e561f189b19c4b67563bcc7259faaba2391a2e3dc3a0fc82a43", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018869, "uuid": "87adb6f5-8dc2-4368-806f-91494924e27f", "value": "T1E224B8804B6514724B577E2A6B30A4A6DABE0E3582CD5A8BF45F7260F7DE6CCCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018869, "uuid": "7678e9f0-0514-44bd-bae6-06c376bce431", "value": "3072:Q0/hc72r4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:Q0/hiDqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018869, "uuid": "605be2a8-8ce0-4b35-a9d1-ce2906b35ff1", "value": 210102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018869, "uuid": "aa5a9bd4-1ad5-4a66-80b4-11249fa911c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018869, "uuid": "2d74b43f-bdc3-4a32-8d46-5de06366491d", "value": "Jikm.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f51481-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994777, "uuid": "ac5f06ab-e88c-40ef-8acb-3138e836ee92", "comment": "Malware payload (Quakbot)", "value": "b27e509ad7b99aa1f60ebe7e6857f075", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994777, "uuid": "ae6ba16c-8827-4209-884e-55a9bda18d31", "comment": "Malware payload (Quakbot)", "value": "90270bb7a73d17bf6182fa37e8502362938378f90aa5859d1eb46df07ccdfd5f", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994777, "uuid": "9e85331f-a79d-42f8-ae82-da84f0a458af", "comment": "Malware payload (Quakbot)", "value": "c2454a0be61ad386d6f0f00dd7d52a111898fd95", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994777, "uuid": "f9027115-e16b-4086-af02-70bd6577b0e4", "comment": "Malware payload (Quakbot)", "value": "89c45d977f9075695a4e9a4f629a40880f826db20718e37b9f32e6b1cd6ccf234af1271e6d342b3101b50a4b34c1b168", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994777, "uuid": "1ef35fca-e2ec-4238-b6fe-88ca3043fd69", "value": "T12F53195B6381033955220158660F5BD2F7B48874BA62DB68E48EC36D3342D79C6BFAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994777, "uuid": "4c4b4937-423b-4a78-b984-5cdd0140558b", "value": "1536:Gcsj/tQlCVmwhrE53x+83Dbxj29lDC4rk3NlDCU:Oj/tQA3MbxklDC8k3NlDCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994777, "uuid": "241fd38a-a482-4035-a735-616d04c9ab78", "value": 66496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994777, "uuid": "35e66620-20f0-4f76-84fb-9cad7d595653", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994777, "uuid": "6e07e84a-4a80-4a65-a397-23b59f52563b", "value": "Claim_E085.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51bba34-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997143, "uuid": "e95ce6f9-bb6e-47fb-85d2-dd5441517332", "comment": "Malware payload", "value": "b6d1a3ff1bc663c041385eae114e1dab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997143, "uuid": "bbf64588-f5f6-4f6e-a274-ec12a4b00583", "comment": "Malware payload", "value": "90d9ae99f7861597673c64f808a956091ec47c833d246f4538b171b2ccfa8e7a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997143, "uuid": "e955dd50-b423-4835-a7c0-f5acf660002f", "comment": "Malware payload", "value": "3b9192bf9b035aa8f29f220742c6396453fa72fd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997143, "uuid": "8cb50667-17af-4024-aa8e-b03efed72012", "comment": "Malware payload", "value": "b61a7d318de094970c7193cb9ebe9bd329b4c62229c5ddea8f849c7afa709c1b8c56a7f2b8dfc9509e1884a56fe09998", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997143, "uuid": "0f45a47a-f93c-4b90-96fd-825808af442c", "value": "T1E854A7844B1128A24B5B7E36B730A4B9EBAE1E75C2D4568BF45F3250FBDF94CC8C1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997143, "uuid": "0378b350-7d63-4ee2-adb1-6d26923ece1e", "value": "3072:v+JzKxYrwzLlpRftcC8Y0SYrY5KedOVtid+3HTx15G/:vrxYrwzL7RftVndYtid0HTx15G/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997143, "uuid": "5686ab05-a5b5-4b64-be49-aa09fe50ede4", "value": 296768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997143, "uuid": "9f92f5f4-8797-4a3c-9b6b-b38940dd0e8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997143, "uuid": "7c9d4192-2b8b-44c4-8f71-dc5f9420116c", "value": "minyadidaeUnubi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c4cb30-fafa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685018857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018857, "uuid": "434c904a-6852-4d9e-a708-6b3229b84cf5", "comment": "Malware payload", "value": "bafb99bdd2a57996e80b52ffb62469a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018857, "uuid": "1086525f-c746-4806-8446-a9dd83e6e118", "comment": "Malware payload", "value": "916e2172067879c582abd055abcf1b8e71c6aeed77a05fc39a10880c84fcaac6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018857, "uuid": "dd83e12b-cd3f-478d-9b12-d7f9e91e2098", "comment": "Malware payload", "value": "67c4f064212e32ae960176952ad11079936058ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018857, "uuid": "e3d56ccf-6b02-4d60-aa2c-eb5be21cd9e9", "comment": "Malware payload", "value": "4d8d427ae2c14740741ef2f5f97f2a4ac7d303fdce7a64eb6b091fc0cc3c4a8fff7d47cde9bef0f24045f0f52b57ec09", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018857, "uuid": "2959a918-32cc-439f-82e6-e4629887e521", "value": "T14E14B8804B6514724B577E2A6B30A4A6DABE0E3582CD5A8BF45F7260F7DE6CCCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018857, "uuid": "a7e71674-46b5-48a1-811b-0537dd48bb05", "value": "3072:HP+r4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:HjDqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018857, "uuid": "33f959f1-e26b-4930-b4b6-80c95593fb2f", "value": 205256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018857, "uuid": "b79df77e-9a5e-4ab3-ba4f-8029bce9e3f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018857, "uuid": "ff29666f-8f03-437d-b398-07a3ccd108ca", "value": "Cqjsbqwh.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9590dd53-fb39-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685046025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685046025, "uuid": "6805dbec-7326-481b-84b4-9bec5da55d36", "comment": "Malware payload (RedLineStealer)", "value": "10c5d809a9717344b5615a344daba00a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685046025, "uuid": "3ba1c2e4-8c6e-4933-97cd-d3ca1630d651", "comment": "Malware payload (RedLineStealer)", "value": "921586ca72b55a37b7c422f3ec91e3648f1b22af8e9d0c819ffc4cb93c9f34db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685046025, "uuid": "51faa5a2-1983-415a-9fe1-7c61b590b256", "comment": "Malware payload (RedLineStealer)", "value": "2ba372230c51f6ba84006598d0cd1d6512eee94d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685046025, "uuid": "b6dac829-0f11-4a7e-b033-ae7a20389a47", "comment": "Malware payload (RedLineStealer)", "value": "3071388ed61a4cc630a69ac25dc50d3695f59cda8688bcbb202f6b45af745d0ca93a3dfd1bb66f77683fda6108d58751", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685046025, "uuid": "56a7c735-e73f-4b94-a1a0-caef23fcf77a", "value": "T1F2F422036AD84032D4B62B7059FA13CB0F79B9619D79437F2245AD1F2CB37E8A075B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685046025, "uuid": "9672e13d-d324-4416-a49b-bea579c939aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685046025, "uuid": "4e1e377d-a09b-4a65-a7e5-6885c4003243", "value": "12288:pMr+y90vofY1l7HdGpeFVFnzciOwQPmtSwnLiPJn0kBeinMLtIW+uEnV96h:Xym7H0peFzn4iCPmMwnLiPJ0kkiML1+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685046025, "uuid": "c7383f27-1aed-4d03-86c0-d8e0aab7c6fb", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685046025, "uuid": "412f1dec-6e53-45ed-9eb7-c00888e85c03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685046025, "uuid": "d5bc3b2b-f0fb-455c-98ae-5d545fa50cae", "value": "10c5d809a9717344b5615a344daba00a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c324c872-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996710, "uuid": "e28f0ef4-4151-4440-86c9-7ebdf73ca8c1", "comment": "Malware payload (Quakbot)", "value": "d48bf1bf98f8e13aa09464977fa9a1f3", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996710, "uuid": "da482969-adc7-407f-bd30-16dde5839373", "comment": "Malware payload (Quakbot)", "value": "93bbbc37663273a4f5d2b04a0972dbe609ad3e82fee4b023789ffa24a3b3283d", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996710, "uuid": "5aae7599-38a7-45e8-b328-b0d97339ee75", "comment": "Malware payload (Quakbot)", "value": "9e128c7efb15aec023c188a6dbf7e162f3b8484e", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996710, "uuid": "1c988127-ad9d-4648-8aad-f300e26c59c8", "comment": "Malware payload (Quakbot)", "value": "3ebaa3ddca791ed835435ff8bfdc21bb6add4ccff0d735e7a4f374acd3e3347535485be7a455c8df4b9b116e127e26a7", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996710, "uuid": "ab22b98c-106d-4605-8ca8-263851c42735", "value": "T18663195BA385037A56220228620F57D1B7B448746A66DB64E48EC3AD3341DB9C3FF9FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996710, "uuid": "5a224341-e6f0-4ad8-9bf1-ce299642cdcb", "value": "1536:Mvca1nWly/pj8P8mtH/50375RG3DbqMdm29lDCmc4T3DbylX:Y1Wo/pjkXBo75RebtlDCNMbylX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996710, "uuid": "4add0a76-c308-4bd0-ad70-d5e5460bc10f", "value": 68437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996710, "uuid": "217ef59a-188a-4b07-841f-e3f47623f26a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996710, "uuid": "1747c71a-d213-467a-925b-2c9e806f92c4", "value": "Claim_F027.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb2bdf1-fb34-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685043893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685043893, "uuid": "f9b43fc0-6ab9-49da-8899-3a5334864ed3", "comment": "Malware payload", "value": "6aa93ea974a8081e16fe48a04a983162", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685043893, "uuid": "d123102b-2f58-492f-8b83-f41d5277d686", "comment": "Malware payload", "value": "9487d11dc06237c1d5b32f46cfffddbc56200f52795cab8df47145a341ab7ee2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685043893, "uuid": "59a74a17-862b-4bcb-8b23-8db85cdec951", "comment": "Malware payload", "value": "a026f6199e5683b62051334d0c213affb36f127e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685043893, "uuid": "819e67b7-a16c-4dd3-8a3b-3897facfc58c", "comment": "Malware payload", "value": "8489ebe1013704e1788f0388223e9fb608e541c32720ad57c5673fc98570f8d05e9e8bc8cafdd912d04c4082a65c18e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685043893, "uuid": "bcf9123d-5e3c-4d04-b12c-b4cbf6e2798a", "value": "T14E948D13A3D03C65E9255B318E2FC6F4661EF9918F4D7BE7A264AA2F08711F2C172346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685043893, "uuid": "c1337968-463c-4be7-92db-a142340b8837", "value": "2ed2010eb38299ab16b0c3e5615a3925", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685043893, "uuid": "7591cd53-d533-45f8-983c-2ce2bcc0987a", "value": "6144:KmI2sP8bMOSVErUqcJWCmap+izRSTN/lyFFLQ2GiiI:KZP8bMn+U1pBRGN/KsiiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685043893, "uuid": "f038631b-dfcd-452d-95bf-87f8125355eb", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685043893, "uuid": "b0103d4a-67cb-43db-acfb-2379e536d050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685043893, "uuid": "f9b6c468-e827-4a67-bae8-b7be455c6253", "value": "6aa93ea974a8081e16fe48a04a983162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41204d40-fac3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684995203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995203, "uuid": "04375874-f830-4f3c-b51e-7753e67ccad5", "comment": "Malware payload (GuLoader)", "value": "87c3bb9981a8d7188061f6aff915aeb5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995203, "uuid": "f954178a-ebff-4679-bef4-c7ea4ea95686", "comment": "Malware payload (GuLoader)", "value": "94cbc90a35612133949fab740db6794f2cf8e5d4dd865aba1e5c03c6d077a3b3", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995203, "uuid": "b8db733f-1677-441e-b5cf-d79a7ea52371", "comment": "Malware payload (GuLoader)", "value": "fd4f84fd2e1a42549315ac5656550ba73fc69895", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995203, "uuid": "7d8b4e13-00a0-4918-b689-8ca1ad721fac", "comment": "Malware payload (GuLoader)", "value": "12af1abb9d211465f2fed66b681737f8e0986cdb12bf3c7a9d302fd58691ebeb8131c11b86f42aef817cb97e135be0ca", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995203, "uuid": "908c1a09-b5ba-4812-8994-1c72106132a9", "value": "T1CBE4BEF0C243BDB29FAA156954693F706CBC1DDF00A07918954C68A9F0C6BB7386DCDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995203, "uuid": "9fbbc6e5-3d79-46a1-96d7-fd3ebe2987e9", "value": "12288:D/63mm71LVPbqYXWGIe8xOpsm4mCtRhYIBnm702IS1:r6BoSIeFPNJ4m7jIS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995203, "uuid": "749e82df-db9d-443f-8fd3-03aa8cdccac1", "value": 698483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995203, "uuid": "da919c07-88c5-40a4-b23e-5df31abf3a7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995203, "uuid": "8d29a496-6309-4edc-b3a5-cfda8ce2f93d", "value": "SCM02938802311.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c24edb-fb1a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1685032517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032517, "uuid": "3d081c6d-76fb-4d00-baa1-de039b48a2ad", "comment": "Malware payload (AveMariaRAT)", "value": "28e6ab0ec670648302843af54abf05bb", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032517, "uuid": "8f48a757-0963-4608-8a5b-43ce9c3408d4", "comment": "Malware payload (AveMariaRAT)", "value": "957d4dbe710ceb16702d6febb67cb2f55cca53a58891edb7f8a8d5b1d8122dc7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032517, "uuid": "304b7a78-90c4-4a78-ba57-8c5b12e949cc", "comment": "Malware payload (AveMariaRAT)", "value": "32d169ac258166dc019a71e624582f965d44427e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032517, "uuid": "ee74ffd9-a3a7-4b5e-bbda-b95e80ad967f", "comment": "Malware payload (AveMariaRAT)", "value": "5d3cfb8033de9ea01c4fd0016f9f9424e56319174af37539edaa765b996f4df26b8764c18fbc52227c3f4c5c780e0a7f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032517, "uuid": "73edbfac-e880-4c05-909b-01fb97653273", "value": "T12035AE12B3F05473E42A2C39AC5BD7A5590D7E102939344DBFE63D48DB3B28279A42E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032517, "uuid": "35edd252-d12d-43e9-bf88-79d5c1682a04", "value": "b3b7f3046623191c43621fd310d374b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032517, "uuid": "2e2bdd72-05fd-411c-9e46-7781acbb849e", "value": "24576:SSWrMz8C3kJ+VnkaJ56TxIN84Mm/33fb5GJ:SS0o8YXMFIN84X33fb5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685032517, "uuid": "91eee0de-1b6a-4fa5-b715-3767a006e773", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685032517, "uuid": "a2467078-7040-46f7-a471-db05edb8c764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032517, "uuid": "c4d7bfeb-bb9c-42dd-89b4-bf8db7f6d1b1", "value": "Invoice 322515.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8e0eb3-fb0f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685028084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028084, "uuid": "7943e48b-e72b-47ac-843b-f6775ebc2849", "comment": "Malware payload", "value": "58d0c5536fd1dce3102c4aab5c36fb6f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028084, "uuid": "522d4036-b068-43a8-9e1e-ba7301498912", "comment": "Malware payload", "value": "95ac96a9d770db33fe2647d5bd183a282584df47d521afd23ce5a8bec8efcb95", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028084, "uuid": "b372e1a6-32d0-4d22-8efa-b5f9f45606c0", "comment": "Malware payload", "value": "a1109dbce63346db7cbbd0c03fca71cd0672c086", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028084, "uuid": "ea542098-663b-4c82-95c8-f97de006c3ab", "comment": "Malware payload", "value": "cc73f1e1728bc14c227c755e6f0a2a6c539ccd9c616f826d1aff255ff38d2655a4bb66173bf859be50f3fb1f496b2e51", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028084, "uuid": "82be8051-a6ec-468a-8888-cbedb6b1463a", "value": "T14D94BF5263ED5008B1B33F04A9FA91258B3BBEDA9C7AC54E058C5A5E0BE3940CD757B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028084, "uuid": "7c7004ea-febe-41f6-8659-68c31346ebfa", "value": "3072:J+GEwfkYFEhNe4VTdRnTT8w4TWD5ZqsOgDHpb+og0S7wQzS18f8d6bb/g52r:SwfkYFiZqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028084, "uuid": "e3e674b3-167b-4bc0-9e74-cc861542d3fc", "value": 422574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028084, "uuid": "cf024dd1-0108-45ed-bda3-0b07ce5e1d74", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028084, "uuid": "0f0202fc-3b7c-4ec4-bf7f-c202389c76fb", "value": "TT-Copy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad275d53-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999679, "uuid": "4d4e17e8-fb9e-4c8c-8b54-be2ae8c8bc74", "comment": "Malware payload", "value": "159b8843c02f4ae416ad8260d494bbda", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999679, "uuid": "d0e6598a-52be-467e-919f-991cdca0e581", "comment": "Malware payload", "value": "95fce7f28bab315b51c6b3f4faa71fff556fd99c373b3af897397696f140ed42", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999679, "uuid": "26c2851d-31f9-4582-b5d3-20edecb7a374", "comment": "Malware payload", "value": "f799e0303b6d4ddb77df776e95db2b23837480c2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999679, "uuid": "a416476e-e897-4b7d-b4fa-508b324e6812", "comment": "Malware payload", "value": "a3bcc247bda0c17dd0aa4a619a088fd84ce962811441a65e93ddc8a3cd030a76172b6dc1ed0c657b00cd5e4445329b73", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999679, "uuid": "3dc23b3d-7af3-4ee4-a7f9-568cfd3856e0", "value": "T10A7487844B5129A24B4B3E36B720A4B9EBBE1E74C2D4458BF45F7260FBDF94CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999679, "uuid": "799d60c4-08ca-471a-89d3-255596eab23e", "value": "6144:jhcGjYj3RFZ33R/aT3cDvee5IuXIjdvW3WJwgX+uRFYnb:jWFf0ivvFW26Qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999679, "uuid": "e942f752-bff4-451b-b821-0606c8ba9faf", "value": 362430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999679, "uuid": "56a9bef3-1e31-4418-9b2a-a3a70490c2c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999679, "uuid": "49bb7944-7da3-433b-a199-f03eeb63e02b", "value": "cricetidsEmerge.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeeb20ab-fb46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685051759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051759, "uuid": "584876a0-7425-4716-9bb0-eef15c884cf6", "comment": "Malware payload (Mirai)", "value": "434536e133302cb84886afed68d8c9c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051759, "uuid": "e30268ad-573a-49a5-9561-9edc2980c43a", "comment": "Malware payload (Mirai)", "value": "96f8ac2dd0d9046f215f9300d81dd7da2ab044dcbc97bd956a04ca363570e7cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051759, "uuid": "492ca41e-b0ab-4b22-a996-71dd35576a08", "comment": "Malware payload (Mirai)", "value": "078eaa7b84d44e88e90382d952daa8f5a60141eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051759, "uuid": "51f1ce44-724f-4ec8-bf0e-bfa21e43a3e0", "comment": "Malware payload (Mirai)", "value": "8542bfa60831830193cbf77971620c332ee7e18813cd43c368bdd83319ee391b2358ca516a8befccf6dc386b5ba36170", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051759, "uuid": "fbd27d14-6f26-44e1-94d9-ad6b5e6c00cd", "value": "T10B432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051759, "uuid": "ca084a01-ce91-4bad-8cf4-034bc0b2f076", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw3:RqtmZPuutfbltZFBSJsBcfDSTFI+BE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685051759, "uuid": "acc62987-b768-4d8a-9977-9ceecf81eb0a", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685051759, "uuid": "6e307367-58f9-4e9d-b836-ea24794c2fea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051759, "uuid": "c43381f2-f275-4f97-89e9-c6b4702ae7e2", "value": "434536e133302cb84886afed68d8c9c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7764091-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684995053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995053, "uuid": "304eaec6-e372-4778-98f8-b4a204e03d36", "comment": "Malware payload (SnakeKeylogger)", "value": "efe20c98b597f5a5b1077f690fe90d81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995053, "uuid": "c378d97a-0a1f-46a8-9998-b207d2747f10", "comment": "Malware payload (SnakeKeylogger)", "value": "970713a0e2ca6aaadefbbcbd687df8d01060a9089e60698042ddf9ee0041d51d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995053, "uuid": "6a6509b2-9b5a-4d5a-bfc1-8045fa4abdd7", "comment": "Malware payload (SnakeKeylogger)", "value": "91da161a8691ab8cd1eb3c4935515ec4b2b546d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995053, "uuid": "09b192af-cc08-48cf-ae2c-12d1d4671e65", "comment": "Malware payload (SnakeKeylogger)", "value": "993497683f2939fd59fffe42a7497d612c153889b9f211df0ad8ac0f72eb481220c66f8f25ef63e231b1a96bab36999e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995053, "uuid": "0fd6bebe-42b1-4080-920a-a5d4bda3dad3", "value": "T137E423A469260745DAAF07B10061B7F107BEAB9939B2F25B5D03F4CAEF06F4D514232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995053, "uuid": "55e35df2-dc11-4f18-a803-c114757dc176", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995053, "uuid": "86b8c638-a77c-4035-8bc2-00d31fd7c184", "value": "12288:caWIm6lVvtzZBEP85fD48/GrIhjL4/mcg+pmRewtEQAH:xTmIt9BEP8xDhHexJpmRkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995053, "uuid": "c3cb103e-e6b1-4686-b433-21a2399fb3c8", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995053, "uuid": "ee78ef51-6972-4c9c-9e14-ac2e53bcd1fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995053, "uuid": "83cccbb2-d34c-43d8-93b8-ff44f2790862", "value": "2023_24_05_Recibo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4734c6cc-fafb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685019265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019265, "uuid": "3f53f466-790e-4857-bc64-6790607629c2", "comment": "Malware payload (GCleaner)", "value": "3c9dc4e7db1cb659d92959d59267876a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019265, "uuid": "aa147f17-0567-4fbf-8ea0-8dd0a9e6d21b", "comment": "Malware payload (GCleaner)", "value": "97220971c36d54223c20434481179646a3eba74c3ca97f0c11d3f194bc377e8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019265, "uuid": "fd8fca3d-90db-46f8-bca8-9a3c28bf2cef", "comment": "Malware payload (GCleaner)", "value": "a74f38d91441e13e16f7ead9aa2bee89dc7cee77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019265, "uuid": "ed608a5b-3432-4581-8ffd-5b0f2382518a", "comment": "Malware payload (GCleaner)", "value": "2c24964fc7748cbd5f19438107bf27cd9e42898d9883fac51f15e85be5fd1d5b3309534895b4d3a14dc9864b0137381d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019265, "uuid": "081d02f9-057a-4d3f-96a4-a3725ed47da6", "value": "T1F8749E13A2E07C60F97A5A318F2FC7E8366FF1924E597B5522246B7B08701F2D57234A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019265, "uuid": "cc710140-a40c-4c98-948e-c0fae36bfade", "value": "595f681150a42a57bc6e72c8150a8b97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019265, "uuid": "54a9bf05-2e43-43d2-b40e-d59bf44bf30a", "value": "3072:DYC37S2mFuLChDnn6TxFfH/MDGV3g7aeVagXO1rYcVbWODp9KUzGXg7kCgN554ih:UvNz6Tzf7tcVCrVX9NadWiEgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685019265, "uuid": "27040783-6d62-4a3e-ba53-3eff77b77ff9", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685019265, "uuid": "dbc758cc-a41d-42f3-aaae-c918da6e4412", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019265, "uuid": "c77cc0a1-8142-4c63-b708-9bfa6e4c23c5", "value": "3c9dc4e7db1cb659d92959d59267876a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95714d35-fb10-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685028416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028416, "uuid": "cd8dc551-7b72-4833-b766-b6dc7f2657f0", "comment": "Malware payload (Loki)", "value": "ec5deee2ae2dc568b20effc3b3283d02", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028416, "uuid": "a1ab40e7-f27f-4aa8-91d3-696834a110c9", "comment": "Malware payload (Loki)", "value": "97db5f9ed10e07180b2ae62510dc73c36122b1734ce9f2bd7ca2ab3594b0c7d5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028416, "uuid": "5893301f-75fc-4216-b4b0-9c1a656b203c", "comment": "Malware payload (Loki)", "value": "abbc54f588d32189458452c95f5975d9fbaac4ef", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028416, "uuid": "79c43c81-5f70-4b6e-b1bd-9a9058c63146", "comment": "Malware payload (Loki)", "value": "0063ec258347774766f6a0fcd3fc0302849eeb6df06eb103ff4e668c90849577696f57396dd7029ac5307ad2419ba0b5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028416, "uuid": "919d7ff3-5bf9-47ea-827e-402804378486", "value": "T12D457C4123F84245E6BE97FE84B805128FB9BC23A43EC71E959960DD1DB2BD1C887727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028416, "uuid": "ef937dc5-fe6b-40cd-a51d-248444ccf5dc", "value": "6144:xXOEVLlSo+r4ZF0LaOy/D1ZlsHflKSpOtGV4elYeHS+guYAoqo8M6PEnEG/:xlS0rBn+KS8JelY1+eAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028416, "uuid": "d3647e4c-3b35-4b53-ae98-fb4cd1a806c4", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028416, "uuid": "d6f438d6-cb60-41ad-a65c-034de0452842", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028416, "uuid": "93d4190d-59ad-45ce-acbb-b27280084c05", "value": "003736399.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e4477b-fb17-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685031262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031262, "uuid": "2a82e115-0ec2-4cf5-b9c7-55eaf9947683", "comment": "Malware payload (Smoke Loader)", "value": "c6a7672ee104f534b6262fe0f5cb5a7c", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031262, "uuid": "16641c01-bda6-47cd-9209-62361f0b041f", "comment": "Malware payload (Smoke Loader)", "value": "990a82cfb2bcf731c2afb293e96161585f38bea07029d3104bac30c8a1a0d140", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031262, "uuid": "7a86332c-4183-4935-bc8e-c7580e8d5a5a", "comment": "Malware payload (Smoke Loader)", "value": "3ea4ae7c7f7e0dd64300963ebe18a43fc33f961f", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031262, "uuid": "9c217beb-2c69-4b48-ac96-276a37e5d8c9", "comment": "Malware payload (Smoke Loader)", "value": "343451312211f9f142412eb5993bd3a6dfa41daed40a3341abbc59a73f7dbfccc76854ed42727e9ef3eb336b0653aa73", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031262, "uuid": "291f155f-628e-4f60-8607-1a877b4d0123", "value": "T148643A33A3E17C65E5254B328E2EC6FC661EF9908F4977E76214AE2F08701B2C172756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031262, "uuid": "f4db6d82-bcff-4a2b-8cda-1f3f65473ef3", "value": "f7a21c5a25f4fbde0c4ce2c503f4a18f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031262, "uuid": "6b3d7ede-cdb9-4b3d-b9bb-a6a21cc03971", "value": "6144:KPeAHQ7fxOxJxvjHOYGCiMy5mwip+5kdZ:gKNOxJxLTnYTe+5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685031262, "uuid": "2ba20ba6-b13b-4568-91aa-5b5f19c4be2d", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685031262, "uuid": "31cc46db-25c0-407f-8bbf-60676e3fa26e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031262, "uuid": "95c136cd-4d50-44e1-bd47-a36b2c430734", "value": "07543499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555e60e8-facf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685000391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000391, "uuid": "543db319-9561-4629-aa11-04b67589f370", "comment": "Malware payload (RedLineStealer)", "value": "65ddbaacc28ffaad4bfcb15e42d2b577", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000391, "uuid": "b967ef70-d78f-41a4-95b7-4b4a8acdf50d", "comment": "Malware payload (RedLineStealer)", "value": "990e58370efd25109a067d341f8b919a9445f9cd1002aa7c28a186f966c73656", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000391, "uuid": "2b06f070-d3ea-4341-89f5-7a75a12a4dec", "comment": "Malware payload (RedLineStealer)", "value": "26168bb333ded86ded7f2a2e38c21a7a1646ab5a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000391, "uuid": "bd2ace6a-aa4b-414d-b90c-539c259be354", "comment": "Malware payload (RedLineStealer)", "value": "b33ac80aa142c7fa63df216dc4285b0361d54508a70c1545e1243c8def4c7aedf9c8fe7ff5c9c1add3702ae467087aff", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000391, "uuid": "2e280fda-d89e-4f9d-ad44-00c8fd930a57", "value": "T12FE3F824279F8934D6BB4E3DACB15CD076BCAC126952D7464ECCF0593A73B80EB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000391, "uuid": "1943974e-76dd-4ab2-a09c-1554c852195c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000391, "uuid": "dcc783ee-84f7-473b-adec-4227f9e45528", "value": "3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685000391, "uuid": "e83e10da-3f96-4383-9d8f-6d98744b4985", "value": 149582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685000391, "uuid": "27b451e4-0d26-4298-8284-17fce643f7bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000391, "uuid": "5cf818af-c81e-4261-ac6a-d3c005735f83", "value": "M7R70060.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b91f7a2-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003730, "uuid": "f707206b-484c-4764-a2d1-389a2c0dcb1a", "comment": "Malware payload (AgentTesla)", "value": "a50061abca7c92e35381d8a8e2fa735a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003730, "uuid": "25e6ab40-0ad1-4e49-ab7e-8c2811119bba", "comment": "Malware payload (AgentTesla)", "value": "9934bdb2357968d6993f6ea0ce78deb44b8f502144057bd3e74977675326a447", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003730, "uuid": "cc9973cf-2f65-4eb3-9340-cdfc62029551", "comment": "Malware payload (AgentTesla)", "value": "e5503c4332c8e0785ad6da005fe5a3147083aac6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003730, "uuid": "04450975-5612-43df-a436-a83d5bd346e9", "comment": "Malware payload (AgentTesla)", "value": "1c9c94cb8207720b8e6052c2d347a6fae490bfe05e1e00a630e7471b0dcd5273a7461ebe0aba61406a7f9332f9bc0b62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003730, "uuid": "aeb50da2-4db5-4734-8a38-30e4adbc843a", "value": "T15635CE09F050D3AFC5560AF08AA5A2B1942F4DB1240B7393F589F86F7AB398791347B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003730, "uuid": "c98dd43a-431f-4e3e-ab6d-2f49699b39db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003730, "uuid": "e851140c-1b2d-44fe-acfe-326e450274ae", "value": "24576:iTmIt9BEP8SDJZ0Aww0IV3UcVbbUAnQWNB0a7Jl/WYyAqpaCB:iTbBe8S0AwwV3rbUAnQWNB0a7Jl/WYyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003730, "uuid": "c0ad7358-f559-402d-ad5c-86ab77828fd7", "value": 1063936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003730, "uuid": "9dc567d0-a577-4e78-a74d-4a9c8acd1e03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003730, "uuid": "eadd1c44-6577-44af-a556-3261494e4e76", "value": "kwez.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5687c077-fafa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685018861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018861, "uuid": "37f621af-7319-4c85-b4c9-c4525d40dc9a", "comment": "Malware payload", "value": "92688c56c01ea58a23ec5c178214f0a3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018861, "uuid": "984ea004-1377-4cf3-af45-f84b325f16e6", "comment": "Malware payload", "value": "998025a85b527883f1a0f3c8d22cbdcbe9a7580647dbdfa9ab05841fbd1c5867", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018861, "uuid": "789651e2-9a3c-41fb-875c-3d5ffaca6d8d", "comment": "Malware payload", "value": "b6a82ba97bae5e0c32981bcbf06e527306574ff9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018861, "uuid": "4352b65a-804e-464b-bede-9c423d569a82", "comment": "Malware payload", "value": "e8ea89def824b20ba96265a26473f6b259c4286a00d2927e2b377cb95e549650c9f7dc6ef217555ae1e5c9cb12dd78fe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018861, "uuid": "858c48ea-f001-4b68-b018-7e08c918f20a", "value": "T1F614A7804B6524724B577E2A6B3094A6DABE0E3582CD5A8BF45F7260F7DE6CCCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018861, "uuid": "9636dad4-e36e-4733-800f-698b2ea51bcb", "value": "3072:FhdIr4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:Fh/DqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018861, "uuid": "722cd70d-bfba-47a5-be88-4ea640435166", "value": 207231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018861, "uuid": "c01f8f46-9f8d-4809-9c1d-38f863f047ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018861, "uuid": "149bb48f-dc03-456f-a0d4-5f44e1405578", "value": "Bahjpuoj.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e60ae6-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996882, "uuid": "f61a1c83-2062-4364-86af-425d8b521334", "comment": "Malware payload", "value": "d3640d6f923cfe48b7a40585638eceb6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996882, "uuid": "25215f9b-1935-44f8-99f5-c582cd4727af", "comment": "Malware payload", "value": "999a357a44f5670ad3f6512cdd3cc4a69213411f2af0665e3425bb9f9739fc2c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996882, "uuid": "3af63b78-3576-43f1-b183-bbfae21b9372", "comment": "Malware payload", "value": "ae549aacf4325e5ee1e187d5f840ab7c517d4eb8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996882, "uuid": "590b3d43-e10b-4f7d-9616-27a5e4c234c8", "comment": "Malware payload", "value": "ecd907daacaaa0a5e4ea40aca32bd841a3003dd3f85b0b2204d1bcb9e448f51f47053b1c263cb82a630da023f03e4a64", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996882, "uuid": "de59e146-0f38-47f0-825c-b0eb5f737951", "value": "T186648580472518A64B4B7F26A73064B5EBBE1EB9C2D4598BF46F7250FBCF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996882, "uuid": "851b3c83-d655-4ba5-99e4-64dc7a0ace33", "value": "6144:+9oSIV2lEcu/EQaqMa7Yty+Vk6RIUIuwBV01lqFTt:0jvMYW6RIUat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996882, "uuid": "7a9df6ae-6fb2-4d82-8ddd-1a9445c13306", "value": 328115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996882, "uuid": "1e5c0ea8-67dc-4c18-94d5-5bc6f973c3e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996882, "uuid": "b339be31-eda6-4d30-8197-d08c7187a2d1", "value": "inequilobate.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd65c30-fb17-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685031252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031252, "uuid": "756f5535-e983-425f-8e57-56f447465891", "comment": "Malware payload", "value": "7185517bd517dc2b79366fdba3af18fb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031252, "uuid": "202ce912-824f-479d-a3bc-7f89148c6ad8", "comment": "Malware payload", "value": "99ef739335b8a3138f049a2cdca74d07688e6f2f87c9bb86c5ff6a2c0ac26113", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031252, "uuid": "7ad90419-5a91-429d-babe-4cf0faf59abb", "comment": "Malware payload", "value": "274760c0ce0c69e93e73d83f9e954fb3b2e8f3a8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031252, "uuid": "53fe3b34-f057-412c-b24f-ce9fedbe955f", "comment": "Malware payload", "value": "a1ce34601a89bc1bf3dca0dfb083b65367a4c2d909a5e76a4bbccc8be6224691c21d245897607b90b69fe394673ef80e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031252, "uuid": "e8024680-5a72-4308-8be6-2fba01681ebf", "value": "T198051E6013E99A0CF2FB3F552DB952846F62BDE6BD7AC15D132024AE0D74E94C9B0732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031252, "uuid": "592a178b-bb02-498c-b7aa-4412dd351467", "value": "3072:9MBzJEHRkkDnXOxU9nVUfPRlKaR6NgyvtqWXloUcrpVhp4+b1Ifd5xkypoVe/Fpl:IMaD1Bo1oiKyuuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685031252, "uuid": "4933c20a-b315-4a93-a59a-35f32157305e", "value": 801896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685031252, "uuid": "048fcdb0-4dfa-4447-880c-799d31c367ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031252, "uuid": "9864283f-c750-4310-a329-b345fd965161", "value": "06472899.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2422930c-fac3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1684995155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995155, "uuid": "216e89e9-168e-4bef-a373-f768f195be2d", "comment": "Malware payload (DCRat)", "value": "0454aa59b2302173f2b9014d943fc2ed", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995155, "uuid": "020a0fe9-e4fe-47e9-83c9-699dc49a9c2d", "comment": "Malware payload (DCRat)", "value": "9a3c5892a0e77b598f1cebb302bcb1b867ed8539186f4011a6579434cbe4be15", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995155, "uuid": "78ac175c-f07c-4c23-8a62-58b1b52f8f5d", "comment": "Malware payload (DCRat)", "value": "4dbb4ffde2a02946bdcbf24555b4045d7bf2af55", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995155, "uuid": "dddb619f-20e0-4def-b72d-8f5e8c917708", "comment": "Malware payload (DCRat)", "value": "62cac83fb8816c40a85ced84672cd6970f8c284f5518b60743d1cfb8b7628f42fdb29294bf7f0634faea53966d898f59", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995155, "uuid": "da795320-71b4-469f-9cb2-73c00e64b1fa", "value": "T1B5A47B0027F44649E2FF9BFE84B406104BB4B913A53ED71E958168EE3D727A1D84B72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995155, "uuid": "a4b6ea87-b359-422e-bfb8-abd600d16e4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995155, "uuid": "b19b0049-3cd8-405c-bfe4-03602a38b92b", "value": "6144:7XOEVLlSo+l8ZF0LaOxukPPkOjLkVSAxkHS+guDyoqo8M6PEnEG/0qjiKVyBhPyQ:blSSruDPVjLg+BySK4dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995155, "uuid": "408954ef-1f43-4395-8352-06d4931672cd", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995155, "uuid": "7a5d8578-6ca7-45ae-a741-17df6a1c5338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995155, "uuid": "7f85170e-eab2-432b-8ca7-c3afae06ba23", "value": "IMG02011021-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753d811c-fafe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685020631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020631, "uuid": "daffd2a2-18a3-4c5a-b903-0cd52c5aaf1f", "comment": "Malware payload (AgentTesla)", "value": "faf0ad72cf4ef493b7ef5cb96e5f7e0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020631, "uuid": "78526bb9-9b8d-4fb4-8f10-bfbcf903756f", "comment": "Malware payload (AgentTesla)", "value": "9a8b998ec4ed0d159f2ec5cd79b6d9cf56659ab4e627b797b31b1d0e7fbe9ae5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020631, "uuid": "18ac7994-6232-4b37-96c4-c94d37216d7e", "comment": "Malware payload (AgentTesla)", "value": "58bf5e4dbfd20711f0787f8ae8c9de7722d7e488", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020631, "uuid": "59a7624f-e3ac-4a4f-802f-4dc127bdcf8d", "comment": "Malware payload (AgentTesla)", "value": "e5c16f6c184c9fd3947f7c69118be2f91a81dc035df86670533e86b1b99b52913bc0c577058d9ea6ef52853e840e97b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020631, "uuid": "fd58e062-bd29-4c8c-a588-924f1b608dfe", "value": "T121054E7D15EAC9AFDA30C7788FE0F16FF225972375494E2540C6536F0A0A826B78252F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020631, "uuid": "b694de11-88db-4147-a024-302010b341f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020631, "uuid": "653cdc1b-9743-4097-9856-dd44eefe91bf", "value": "12288:0THXKCbLkLFTz6sIcETLrD/iAaNxQcEaoLLjHzDiTB2Qw:83DEmsIcEHfSEXHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020631, "uuid": "a4b4024d-2e3d-429b-ad09-1322979512ff", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020631, "uuid": "e170aa26-1887-425a-836c-6328bc770ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020631, "uuid": "4a72c45b-e950-45b5-9578-d89f6f9e3a72", "value": "PRE ALERT SHIPPING NOTICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658ce251-fae4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685009438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009438, "uuid": "e26b3a86-a9b9-4767-80db-5d523d84a3d8", "comment": "Malware payload (Smoke Loader)", "value": "3109b2ee1abb7b816fc71faaed34ac5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009438, "uuid": "e9359aca-f6d4-4c85-8f81-037f710c2f67", "comment": "Malware payload (Smoke Loader)", "value": "9b864c28126995a79297937746d61a6eead541c31f039fad9cad17c7ffe41317", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009438, "uuid": "7d930e43-2d68-4b23-8196-ebc6d8f09cf3", "comment": "Malware payload (Smoke Loader)", "value": "72bb837d8af3aa6a3a9875f4af7fee77e2f56547", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009438, "uuid": "41cc5811-a879-4b76-8ef2-e3760231c77d", "comment": "Malware payload (Smoke Loader)", "value": "b390a4f0dcdd3a13a05438ab0cae67e54499597d1419ac8033b37915e7a828043080ff9a0be6e5f070b0e55d15999e1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009438, "uuid": "983b4348-fe00-49d4-8a47-d9780804b953", "value": "T1AE548D12B3D1AC70D5161A368E2ACBB85A2EFCA18F5567E733947E2F09702D1C672707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009438, "uuid": "a940b005-1478-4d18-be2b-b3f9605de79f", "value": "4dc3e52c058b03af2b7dec3a031b4e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009438, "uuid": "2ce55e57-b1e5-4e7c-a3c5-5ecdbf5aa330", "value": "3072:XPBifsYaps9wpmJr2U5h3RCnATuIPGWrabsSxfgTHshHu8AvgEUDqCJHvXIIwH:DfQkonBCA6UrpSx3NAv+qgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685009438, "uuid": "39b20415-bab0-420c-8fd0-8a7363b6dc4d", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685009438, "uuid": "185fff79-b6bc-4874-99b6-a8943d23275e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009438, "uuid": "981ee0db-b576-4de2-b3d2-6b53f9cb5d0b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553f3b3e-faea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1685011987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011987, "uuid": "b89f5c26-dcb4-481b-884b-d63add0f6273", "comment": "Malware payload (QuasarRAT)", "value": "9df0b4720bd37b4760df97c3bc09422d", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011987, "uuid": "05161e3f-00ea-403d-8be8-67b0fa47bef9", "comment": "Malware payload (QuasarRAT)", "value": "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011987, "uuid": "3c17273b-9773-4462-9313-012849d2f2c7", "comment": "Malware payload (QuasarRAT)", "value": "4e990ab8522c79eb4c599663f5d6ebd407759e93", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011987, "uuid": "d17074d9-6e99-4ecc-9d00-6ba1d9f8b9d1", "comment": "Malware payload (QuasarRAT)", "value": "6cd3e4914304609943a1726bbef8e372b806df8d3458d0bdcc8d0bc8ab3829dda5ce04d40a5efd2f7b69fb337bd26cf5", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011987, "uuid": "0228106a-d4cc-4f82-921a-e4817dd00f20", "value": "T124E549143BFC5E22E1BBE27395B0041267F0FC6AF3A3EB0B6591667E1C53B5049426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011987, "uuid": "522f4551-f424-4d06-b11e-9e5c31e647bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011987, "uuid": "4912beaf-f098-469c-a2d1-7793886d1f6e", "value": "49152:HvTlL26AaNeWgPhlmVqvMQ7XSKDI5jhJzoGdowTHHB72eh2NT:HvJL26AaNeWgPhlmVqkQ7XSKDIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685011987, "uuid": "0b579ff0-c5d2-49d4-a39c-bb40f5df46be", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685011987, "uuid": "d79493fe-76b9-4c97-8a64-bae3f712698c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011987, "uuid": "56050fbf-b34c-4ea4-ac45-7f45578b265f", "value": "007062299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a51a03-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996904, "uuid": "67a7e0c6-36b8-4671-96b5-b56f895c61de", "comment": "Malware payload", "value": "6313d0b453e63bcc1760c6dc1b09432a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996904, "uuid": "4a96edd6-ce5c-464e-b9ab-6655519f7f8d", "comment": "Malware payload", "value": "9ce46e4de5326d98bed44a572daf5beb467b46327fd82fabc3e715babed7414c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996904, "uuid": "7c9b46c8-beee-4583-803c-87841f5ed374", "comment": "Malware payload", "value": "b6a041862f8bb1079810b151ed756966b5781bec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996904, "uuid": "67c0d0b0-204c-4d28-8c4b-148f75de06b9", "comment": "Malware payload", "value": "d6abf40435c7ffa15cb1025696ca624b41a119ae274212c04d667eae9eb4d80c91959f82c65b77ea15613af0cbc29dee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996904, "uuid": "41b4480c-63be-4a73-9e96-eddc0f421bf3", "value": "T1755453804B5525B24B5B7E266730A4A5DBBD1E75C2C85A8BF45F3260FBDE98CC8C1331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996904, "uuid": "43337b0c-13aa-4211-bc6a-926963e42485", "value": "3072:AUNgixNSXu5e5rps+PQ3qO/28uAQ5V/nM0HFAViUDsK03:AUyixNSXu5aNs+PQ6Oe/AWhmVHDF03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996904, "uuid": "cef8f49f-a69c-4769-9f0e-df38ddfb7b8d", "value": 297081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996904, "uuid": "c57c13f2-5c58-455b-8b22-3f10384a341f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996904, "uuid": "05d71603-247a-4e52-a4bc-7fd0f5a9227d", "value": "involucel.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0421c16-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999658, "uuid": "3128ef53-60ea-4464-8e1e-ad0ae28c5f91", "comment": "Malware payload", "value": "6059ae32dd90269d48d9b8a6f563d279", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999658, "uuid": "7278a6d2-284e-43c0-bd52-6c1e0540c8eb", "comment": "Malware payload", "value": "9d1454b072786553e0ff8acbe4b2d7a916261e45c8579e31da626f0d8093fb71", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999658, "uuid": "819753ed-a0a7-4ab0-b0f5-f0ce6132ab8a", "comment": "Malware payload", "value": "6472860b5a34933753d613bb5f0d62d632377e0c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999658, "uuid": "6b0a0e71-7e80-4be6-86ce-8422907124fa", "comment": "Malware payload", "value": "f9a362bb20e27a7a6ed3b38099d44cbe14683cded7e3d7da4fd00fd80263ef2fa8407b1a85ba57451336ba37d5b80610", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999658, "uuid": "6ad1370c-0663-4e6e-93c4-832228334e13", "value": "T193448480476519B24B5B6F36A73094A5DBBE0EB8C2C8598BF46F7250FBDE58CC8D1321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999658, "uuid": "8960223d-433e-4b11-87d3-9b79c7a58a83", "value": "3072:Mbtygcbb7beOjGf0g6ESGPorHug2xuwdWdTNAt3qVOs6P9XfAHdK:MXcDCO3QPGuBw9bAtSH6Bf4dK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999658, "uuid": "53526d04-a5c7-45a6-959e-74d88ab44940", "value": 263714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999658, "uuid": "3bf39a34-1963-48e0-b832-61d4e5a6d3c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999658, "uuid": "d61093d0-0153-42ad-8989-be2c92293c12", "value": "contrastimulant.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc8776f-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997801, "uuid": "cd11dee1-39bf-4154-8c61-469f9bb8bc86", "comment": "Malware payload", "value": "e39ee46117c94e722fbe24f8f01ce565", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997801, "uuid": "15108a70-e0aa-4cdb-8f98-524c6bfe7294", "comment": "Malware payload", "value": "9d4215d3a3e926379bc2740bc427f91237a4e7f46ed0c9e46173827e03db026e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997801, "uuid": "9403c2c7-108b-4881-8398-e85654db2ea2", "comment": "Malware payload", "value": "d3f8a2581de2ecd8c9fc2f8ba432f5bf6a0dd723", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997801, "uuid": "af27e23f-3a16-40e7-928c-91aa038e15a0", "comment": "Malware payload", "value": "c738d49c5ef5b0c3bd22eef00fcbf50f8a408f87d0232ac245924a8fc99a0149b9b4ffe189d4c93fb0d4247be807c7b4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997801, "uuid": "8f03c6d6-5426-41a3-a5b8-e85adde61258", "value": "T10264C684431118A64B4B6F36A73454B9EFAE1EB8C2D4598BF46F7250FBDF94CC8D1222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997801, "uuid": "077eb6fb-6f75-4651-af47-3e0ee9d10aff", "value": "6144:fmchxKSkckSpuuoKp0xNBBwKdBFyQ+Zq2K6umeDOtxsdCZf58V7rePUBP++k5FNQ:umxKSkckSphTp0xNBBwKdB7Wq2K6TiEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997801, "uuid": "454ac645-b5de-4ae7-9424-c0a2c2f1f9da", "value": 307212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997801, "uuid": "277f6fce-199d-4a45-9a01-0e20171f3ccc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997801, "uuid": "1e217fed-e7c7-4024-85b2-6b256af0d893", "value": "QuiveredDistend.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32b53bb-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996656, "uuid": "93e754a2-c3f9-46dd-b747-67d57ae8bba1", "comment": "Malware payload (Quakbot)", "value": "829328fe32dd1d49738b3167296d6592", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996656, "uuid": "5f155d10-854d-4b4a-b2fb-8b4d2b174be3", "comment": "Malware payload (Quakbot)", "value": "9dde76b114ebe2612b26e6e3ccc40d27b9d9e5c790c6a5aeffebaa2f8715860a", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996656, "uuid": "e40b9b6a-d86d-4c95-a853-9b10b693f2b8", "comment": "Malware payload (Quakbot)", "value": "6ab2bb385663899bb205804fdb90247af7543356", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996656, "uuid": "ea7679c3-bd28-436a-8587-f45f9c83b7a9", "comment": "Malware payload (Quakbot)", "value": "2ee4db879b4ef99fdc194438ce032fb9f757eb25f2c838e2e51268f7ee3c4ac85ba91679294091a451a27a8e4f4b8ce7", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996656, "uuid": "51d096b2-0662-496a-8c66-b2ce7bbd5e8c", "value": "T13B633A5FA38113396A220135250F5BE0E7A14578AE76DB78A45EC2693321C78CAFF5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996656, "uuid": "d4f08df6-3580-4e45-bdf9-6c280847b925", "value": "1536:BP1elmdm3DV0WxjM49lDyA60BmLiLu/0md7o4F4K8n0kpxviG:Telm0OW6+lDyA60DLu/DW4xO0kpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996656, "uuid": "a2aedec6-b1fb-47c3-bd1c-74340b0ce3aa", "value": 71385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996656, "uuid": "74c23610-709b-46a6-856b-44c46bad0c57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996656, "uuid": "89f0b738-2ff9-451e-b7d6-8ba6e17271e8", "value": "Claim_C208.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf01500c-faea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685012192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012192, "uuid": "41e0e456-3528-4711-876f-e216a67e9e6e", "comment": "Malware payload (Stop)", "value": "fe874c2a0e2a364b007af13709abf8a0", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012192, "uuid": "2e96e4f9-fa25-4893-87db-7932d42589af", "comment": "Malware payload (Stop)", "value": "9e6cc7a86992947cb5dd8a26434fa6893d8462d646a3075bfeea7f15c333b2fa", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012192, "uuid": "3b7e813b-ad71-4302-8623-a348fcce612c", "comment": "Malware payload (Stop)", "value": "6cde641d3e7b99337775cb63f92a568efbc744b8", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012192, "uuid": "dbc8e6dd-8ca4-4197-9036-cf636a8564d2", "comment": "Malware payload (Stop)", "value": "4a3629fe72848cc4bafe96adff24d22bdb30c54c31bdcb989951aaab9e159839dd18e4476ae55e54a225dddc7953aeee", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012192, "uuid": "98507708-f47e-40e5-a281-40a74e5b2dd1", "value": "T15B05011333E5AC31E1675A354D6A87A85B2EFDB14F05B7E72380BA2F09702E2C576706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012192, "uuid": "4fd57241-1d62-417b-87c6-ac96df12646b", "value": "4dc3e52c058b03af2b7dec3a031b4e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012192, "uuid": "fa477c3f-8dae-48a8-9f12-6855b8457db0", "value": "24576:W9zb/Kv3Yp9AYzqd60qh6n6yRw5FS+M9:WlDKwp9AYzj0e6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685012192, "uuid": "f90f1276-0022-41a2-aef3-5e8e082fe16a", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685012192, "uuid": "f7288a9e-b0d7-45a1-af6b-c222f003bd3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012192, "uuid": "a62d8047-a1d1-41f3-84b2-0d1a40c32f59", "value": "08212099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16440d5b-faca-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998138, "uuid": "05a95d4e-2f1b-4131-aeac-06bb20e22082", "comment": "Malware payload", "value": "bacf453f03752b8e81f266e7976d0b64", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998138, "uuid": "8918b447-8c32-4523-8c73-328ae38ff757", "comment": "Malware payload", "value": "9ec1baa0bb341c21fc82867ea6dc5bb364e4b186585e25d09919ac1019c015f6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998138, "uuid": "bc127909-2158-4b78-a995-54b409d6f873", "comment": "Malware payload", "value": "cdfed9e0952ebd33ea7f5eb839d49c73f4470bde", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998138, "uuid": "debeca1b-6902-4d76-b74f-16771a19d568", "comment": "Malware payload", "value": "1200b94c5f84e395ee50e0a31d969f932223eec5e60cedc0f4fd38550eb39b2de932659bee99f0201205b10c96f3af60", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998138, "uuid": "48a956f2-e997-4ce7-9fd5-20232a1e05ab", "value": "T17E5442804B5525B24B5B7E266B3094A5DB7E1E7182CC5A8BF45E3260FBDEACCC8C1731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998138, "uuid": "63241723-b797-4bb4-9e9c-453c2011c192", "value": "3072:I1LOmkg8wPy8GV7T/Op69gaHOT29yK76BppqQk9Pq:MMgXPy8GVPWpegaOT29yK76BGQk9Pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998138, "uuid": "655025d6-978a-464c-8efe-f85ae3c60c78", "value": 299546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998138, "uuid": "b50c1d91-8b63-4857-af4a-edb96156ddf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998138, "uuid": "8c7dc419-dcad-4bfa-82ce-98134b1c2834", "value": "Unprepare.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f9a8c6-fac3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684995181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995181, "uuid": "b58592af-abf3-4b35-b435-1bc156ee1057", "comment": "Malware payload (AgentTesla)", "value": "fdee229dfb02edb91fabd190f07ac0eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995181, "uuid": "07fca128-2b66-49b1-9fbb-603ce39d2b3c", "comment": "Malware payload (AgentTesla)", "value": "9f01f8460d60590d2e4e5f7636e1e0a7f6f2cc5e37510b747a598ca24533ba7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995181, "uuid": "40b896bd-6d5c-45ce-886b-3ac687eabef5", "comment": "Malware payload (AgentTesla)", "value": "a3bd6444f252524310ab376ddac774ca60d86f22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995181, "uuid": "4b9ac3f6-6ed0-4106-8fa0-c31dde82dc6a", "comment": "Malware payload (AgentTesla)", "value": "14edc630ec03a6055b6b62a4b2564d6ee12dbf1a90c53bc5c0a24530c411d33a075902f9a7ef5f79cf001da2c683aa26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995181, "uuid": "bd2e310e-c481-4a10-8644-47167950c132", "value": "T11A64E09535A1D45EECCF0735CDA28FCA6513FC72CEEA4247B245B30E1A76F80A90176A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995181, "uuid": "ec29f77d-2b37-4691-8ca4-5d91ea8d964c", "value": "6144:Vk3hOdsylKlgryzc4bNhZF+E+W2knAE7tuuCXs4gU2s8nT3AnIhS39EV3rA1GRhi:Ctuum38nBU6yIjTDl/vlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995181, "uuid": "716f0127-d830-45e1-8585-97f998de63ea", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995181, "uuid": "d45237ae-abbc-4c77-96ff-3de02b4fd2a9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995181, "uuid": "f6b98c06-cd21-4f6f-a9d6-44d8cb11b42d", "value": "Purchase Order 10196869 Richardson Electronics, LTD. .xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2fbee8-faf3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685016111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016111, "uuid": "6285e9ed-7c50-497d-9a39-fbcc5dd6a860", "comment": "Malware payload (RedLineStealer)", "value": "b7995a6fb842a51b8a53baad130902b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016111, "uuid": "44d3beae-a9d5-4859-bfd7-a4eac1d23f6e", "comment": "Malware payload (RedLineStealer)", "value": "9f828771f1bda5b113e3645fbc82fcdaf419780a2c53836e0cf0962e04852215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016111, "uuid": "7501ac75-75ce-4a50-ad87-2b06d8694125", "comment": "Malware payload (RedLineStealer)", "value": "c8792354a0f6a6e072c724f3b7d420c77e0f738b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016111, "uuid": "f52277b3-c034-4c64-bfa5-51bb6b3b0199", "comment": "Malware payload (RedLineStealer)", "value": "258e68424c1c0aa0927fbeed8cd21ed138cb629a0102983209ef88caa89f00a0fc6915a85d03f3f1b687e685e5ce99a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016111, "uuid": "931e0910-0852-4195-a1d8-cc78e4db68ca", "value": "T1F284CF1273D1AC71E61A1A358E6AC6B41A5EFCE18F117BDB23847A2F4A701E1C973707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016111, "uuid": "41c487b6-b379-4e26-963f-0dc6e5506c3b", "value": "4dc3e52c058b03af2b7dec3a031b4e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016111, "uuid": "f196f630-6c86-4771-aeae-d621c617dce9", "value": "6144:vfCXxq4gPLwb942kpwr8AGxZeZP2v8enssEM4h:Exq4gzGmR6r+2XesXMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685016111, "uuid": "542e4ca4-2bd4-47bf-9904-847702964020", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685016111, "uuid": "f870758d-fb36-44f7-bb59-d9dc4ca8b7a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016111, "uuid": "b1c4e0fe-660b-4a69-be0d-7ffa658f55a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be86e27-fb17-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685031299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031299, "uuid": "11a3d62b-cc13-4316-96f1-13e898f21129", "comment": "Malware payload (SnakeKeylogger)", "value": "1326c8c74cd2644a0d6a518436e5ce84", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031299, "uuid": "eb820ce1-612f-408e-917b-b5c36e31ceb6", "comment": "Malware payload (SnakeKeylogger)", "value": "9fcaddfff8ec533450f87cb4839355f47a7bf837bc0bb573492320074289046d", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031299, "uuid": "0d284815-197e-457e-b0df-a31f6ec40717", "comment": "Malware payload (SnakeKeylogger)", "value": "9c02e42f86ca27eb21464728b0e66a52c36c67d6", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031299, "uuid": "841945f5-a3cd-426c-8253-195bea6494cf", "comment": "Malware payload (SnakeKeylogger)", "value": "e0033cafc22ee6f24dd0c88a55e53a7cf138f7582f3b6c797a48017bb712fb67aabe0ddb7895b9fb979811a5f68de227", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031299, "uuid": "eb6264af-12be-4dc1-a8b6-905165db8c60", "value": "T12AD4335B9AFF40DC375200D83CBF592AC1256280BEB8D63C8C5216E97B469CB37421F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031299, "uuid": "e53d5b68-c307-4fb6-afb4-9ad6db9f73c5", "value": "12288:pAQIyHgfLlXLl4ZG8Alfze7t4YG7Wdx8OA5b:pAsAfhl4WJ+thnbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685031299, "uuid": "9669d9e1-d245-4bbe-ad0f-dfd8e1f629dd", "value": 640960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685031299, "uuid": "002583c8-0fc4-4ae6-9bda-c0f798f53d20", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031299, "uuid": "3aa3d92c-ab94-41a1-844c-9c89d4201418", "value": "08576099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f55dd0-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (QNodeService)", "timestamp": 1685003697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003697, "uuid": "a194ff83-99c6-4cc6-8bf5-b81ebf254798", "comment": "Malware payload (QNodeService)", "value": "89fd6348489b939b49e4edd7a24f8242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003697, "uuid": "e7a663f5-31a1-4ae8-b113-d9f344bab3e5", "comment": "Malware payload (QNodeService)", "value": "a01b92a477bdf998362cd7ec70b0aa1a8fdc1cdbb2350ef47c5f17abcd422066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003697, "uuid": "39a7968e-d51e-4cdf-b956-dcaf2e20f622", "comment": "Malware payload (QNodeService)", "value": "eb464993103a463a57df507c6ad8c7424993b89a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003697, "uuid": "0e025654-23c3-4e94-b4bc-02e452f7fd2c", "comment": "Malware payload (QNodeService)", "value": "481aae975018e8643b20ceb126429ab512e411d8618a814c8a65bc4b6d41fa646d63a2489a78520d39422f3d15adf7a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003697, "uuid": "4a1ea06d-6e4b-4fc4-9fe6-192f6459116e", "value": "T10E535C003798C965E2AE47B8BCF3550006B1D1772116DA1E7CC810DBABAFFC65A526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003697, "uuid": "0520be5f-e928-4738-a917-63df8f47dace", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003697, "uuid": "23f5e2d9-d54d-42c3-9119-0be7f64422dd", "value": "768:Cm0vnfEXf78awC8A+XU2azcBRL5JTk1+T4KSBGHmDbD/ph0oX/XxDOuuSusdpqKX:qEXiLdSJYUbdh9/XxDOqusdpqKmY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003697, "uuid": "0dc00403-7ea6-45e8-9d46-86d3ef942cb2", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003697, "uuid": "3af17980-da04-482b-9d62-9f5b268047d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003697, "uuid": "78f02825-fbb4-489d-8463-51d43862ce58", "value": "a01b92a477bdf998362cd7ec70b0aa1a8fdc1cdbb2350ef47c5f17abcd422066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced81141-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996729, "uuid": "bbdfc087-6aa4-42eb-85bd-6fe835916513", "comment": "Malware payload", "value": "f924d3cff074bb79475b3212098a482b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996729, "uuid": "debd7fb5-b993-4fba-adda-8da0a3831c0e", "comment": "Malware payload", "value": "a029a8f8671141240afd5e3d2fa975f78b3b40d55f10b67684e92d1fa46f4182", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996729, "uuid": "7eb65ef1-511a-41b4-99a8-60f3a8b0be84", "comment": "Malware payload", "value": "d25d05e93353e396180732189a290ab25625aa82", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996729, "uuid": "28c345ce-18a8-4e53-9212-988f6d572457", "comment": "Malware payload", "value": "5af55113499e08991928955206ab2842840884cfa5b089a3c204829e00dbb691d7a6a2250b0879d193b9f688d936ef89", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996729, "uuid": "7a07d44b-2824-49c5-bfb6-61b5fee00f83", "value": "T196647480475518B24B5B6E266A3094B5EB7E1E74C2C8598FF46F3261FBDE98CC8D1332", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996729, "uuid": "5c76f1c5-14c3-4f37-8f74-972e9615cf6a", "value": "3072:Qwm1mJDrhXoGNrGl1PFOKQLIpfDjCwJt6TUdizptQo4qFY3cLG9:QwSqDrFoGErPnFrkrQo4qFY3ci9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996729, "uuid": "d792879a-9687-4f2d-a9e5-e45b71c4b6f1", "value": 330294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996729, "uuid": "b79ce7bf-f626-4c14-8f27-8608ef2be0b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996729, "uuid": "c6fd2eeb-6125-4296-b189-4a4cc0d81883", "value": "freshman.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df7db0e-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997882, "uuid": "25bce3ec-0d61-4c7b-bdd6-6dae1b7896b8", "comment": "Malware payload", "value": "29d7c4d7feea8bf289e0160a3b56603c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997882, "uuid": "49c7745a-dc37-4b0a-bbe2-70daaa280eb5", "comment": "Malware payload", "value": "a037369202c46836c5ceac86f132912d70bcde096f1d40fa509f48591bcc1ff5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997882, "uuid": "d3f93896-b204-4633-ba2c-7c772e9b5ab9", "comment": "Malware payload", "value": "2a6ecd56feb05c1395292c273913afc566aab55e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997882, "uuid": "d5e93999-d729-4c19-9044-9529d6edb7d6", "comment": "Malware payload", "value": "45d62a2c0ee968312bc6922789b91604b2d9a2ce4439128e0d9a3c178766d51b1f4ad91e6b7edcecfb4a2b85e7fb81a2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997882, "uuid": "903d3e34-5b98-4cee-b3a8-82e88233f38e", "value": "T128549784471128A64B5B7F266734A4A9EBBE1EB4C2C4568FF45F3250FBDF98CC8C1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997882, "uuid": "64551cf9-bd8f-4078-a0bf-9efac3fe878a", "value": "3072:MJ3QTjwmVlFUa91UM5igA33fEPDos1fknymmRnVKCGq6upDlg:U5mV7Ue1F5i7G1MqnVKVq6upDlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997882, "uuid": "87abcae2-6e6a-4e61-8f13-fb2d00269809", "value": 278999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997882, "uuid": "f8655305-f906-4c2f-a083-86480c893bd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997882, "uuid": "1557303b-04e7-40ef-b73e-bd33fee2a0d8", "value": "SclerotizationM.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83eefb71-fb01-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685021944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021944, "uuid": "e7153af4-a23a-40b2-805b-7058a26e9945", "comment": "Malware payload", "value": "8dc4f3541ec93dd368a87cb83235a67f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021944, "uuid": "0922fbcb-51b8-47eb-89cd-d9a570202375", "comment": "Malware payload", "value": "a067fbec12a8465545e03cfe6e5529fba95498c69a46457a7aeb1361b2529a47", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021944, "uuid": "f6e4144a-5775-4f89-9278-f8df262655dd", "comment": "Malware payload", "value": "eeab3f6e746228dab2fe8dabbf6a3f08ce17eb96", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021944, "uuid": "720631f7-3222-4008-846c-2e7b4b07972a", "comment": "Malware payload", "value": "6b595c26364fbac32f93ed3e48ebd805dfab5dfdfa5c9ef0e7dceeb57645481a934ca10aa5795c690348c429716c5955", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021944, "uuid": "db4d9212-a083-43b7-bb99-db1d7e1a0916", "value": "T17267336AC3DDEA87CA6BF271E0610647E51A112D6411FFAB3F11C1B497E3A00EB1AF54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021944, "uuid": "d58674b3-5e9f-4b76-b95a-5523ba41a1ac", "value": "786432:EWJvtLPtoJyOxntKous2UwmLqQkvqUBflzvuO3aXO+7:BvdlXOxntKous2ULqQ8qOflGOqXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685021944, "uuid": "af143e5d-a16b-4321-96e1-41ec453f5e29", "value": 31273604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685021944, "uuid": "d7d17810-72e4-4707-b695-f988373c0490", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021944, "uuid": "b4af0304-2bcb-4749-b8ae-612ed8dcec89", "value": "MateMask.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90c860a-fad9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DanaBot)", "timestamp": 1685004826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004826, "uuid": "9e117b41-38cd-49e7-a8ac-da1c52b17000", "comment": "Malware payload (DanaBot)", "value": "53e1200542294619c0f8f7cd8947e534", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004826, "uuid": "8e7f7205-4899-48c3-b60b-836610964dc8", "comment": "Malware payload (DanaBot)", "value": "a09e6052e43463d9e44a5eaec21f24f3a4e35f13611a734206dff6b3128c4a43", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004826, "uuid": "294468f6-a40c-4f67-b665-a0e635057ae6", "comment": "Malware payload (DanaBot)", "value": "e24399d323492602fb87049533a39372d873effa", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004826, "uuid": "64eeeddc-11bb-4b7e-bd24-f44766e85d16", "comment": "Malware payload (DanaBot)", "value": "285848af90ab029a74eb6cb87ba4f738e764028fa289bc6095cf169dd39abbe17820b0147dbaf326df25eb9cfadb0e40", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685004826, "uuid": "7d8a0f8c-8dd2-4e08-a204-de0b3f8a8eed", "value": "T1DBF5332373E45E64E53B1A308E7AC665595FFDE08F86B7EB2254A92F0D701E182B1313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685004826, "uuid": "3ed22eb9-c78e-4a8d-be82-91c30800ae81", "value": "761a416c92dda0b5d3a5091999204e5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685004826, "uuid": "8ba9c0a6-1bcf-4c2f-af31-a0d8bd111914", "value": "49152:1fZWPb/gjBdY9tVP1z5kiSHZ8WyexBrMB6Hv5XPEC/Imi0mqGcCp8ZpX4aItJ21l:1x+b/A+9tV4i0Z3GBG5fpBGcamXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685004826, "uuid": "2f186d4f-ec83-4d21-80ba-850255fb191c", "value": 3494912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685004826, "uuid": "0cb671b1-5e18-4235-9c03-aac6b82c7b54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685004826, "uuid": "f8759b3d-6279-4769-a246-73232c2eb592", "value": "M7R64198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac16d962-faf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685017287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017287, "uuid": "d83e05b3-7b4a-4da5-a8a0-f111abc2c615", "comment": "Malware payload (Amadey)", "value": "f1d3250ac495982f5e086d3ea12df519", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017287, "uuid": "c438a5e4-8744-4e82-9a98-338ce80a738f", "comment": "Malware payload (Amadey)", "value": "a09efd143bb41d9fb82ba479ecdc3b45d3f76d32716f49bd14fc8b5f7afeb82a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017287, "uuid": "a677eccd-541c-431c-bbf7-e6eb3e3e90cb", "comment": "Malware payload (Amadey)", "value": "63c0bf154a983b933c9b3eb05cfe77ce06381814", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017287, "uuid": "0c1a8f57-692a-4380-a136-c436e1902691", "comment": "Malware payload (Amadey)", "value": "0bdfde116937a25218afc7c36f3e961dfeaec44d6ca38d0f981cd8bae935788d89a2b1cd4d02223d6b0d544b7459bc25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017287, "uuid": "e5cb417e-22bf-4c55-8dc2-37fb300a15c9", "value": "T1FF352356FBD0C071DEBA27701CFA07C71A3A3DF19AB452A72250A81A1C722C564727BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017287, "uuid": "b6b443b1-996b-4fc3-be78-2309dfd8fcac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017287, "uuid": "8627ad53-e2fd-4462-a48a-9befa6bbb8b6", "value": "24576:PymsdIAOUPoGgJtVtfEcT6Rn9bKJEkZc0vfs2/7Ki:anIA1PjcaRn9gEkZ52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685017287, "uuid": "74a3f1bf-114e-4802-8730-601ccd04cf8d", "value": 1071616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685017287, "uuid": "acc0fcae-369e-462c-b70e-d5da43abbe1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017287, "uuid": "9c8dba38-e53b-4d96-9c9d-72b598eaa1b7", "value": "f1d3250ac495982f5e086d3ea12df519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2d63da-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685003733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003733, "uuid": "4dbdb394-8024-4805-9cb9-03748cb85ce0", "comment": "Malware payload (Loki)", "value": "c45a8c7c0f87cb97c0599b2348c005c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003733, "uuid": "51d48c54-ab2a-4ff9-8ff6-811f7b8ab01a", "comment": "Malware payload (Loki)", "value": "a0bee5267d0b17ca3aef423b133243a4b02104f85720e73799e6cd5972176f20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003733, "uuid": "eaea5e17-cfeb-46d4-8788-da941a164c2f", "comment": "Malware payload (Loki)", "value": "1a9153590bf2b52d4a5d4f8f8a6b3d529e1c3dae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003733, "uuid": "36303cda-b3eb-43a6-a846-693217374157", "comment": "Malware payload (Loki)", "value": "caccb6c9c9b351b64ad77e20683795a7031fe1e8632e997539fb9a29232ef61e0437c4c809a8d5170a6b4f43e0c177d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003733, "uuid": "6880ffa1-0bbf-4256-a0cb-dfa5151b0c43", "value": "T113B4DF74519E8A94E01FCBB165BCFC72427170F3EAE9C9750729A184CE2BF506E8C91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003733, "uuid": "02a0d440-85b4-4291-81b5-84cb9d8b4c44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003733, "uuid": "e78da932-d10f-47dc-bc18-187ebf3e2734", "value": "12288:plXn0v5MzAhCbJJtOS168T4TNe0ypCELMpSK:H3AKzAIbJJQSCCSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003733, "uuid": "7638a071-10f4-4c54-b3b6-9d05c72ee691", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003733, "uuid": "befefcf6-df5b-4e38-893f-0f9a10bc6743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003733, "uuid": "24eff2ce-192a-49c1-9a43-c755d7235665", "value": "o5xq5XkKggmUoYK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc83f84f-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997128, "uuid": "883967e5-9e19-4289-8c3a-686ef4314592", "comment": "Malware payload", "value": "78e9966f94f20d7144c024a2d2524ed6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997128, "uuid": "5ea6da34-cba6-466b-a269-748b2d90ec1c", "comment": "Malware payload", "value": "a0fb8d031446c1ab4f5c76bf75821b68c070cf40896905831d44beac9429a4de", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997128, "uuid": "6de2eec6-d0f5-460e-b65b-530907cb9373", "comment": "Malware payload", "value": "3e1ea8d51292ac2a0c60eeeaa8f01253ec29d123", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997128, "uuid": "64b4b2ea-b30d-4e13-997e-36babea65d44", "comment": "Malware payload", "value": "40a8d2c4252a8387596afe8196c063755eb49e4417a4d64208ba3554783bf5c0a8e946ec86cf8dc4f8b607217e1f47e4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997128, "uuid": "f74ff8d1-b3a0-454a-9517-7e73f9653fd6", "value": "T143646680475524B64B5B7E26A730A4A1DBBE1E74C2C8568BF4AF7250FBDE68CCCD1321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997128, "uuid": "7ea5656c-fc97-480b-bfc7-2a823e480ed3", "value": "6144:0EVblaEkE3IGsMAhtFyZC3IShKKlmYPk9iVW4ADz:0UZ84vzYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997128, "uuid": "60969b77-ba20-49b1-89fe-36796ca5e288", "value": 311087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997128, "uuid": "7428dab1-be2f-49b8-a2b4-0142298db81d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997128, "uuid": "7491285a-1a7b-4fec-a4d3-24d2dd2e1518", "value": "moronismUndiffi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5364825f-fab6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684989650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684989650, "uuid": "63cffeb9-8b14-4374-8445-d55b581ea3bb", "comment": "Malware payload", "value": "eb787c09d4610f9a7f9e741165263e46", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684989650, "uuid": "df09d436-cd0f-400a-bfc5-4848a4ede112", "comment": "Malware payload", "value": "a17f0da7507fe915a573acba4f45da0e6176290e0c1b4694a77b68c85cfb4d76", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684989650, "uuid": "fd820a8b-e086-454a-a343-93f0294f7a43", "comment": "Malware payload", "value": "903499cda025cbcea8c776a5b0e645b2f4228b39", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684989650, "uuid": "be90fee3-75f7-49a7-8c7a-6c78c7c39138", "comment": "Malware payload", "value": "22d7ec0a04406e800d22d0f72dbea747c937adb5a5577990821ccf6029f4bdc5b50beece4b48964fdcff6d3060369718", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684989650, "uuid": "fa78e2b3-c936-4e7e-ba43-de30e3305988", "value": "T1A8767A093AD508DCF8598FB29B9503A833DD33339BAC0DD6B6080518A76DDB94F5DA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684989650, "uuid": "3bec9908-29eb-4af5-bcd9-9a35c86b2fb3", "value": "d14ac171253cf4e289cd276f47898b08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684989650, "uuid": "995ff851-9325-4ac9-8e9d-614d261a52d5", "value": "98304:Jr5YCmJXMBKck8xt9B4WwReLI8LlaG9OSs1HYdZqw4Hlm6kooN58:wJ8E839yWcenlaIOSUwkEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684989650, "uuid": "ef24892c-f458-43a8-a72d-6bf391b5d399", "value": 7332352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684989650, "uuid": "8af2ccb6-d0f0-4f02-bd99-f86f5a1e321b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684989650, "uuid": "c88f8333-0365-43dd-95cb-b76d7d7b95ec", "value": "eb787c09d4610f9a7f9e741165263e46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c78a1e7-fafe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685020670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020670, "uuid": "63190130-d7f8-469b-bcb4-dfcbbdf8e46e", "comment": "Malware payload (Glupteba)", "value": "ce9b4b1faeba8ae5e658ecc58fb8f17d", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020670, "uuid": "38164c9b-9d52-4462-8fb9-804054384aec", "comment": "Malware payload (Glupteba)", "value": "a196d7c5f3f98ca780ff6f2cf571afda77e96ad17ad6e7fdf0c505e9fce872dc", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020670, "uuid": "7d8ae37f-22f7-406e-aa24-a8aebf74a00d", "comment": "Malware payload (Glupteba)", "value": "9841b196991658b9de1649dd6be86f7ba79a9759", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020670, "uuid": "52ea5037-667d-412e-ba7c-1226e7e7a249", "comment": "Malware payload (Glupteba)", "value": "b76abcdb481a32f5c3dfbe7ec747278d2832d8c38ad5c6c1472034ca9822d2c8f1c4fb3d9cd150a5ca5a62ef400d771e", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020670, "uuid": "9f43847f-3280-4971-9a09-ac75634ede0c", "value": "T1B4163320B6917DB5E5170E320E6BC5B96A6DFCA48FA027E7135C5B2F44B02D2D3B170A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020670, "uuid": "8aefed72-e700-4fae-adfd-d71b08dfe8f0", "value": "8522dc5d9d6a2a97002c24ca5ed58b85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020670, "uuid": "b8205adc-5dd5-4f6b-a908-9dff6e056ded", "value": "98304:oTMIFZRn8cnjeBPyq07euzlcxJ+ruB8FnVseT1:oTPHHjeiKuKwKmFia1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020670, "uuid": "6f816a98-19e5-4449-88e8-9f33cc692884", "value": 4368784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020670, "uuid": "57124655-4007-4f77-96e7-f77083238bb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020670, "uuid": "7d820d7e-37ff-4259-b08e-91dd182fbfc9", "value": "06621599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0534add5-fb47-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685051796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051796, "uuid": "f689270e-19a8-432a-858a-51d54661eea6", "comment": "Malware payload (Mirai)", "value": "88f6ee0aedab6a8c5d75de921254fc3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051796, "uuid": "0f435ab4-e246-4182-ac75-a7a6de27d690", "comment": "Malware payload (Mirai)", "value": "a25b27edf598a5845c1d7910fb53fcec9ebc39288cd69c047b8ac0468bb4d285", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051796, "uuid": "3e596f8e-eb5b-4bc9-b0cd-82e1aa91cf85", "comment": "Malware payload (Mirai)", "value": "235f8f6f90ddf8ab6c0ee9efd207333acbe14f43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051796, "uuid": "f45755de-c3c8-4e46-94a8-61a7e0e00db8", "comment": "Malware payload (Mirai)", "value": "24f0b2b1ddd07307ac0efc9eb15a56463881775cfe4f469fb31105dc1ac1c030631ca4dc0698ab96587866c8395f0dac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051796, "uuid": "2b1cf110-3929-40cb-a78b-a1ed5195233d", "value": "T12282CF3061AB74E4DBF14431FEAECEC697160BF9D0FD369216586B78898610621F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051796, "uuid": "5882e638-e719-401c-b445-f70de0fe757c", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMayhymdGUop5h5lR:2dV0P6+kom0tVAoNvm+to1ys3UoznlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685051796, "uuid": "d430420e-f870-46f7-8a86-c59bd6748421", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685051796, "uuid": "9d9f8709-553a-471a-8a91-0c5bacee887a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051796, "uuid": "23d3db3b-1dea-4eab-8fef-7b96ad4a1b35", "value": "88f6ee0aedab6a8c5d75de921254fc3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b38385f-fb52-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685056531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685056531, "uuid": "752e0b4d-07e9-4e51-83a7-47093ea1d0f0", "comment": "Malware payload (Amadey)", "value": "f00ae380d5210f4baa041d86e4fbcb1e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685056531, "uuid": "66eee0f3-badb-4878-899b-ccf2c7d11679", "comment": "Malware payload (Amadey)", "value": "a276c634f10f20026012c5a5b08a59fe563ee3b84ce967397fbc8723cfaba74c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685056531, "uuid": "737cc432-95a0-4ef0-b8a1-a0557b419583", "comment": "Malware payload (Amadey)", "value": "eb15c4bc699e211912fe4b389d2afc5490bbd08d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685056531, "uuid": "0952d615-0a16-49c7-a4d4-2505832d1622", "comment": "Malware payload (Amadey)", "value": "2ea4ad7043c0cf540a308cfcd3f2c5ad7af2a999c40eb1cd97f7d4f45b26c9d333bb0eb5ed987ccdfe3b297b4e752ca7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685056531, "uuid": "5196d539-79b0-4190-99e4-61acded8cb42", "value": "T105F4124377CC5232C9B51BB04CF71393073EF96298B9836F2649646A2E761A0D97272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685056531, "uuid": "e4b1cd52-435e-4239-87eb-69464468ce5e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685056531, "uuid": "0df43da6-b7c1-49e1-b9ca-0991f22c12a0", "value": "12288:UMruy90DdpHUak1IbhBbIj0tNY+imQRwKmxtveapYwoWEd8F3Wn0kB7tnMLtIW+Y:iyq0ivbq0tNTfKmiaT/y8FG0kNtML1+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685056531, "uuid": "03088edf-977b-4a4a-bd43-f432177514ad", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685056531, "uuid": "9a73d8b8-9261-444a-8710-ad26832414c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685056531, "uuid": "4008cbbc-c901-40b4-83fe-998fc96735bc", "value": "f00ae380d5210f4baa041d86e4fbcb1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14b36f2-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997082, "uuid": "dbb4baef-d6a4-4a4d-ab50-9e5570d36bc1", "comment": "Malware payload", "value": "ca88b2b5a142990888f5c5fdd0d5dbaf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997082, "uuid": "788efb46-8e55-4abe-a90d-7223cc4b7d5a", "comment": "Malware payload", "value": "a2bbda42b4445162d8e49428db63a7504953c4ab81c17721cd8186084057a74b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997082, "uuid": "30552b4f-30f6-40a9-9f03-c4e127e2f583", "comment": "Malware payload", "value": "44376807905dc128f13a8008f15c3da3534b10c2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997082, "uuid": "c55861fd-81c2-4e12-86ea-d4bf90239e9e", "comment": "Malware payload", "value": "3e767983aa0645fbf6741440fc63322ebeac660bc803aae1b7a60b22395bb2cedade32ff246bd7214250030b4258e8e3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997082, "uuid": "f997831b-26b4-4253-8eaa-872ea1686206", "value": "T1CE6487844B1519A24B5B7E22B730A4A5EBBE1E74C2C8568FF45F3261FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997082, "uuid": "8aa16e11-29b8-4e7a-aaaa-4818be6200c8", "value": "6144:xPq+jrJBeKuYVgKoGiUqi390Wonoc9sxeZoH85+3a9wG:JNQrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997082, "uuid": "e99ffc47-90e1-4050-86c4-b3ee466d6a32", "value": 331604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997082, "uuid": "8639e3bb-345e-4acb-bc75-3d51b82014a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997082, "uuid": "3ee91b06-1baa-4a25-ab80-fff981f91276", "value": "nomocracy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157da368-fb04-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685023047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685023047, "uuid": "b1055b6f-ac22-45ae-9c84-e487aa0a75f6", "comment": "Malware payload (Formbook)", "value": "9361676b5625a3ee609012345460e915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685023047, "uuid": "ff8f3d8a-602e-41e0-8daf-053975b9fd9a", "comment": "Malware payload (Formbook)", "value": "a31f2c90d1b4546cc56693c44f07e4f161d52fecf99c4b1ddc2b2674e49f51fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685023047, "uuid": "7924d08d-5bac-4c1a-a290-a2afde074ccb", "comment": "Malware payload (Formbook)", "value": "ec68b61812ceb090176ff6c5c57fec930fd65c5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685023047, "uuid": "afcb261a-a3d6-4e42-8d0a-184090b254be", "comment": "Malware payload (Formbook)", "value": "90f8ed4bd554802b4b66500be92a22769681859460c21b1fef8ee9e2bebb4c47280977b0824799ea6f9141777ffbdc38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685023047, "uuid": "a9aebd0b-c244-4a52-b09b-2e9ca5d8446d", "value": "T127E4BE75E7349896EC049239843F9D6E5BA3FF7198B0414E226D3A394AF334F452AD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685023047, "uuid": "abab4536-bd0f-410a-b76a-39f8548d9b0c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685023047, "uuid": "9f42526a-a65e-43d3-8ded-4731b4c7da16", "value": "6144:Y6bAcJ1bofjd2BOm2lbtnDEjh4UTaYmvz7j4E4XHPQPkNWAwKW9635wAtrDZPLr9:nBunjDb4E4XHPQoWct/Nrl/sEosmZpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685023047, "uuid": "b7c6a12c-525f-4bfa-9d22-ba95e3c8c2ed", "value": 658658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685023047, "uuid": "1795fbcc-7e7f-4818-9240-d4b839f4b7ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685023047, "uuid": "b5c980d9-6b1d-442f-b8cd-afe19804c200", "value": "Mapa Quantidades 52359 - ORC 667_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93034a00-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996629, "uuid": "f92ab945-d9bd-4cc8-abd2-6405ecb1c019", "comment": "Malware payload (Quakbot)", "value": "262fe97e054da61b915a6bc01e8bec53", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996629, "uuid": "60047274-9eee-403c-b93e-d53276dfc2cc", "comment": "Malware payload (Quakbot)", "value": "a3dd0ea9dd795cb28ca3ec2af8d278c4c0ecbf9f4296c9bb35e03a01c1ec57a3", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996629, "uuid": "46eff9f0-0350-4395-99af-c58cd9c1b001", "comment": "Malware payload (Quakbot)", "value": "0e9e98b29ac36701ae4af71b19f65b168615a853", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996629, "uuid": "65c24027-98e8-41e5-ac88-2221c23a3e95", "comment": "Malware payload (Quakbot)", "value": "120d954535e4cec34fcb5db10468835d687cc3b4ac6e98375301b9ad0b5f1215aa1675b348276d48c7f1a9e33009268b", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996629, "uuid": "3b608716-9eee-4ffe-bc7f-489383dc4bbc", "value": "T1D4731B5FA380133969614233640EA6D4F7E14838A776DB78A81DD72A3322D39D5BE1FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996629, "uuid": "47117961-c0da-44ea-9c79-7417708eec0d", "value": "1536:2MUaB/PtZ63PMLmlZAQq+cqHZpbTIkJx3v4:2M3M9Z/EazEkJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996629, "uuid": "9d8fa266-38bf-4b86-b4ee-9b2da8394528", "value": 78597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996629, "uuid": "1ff63d70-346c-410a-abd4-7613658e6ab9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996629, "uuid": "e57c77fc-efb9-4509-81a3-c6214f9ce78a", "value": "Claim_B214.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2ae342-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996591, "uuid": "7da08168-c162-45a6-a86e-5966b3aa1d36", "comment": "Malware payload (Quakbot)", "value": "6411637629cb4640ee2f91fe18dd16b6", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996591, "uuid": "05b0cca3-ffd1-4ab8-b759-48b71d5d0084", "comment": "Malware payload (Quakbot)", "value": "a43e6cf7484cc18199f76a010611617494b94e6a32d2e6cd45421ec355b61e20", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996591, "uuid": "4889f0d8-39d7-451d-8dc1-29e25fdc7008", "comment": "Malware payload (Quakbot)", "value": "1e7da59d787af69ae55175d3cf79e8768d31ff4a", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996591, "uuid": "9ad1a250-0934-4364-8948-2f5fef2c7363", "comment": "Malware payload (Quakbot)", "value": "961f6b8d60bc3b8e6f0617bd25a8100e9fa207b7b86f5e11cae99f6098c79fa3d59ebdd1c0b52a2c3e418c11fc9fe8d5", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996591, "uuid": "25a9df31-598d-4e5f-ae3e-e8166bdfee6f", "value": "T1E15319AFE3821378A9320214514E56D1F7E149387A62DF78A44EC3AD3311D79C5FA6EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996591, "uuid": "2ae67769-d905-4ffb-80a9-d3c3cb29228b", "value": "768:ojBM+ohKxviWAhn6kLwte1+wD9IBm24VCRhj2wphFGbIoEI05Qj2kW3CdX44kRE:eB/fxvr8n6kDDwmLI7gIoEij/Imozu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996591, "uuid": "30d0ac86-a21d-41b1-9fb3-b0dd8f391f1a", "value": 60817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996591, "uuid": "db8dde4b-220a-4933-9f0b-a287f03b8461", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996591, "uuid": "6fef8bdf-df2f-4330-a238-cc5c2ad2c78b", "value": "Claim_A586.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09be9b29-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003700, "uuid": "c1be7dec-7b7f-40a3-9b73-ebfcb2b5a891", "comment": "Malware payload (AgentTesla)", "value": "d56ed7d6212ec1bad5597151376c90c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003700, "uuid": "473e8873-9241-4a73-a94f-bdb8b7c8ba2b", "comment": "Malware payload (AgentTesla)", "value": "a445a43ad0e6079bae384dc89c31a742ca0d4de5e3ca5fedf95e670328ed68e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003700, "uuid": "601e69fd-186c-4dea-b49f-6e2ee080d892", "comment": "Malware payload (AgentTesla)", "value": "133a2ee01094924bf944e3db5f18dc27b0fe55cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003700, "uuid": "cb894717-c8ce-4f2f-9f97-ba18f790fe09", "comment": "Malware payload (AgentTesla)", "value": "f89d33884cf34d2d7b09d6f7e562301f7556e2468e1220e359dbf28120c33f876e9a041cd759f9989e5839a3f5756404", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003700, "uuid": "12e4784b-92ac-414b-9f8d-e29cc5c8aa2c", "value": "T1C2D40180767DAB06E87B97F5040485B4433E9D6BB233E30B4EA7B0DB5A54B441B41F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003700, "uuid": "c9855001-e98c-4f1c-abff-0daa95684cde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003700, "uuid": "6edecfa6-ddc1-4251-92d3-ae8132e24e4d", "value": "12288:S2N8jiZ4zypIPsWtPplTY6RhKuWku71b5YH4RlnL3jra/09tQO/5lN7/UjTFDJ:S2N8jiZ4zypIPsWJTDE1ku9yHIXS4xDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003700, "uuid": "4e5efffe-1f32-4491-beb1-800b6f23e1db", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003700, "uuid": "ce5f71ac-19f4-4d8b-bf9d-c77a2f702c1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003700, "uuid": "4e52a6bd-28a9-4fa6-9548-1177ae9b4327", "value": "AWB ref #HQ3720811880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae873b5-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997877, "uuid": "b2dc750c-54bb-4da5-b1fa-2febbd85b2f1", "comment": "Malware payload", "value": "99c3f0ccd2c8cb66f623cb0ddc885211", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997877, "uuid": "d3eeecef-ebc0-4685-936a-a448b0fd251f", "comment": "Malware payload", "value": "a464b9ea9d4b956194ac778f29f000bf2861af0d73daebaabb6ca96e1eed2a5d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997877, "uuid": "f7cd0470-3a31-4be1-b4e6-c42862ad35bd", "comment": "Malware payload", "value": "f847df9d11859dc75a5ef708530e54165451e6e7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997877, "uuid": "72b10eb4-4d59-409f-acf0-066388394671", "comment": "Malware payload", "value": "6196de16e3c981dbab76ecc62d8572ae34ddfe9c664cf2e2748959ba13910b19e1b0e36caa316dd3712f29d4e8ca8545", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997877, "uuid": "b4eb5c17-984f-4bef-80f5-1c793f3c05df", "value": "T113649780475114B24B5B7E36A730A4A5EBBE1E74C2D8598BF4AF3251FBDE68CCCD1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997877, "uuid": "6c5c7ca3-eefb-4d64-9f2c-96b00271b88d", "value": "6144:ftRjaPP2jMJvPo8SYFrfLIk88rNEAaJqjvQl8:AGWrS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997877, "uuid": "a8756e67-435d-4d6f-a4c1-877b5ff58789", "value": 322242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997877, "uuid": "a5024cca-8763-45c6-a01a-7bce6d085b93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997877, "uuid": "91787f03-4d26-4049-bf00-7b3db08c7ca7", "value": "ScarpedAerostea.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b52ddc-fb31-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685042561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042561, "uuid": "da371cc1-0a62-4a1d-9a5c-7321cec2d077", "comment": "Malware payload", "value": "de906fce89f615f303ddfb80c1b37b35", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042561, "uuid": "13682d2b-24a5-4749-a307-99d54b8ec759", "comment": "Malware payload", "value": "a518e0fddabae1e59f933566cb54e592331404d5362976f3ef81a1432dac4ffb", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042561, "uuid": "a32839fc-6bf1-419e-ba6a-6b152b403ed7", "comment": "Malware payload", "value": "3568e3f9f0731da9a3294f4f8de61f95dc3eec31", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685042561, "uuid": "752d5f73-6787-400a-b4f5-35225cd51250", "comment": "Malware payload", "value": "0765abc94044d46da477edfd0ae1d180c6162fbc511905d4d65237429bf39aa69604d75974a5e41dcdf92fc7c72a4cfd", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042561, "uuid": "64a56b18-04a2-4927-8442-0503cdd411ac", "value": "T1B4E27C16AF0BC632C82C42BB8CE9658107F5E349B25BCB5F7D881408EB67B9B5351B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042561, "uuid": "5b4b551c-7235-48a4-a329-909dcfbb722d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042561, "uuid": "e11ae487-0174-4c41-89f3-d54f29acc9ea", "value": "768:Kss2m3MRLno1Zbwnfel+qSGGDNiuk2Gb:Kss2EMobwnmUqfGD1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685042561, "uuid": "5cd2f959-b2c7-4d7d-9ce6-a1065c3e138f", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685042561, "uuid": "dbeebe56-3753-4ad1-87df-1077d22969ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685042561, "uuid": "9308dc7a-a10e-4c58-9f16-9db5a85f3cb8", "value": "sc0pe_hidden_pe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71121676-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997002, "uuid": "65dca3dd-4ba5-4688-b360-22f5fbdb091a", "comment": "Malware payload", "value": "630b7af2904a268d9c42554ec78bd2d8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997002, "uuid": "b3724db0-dd6b-4ed0-96d2-d458335075a3", "comment": "Malware payload", "value": "a5af0257e4f6178fd06bd80274f021e9017438659248fc5c54bd917431334d20", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997002, "uuid": "3c8f5ae2-a66e-489a-94d3-c2ac2bf811ea", "comment": "Malware payload", "value": "df60a422fc97729248d5666e1fdc00be3e8613b5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997002, "uuid": "3a8303d9-8918-464d-8109-dc1c70ce9d48", "comment": "Malware payload", "value": "111da1796140643a01186cbe618a7a767487c9b3b2a0d6477edde464ba53f5dd4efd56c83218e22a0aab0118b6ed6741", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997002, "uuid": "fe9c238a-10bb-4628-9c76-76a6460ad534", "value": "T1664487804B1129B24B4B7E26A730A4A5EBBE1E75C2C4568BF49F7260FBDF54CCCD1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997002, "uuid": "2ded621b-1405-4566-a7e0-9d5ba907ae65", "value": "6144:r5+eGb27+90+/hTmtQ29KmmTL+LTPi3dU:r1T+9oKfUiNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997002, "uuid": "37ba05fa-e293-4b97-bdcd-6572d74fece4", "value": 267721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997002, "uuid": "25adc9e2-d755-4a79-b3b5-f2209ff8c7a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997002, "uuid": "2a8cb388-afb4-4994-8895-4cb3e90df099", "value": "offlet.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d58b6c-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997954, "uuid": "5c1d7344-df32-450e-8c2f-6aab0a627b15", "comment": "Malware payload", "value": "18f47813242dd801a2fcd175498ecd7a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997954, "uuid": "38390938-8124-4571-b40a-c2e848da0812", "comment": "Malware payload", "value": "a5b79c605fad6a5476a0dcfbd2daee0e0cae57357d91a60a94264ed3a5096b21", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997954, "uuid": "7ebb21fd-7730-436d-8e03-a3cfc3f8ddce", "comment": "Malware payload", "value": "aa1e438430a375446777b539bdaa4626aab454d6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997954, "uuid": "b676cb29-ae0c-4d28-ab1d-6a6b431feb44", "comment": "Malware payload", "value": "0aef1be86edfbad814daddb421921e35f529cd72860c1b46a764e3464d3072b7506e8d9eaa7a5038e233d93497414438", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997954, "uuid": "24ecec9f-1a0a-4f49-968e-b023dbe9503a", "value": "T152749984472518A64B4B7E32B72064B9EBAE1FB9C2D4598BF46F7251F7CF90CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997954, "uuid": "2ee92e5b-ba50-4a1a-b53f-448cc5fc4f73", "value": "6144:nx61RyqKSxNvyrSW2uU9VmQ2L4PtjQ74cR8r0:xNLHZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997954, "uuid": "9e04e162-c6fb-4b34-85e4-5fda498a6910", "value": 344753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997954, "uuid": "b645cb5c-7985-44df-8a2d-25939acb64b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997954, "uuid": "bf0c30bb-6c26-45bf-9ba5-eed4d5e0ea98", "value": "StreetwardPlack.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01f9b4f-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997993, "uuid": "c7b58600-eca9-4807-995c-cc72ab8e0c36", "comment": "Malware payload", "value": "3c4dc2c3f47720e606cf6a5f720ab913", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997993, "uuid": "4e84da6e-fb94-49b6-885f-01d33c151046", "comment": "Malware payload", "value": "a5cbd6f52638085291c4b63c578e5fa09ad3446d420c573ca69b31db0b808877", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997993, "uuid": "1247c0ff-2764-46f2-abe3-cabf5e782e48", "comment": "Malware payload", "value": "fad99b63bd2ac4fa57bc9b798b72195ad2450dc7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997993, "uuid": "832471f9-3979-4b7e-afa8-dfda0d95e6c1", "comment": "Malware payload", "value": "eadde3fe9a09bee8940f5c55393cea9ae3c83db0a39d0429137c480d4fe98d26af4023f784a62fe62e5a4aada6e6debf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997993, "uuid": "68ca3ece-c815-4fa0-bf5a-b526c4138f51", "value": "T128449980475128B64B5B7F266734A4A5EBBE1EB4C2C8568BF45F3251FBDF98CC8C1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997993, "uuid": "4de167b9-c849-405b-b98f-9511a06375af", "value": "6144:yeTsZpQW/O73gTyR/TKN6YqxBYUlbNInw:yJrWTqUlxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997993, "uuid": "fda31fad-56ed-4054-be26-0b01769b17a4", "value": 260215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997993, "uuid": "5836d2a7-8e36-49ec-9089-465f80318f67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997993, "uuid": "02a71e45-54dd-4a83-adc9-97425f603b3a", "value": "ThaumantiasUnav.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9b159b-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996674, "uuid": "bbe44b69-0c34-42cb-8aa7-9fcee5f28db9", "comment": "Malware payload (Quakbot)", "value": "b940cbb6e3f3abd61b05fd5b74b885de", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996674, "uuid": "c72cd511-38e9-422b-9575-3ab68bd17537", "comment": "Malware payload (Quakbot)", "value": "a5d1f4d66b4b3ff65ba4a6305881f11c96485a06d7d4e87a0e8725194774c373", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996674, "uuid": "28292649-2d49-4efc-8ef1-82aab76617f6", "comment": "Malware payload (Quakbot)", "value": "58b0df8ec42e102c07ad499318b4c129395ee580", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996674, "uuid": "e0086add-eb33-4ff8-8c6b-af3d14f945e7", "comment": "Malware payload (Quakbot)", "value": "e9acfe705559d554f222a7347de440a3db1ff205561b24770faeb874a192831e4c348d03932ea79cbd6982e30d8f9269", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996674, "uuid": "2d8e06ad-897d-458a-8eef-9c982c976672", "value": "T17C83191FA381133916620225660F5BD1F7A48478AB36C7B4A45EC22D3352C79D6BFAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996674, "uuid": "eee6fd85-e702-4537-9cfd-264fffa208db", "value": "1536:DMUk82BgEC9jxTmdLALF1CwuOy3DbWVQiIQidVxDjmT9lDhQFlPlX3DV0WWjIj:DMUkdgECp4LALqw0bWIjmxlDyFlPpOW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996674, "uuid": "8b3ce600-21e7-4f46-965b-70671a0a1bd6", "value": 81241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996674, "uuid": "62c7ea50-668d-44eb-b9bd-86095fdd1f9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996674, "uuid": "86a44afd-ead7-41a2-902f-cef79f60d1c8", "value": "Claim_D280.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b008bf-fb27-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685038216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038216, "uuid": "e5eef4f8-2ad6-4358-b65e-a189fd1a35d5", "comment": "Malware payload (RedLineStealer)", "value": "c3f9b42d0503c702ef16041d7514b40c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038216, "uuid": "d567c8f4-fe73-4182-82a7-16bf72828f0a", "comment": "Malware payload (RedLineStealer)", "value": "a669ab0a60d4d8c8421d88ca8d8f826d7ff82f9a4e2bb68f0c57e5c109be7c47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038216, "uuid": "74fe80a7-5b22-41bd-839a-4d339e729000", "comment": "Malware payload (RedLineStealer)", "value": "d30a59f1703ff21bdbc758d068212367899ac894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038216, "uuid": "7eb13faf-1d50-4a64-9255-bacd51a27f91", "comment": "Malware payload (RedLineStealer)", "value": "2f49c76f2ba9fab9b5ff2d486074fd7c84ef66570948a67a8c0389d4a0424bab26ae4c0ab4ea71acbbcb73188cf89d51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038216, "uuid": "876e7aab-77d0-4fe6-a050-c4d282beff64", "value": "T1C7F41353A7D88032E9755B3094F313E30F3A7DE2DEB4822B2315996E1C73590A572BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038216, "uuid": "8c0fecbf-214a-40e5-a83a-c60d74045588", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038216, "uuid": "565ee84f-24e7-4317-9eec-c89a098ed42f", "value": "12288:vMrLy901+wkofBihMhQSmw7/eyJolg39Vvx/oNUTF+Q+f3av72bW+ETm:EyIk7nSmw72yJ8g39V++TFj+PS2bZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685038216, "uuid": "a36bc6e2-d2bf-4d35-8b4f-922494961a4e", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685038216, "uuid": "1e87ae33-91dc-4369-ac3b-8ddbc46ac0a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038216, "uuid": "39df6510-abd9-4b83-a5d8-fbbf4f5d2d5b", "value": "c3f9b42d0503c702ef16041d7514b40c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38305e75-faea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685011939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011939, "uuid": "a61e0744-2660-4285-ab7e-ec5ef9047553", "comment": "Malware payload (AgentTesla)", "value": "dabfd7cf473c8d763351a683db36ae1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011939, "uuid": "0764a2f2-f4be-443d-a23a-d3b904f647f3", "comment": "Malware payload (AgentTesla)", "value": "a75f12f4515a1b8ec221711d0ca1adc6eb517a4565fd1af93c9c93f52035a986", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011939, "uuid": "a9ed1f67-25bf-4868-b1a1-a517fc182094", "comment": "Malware payload (AgentTesla)", "value": "8ad03bafc68f7814a6a24be6df69dad76267eb9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011939, "uuid": "8e666bc3-2364-451e-99b3-11783c764c01", "comment": "Malware payload (AgentTesla)", "value": "6f26fc6b0e8ac4c18d164c57814e40b42db2c784f24e129b6df869244df06c9ee381a21ccea3211bb8e8790678031c71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011939, "uuid": "a066accf-543a-4e41-8406-b5f11d1a0457", "value": "T1DFF31917BF008656E8580F3048F78BA62661FD446F520A0B3219F72DFDF17E49E2AAD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011939, "uuid": "51b96667-fcc2-4261-9c39-21f4fb6426ee", "value": "3072:r5fZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA79Z6AFsTye:dZ+RwPONXoRjDhIcp0fDlavx+W26nA78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685011939, "uuid": "dcaf1c7e-28ed-44fb-88bc-972551415a87", "value": 161280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685011939, "uuid": "18811114-d59f-4c61-a904-d4c116de46d6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011939, "uuid": "d082f92c-f418-42ff-b4ad-1197ca282a9b", "value": "004179599.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b03f24-fb4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685053456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685053456, "uuid": "f7226411-8ef1-4089-9fd8-730793b255ff", "comment": "Malware payload", "value": "7dfc684dd97c18828e2a85b6415dee45", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685053456, "uuid": "7c4f11c6-d30e-4b4e-8a71-a3ee4e9defc0", "comment": "Malware payload", "value": "a76c4f346a0f72cc1fcf8c471abb0ecd2e914c5863a4f4556d884212f8d3b2fb", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685053456, "uuid": "8d0d3ab2-2876-4177-a8b0-d29b3257abe8", "comment": "Malware payload", "value": "5c2de26ff4d9993852e1397755c561e4b359853c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685053456, "uuid": "e2cfff25-f047-4880-85cf-7936ac674db3", "comment": "Malware payload", "value": "a3210d9cd164883b6c7ce5ec7fce575a430cb09270fae0a87fd3300310e3d66f8166f71eca936c0f9b3e4819eb857a71", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685053456, "uuid": "05c87992-2c36-4f68-b1a2-007f87f1026c", "value": "T1880733B9DE983871E509A8FCCCB99F30C98ABB6F1B65DDF20167408796163D04065EB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685053456, "uuid": "280be2e6-27a8-42d6-8626-85593f0633fe", "value": "393216:r2efotRw13R5G/1SZ41JHfKmTb2jPAU6BVAPxHteNYh:Xw/q3Rc/1S0Cc2joXBV4e0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685053456, "uuid": "ec4839ac-c105-4f81-b9ad-98a0dcdc5612", "value": 16852140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685053456, "uuid": "006c7ec9-74c9-4a99-b70c-90ccc21bda15", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685053456, "uuid": "25d9db2f-4dc8-4ae5-938f-d2e07d998776", "value": "2O23-F1LES-S0ft.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267cb62e-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003748, "uuid": "b73928d8-fda7-46f1-84e2-38b7a9fba5a1", "comment": "Malware payload (AgentTesla)", "value": "33c9e0b98954f80ed694998114578c3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003748, "uuid": "98d23b8a-0149-4583-9d00-96ee21a1d67b", "comment": "Malware payload (AgentTesla)", "value": "a7844d54db8f79a6c878de38086ea87e7bd11ecc16f0550f2258b6cd134392e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003748, "uuid": "f7f5ba16-c5dc-4c93-8a7d-6cdd55af819a", "comment": "Malware payload (AgentTesla)", "value": "431a8acc88b4766910904ded92da0451b19b1f58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003748, "uuid": "fce130fa-2a59-468c-b466-080baaee3014", "comment": "Malware payload (AgentTesla)", "value": "b372a1cc4d507aa84500a970471d938ee163b9e6210cb1f6b4f6dad4d6181d8117286509136bf67525c91e5797f3942e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003748, "uuid": "edb6393f-85be-4f5b-8058-7c95d143138e", "value": "T198D4F16B1B4B8836C43506F88525E2F992727FE4252BC32B9DE77C73F5383839906196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003748, "uuid": "96dfe74a-e287-4b88-b35c-eda288f75482", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003748, "uuid": "141e72dd-545e-4bc9-b1de-5f1121d1c5e8", "value": "12288:X+ngsnqoSdNES81XF8ukAVLAS50fFFsCvsuXpugDqD4GIOH6Cdzss:OqdNES8tnVwFsCX8kjYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003748, "uuid": "3127a5ad-7462-4282-96ba-2d1b7f4b4df5", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003748, "uuid": "2280eb51-dcf6-4473-86d1-357dbc2d7c6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003748, "uuid": "834cb1a6-18b6-479a-8a17-42250fb31b2a", "value": "Q-44315.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27123943-fb10-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685028231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028231, "uuid": "685cdc0e-0e9a-42ab-a49a-df6d69ab0389", "comment": "Malware payload (AgentTesla)", "value": "73bca260cab0d031b5d3c32c1ab0f679", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028231, "uuid": "440e8349-8a14-49ea-9b7f-679302285e92", "comment": "Malware payload (AgentTesla)", "value": "a7cbbba4240bca662bb18a1b8f3de13c839b3714ca8a869fb5c99dda91f43913", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028231, "uuid": "e552304e-a3cb-409b-a241-a5634ebd19a5", "comment": "Malware payload (AgentTesla)", "value": "88b617bfd6518710c0876970568db69625914d14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028231, "uuid": "bc1b281b-c514-4f32-9922-6ad4c781e086", "comment": "Malware payload (AgentTesla)", "value": "bdc1bf31e89572014b91aea1e984b204352c418d8778b4bc4511a82a49154a784e5da959cba9a0764be14166ac571e79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028231, "uuid": "0044dd8c-4a06-4dce-a71e-c7b726f3621a", "value": "T12AE41255366E3F16D479C3F9843439B963FBBA6A7072E3092DEBB0CB616AF014501983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028231, "uuid": "682796e6-4075-43a4-88d6-88794afc5bde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028231, "uuid": "8bef7ec0-c44b-4117-8f29-e8726ed0b960", "value": "12288:xzWmzZBEP85uxrKX7pHa4Sbpk6Qqp2v7Xt8qV5BOOkHBQCBS8ZaVstAJ6+t:99BEP8OrytQvN+d1ByHB5oCaVJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028231, "uuid": "14f45414-2a7d-49ad-a9eb-9c99dc789638", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028231, "uuid": "2dbf1cfe-7eff-42df-9591-81a5f04969ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028231, "uuid": "4b198291-8951-43c4-9daf-0cf8e2f49abe", "value": "DHL SEVK\u0130YAT B\u0130LD\u0130R\u0130M\u0130 VE SEVK\u0130YAT BELGELER\u0130_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52a1588-fb10-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685028469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028469, "uuid": "3ccf1f31-ac0c-4cd6-b39d-afc4c2be06ca", "comment": "Malware payload (RemcosRAT)", "value": "f9f8c06338941342ca6171fbd7b0f418", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028469, "uuid": "6bdb5055-5970-4647-90c3-e1488a3c6381", "comment": "Malware payload (RemcosRAT)", "value": "a92e5d75ad4b92ef75d516f16ac09d3b2c171ed3c75f137290640db1d3d76162", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028469, "uuid": "235784b8-f62e-4b4f-a7d3-fe6ee40c948f", "comment": "Malware payload (RemcosRAT)", "value": "5e0115c4e079da2dd2c2ba3313ede4bd2fd9aa87", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028469, "uuid": "6576c620-b198-4c37-99ed-4bbbd2bdb959", "comment": "Malware payload (RemcosRAT)", "value": "8e4a3d930510739df5530e6a22c65f12147abc27310d2cb57477782ae7d3537d1f5bb4775ae5d610cfe1be82f1867c7c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028469, "uuid": "fbac8c94-b21e-4d01-9b8b-3048710476c2", "value": "T16B06E13306C7FCFA67F23D58C6423A540CC86CF3A32E6699FD4905BA26B8454DA948F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028469, "uuid": "dd06c0cd-16ab-4688-9c0d-c7fbb0d8fa3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028469, "uuid": "eaca28d7-ce5d-4a8d-8e8b-90417acf06e5", "value": "49152:4I1mAs77KUizz6MDQiKstlmo+O1O3OiH9hluE1iTKVP4:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028469, "uuid": "8f4f2d83-9934-4327-9af5-3d8fd364b1da", "value": 3957760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028469, "uuid": "820803d1-5c5e-434e-bf68-3934e3306845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028469, "uuid": "61ea60ba-a89c-48fb-a4b9-457da792c91d", "value": "05118599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0293714f-fac8-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997246, "uuid": "39bf794c-57a4-4d0e-be71-f5400626b7a2", "comment": "Malware payload", "value": "e72a6f8e9ef8c1642b2e26f1720b8cbd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997246, "uuid": "df01752a-84e9-4f01-9332-9d1fd127fc08", "comment": "Malware payload", "value": "a95b9eafd9bc0a72729cf15e8d9a7c69168aeb1cc31225a65c8a713179adc8c0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997246, "uuid": "6d8c052f-06d7-4c3f-bb6a-fedcfc99066a", "comment": "Malware payload", "value": "51c00fe17dc5a898210a9d25565c795ea2fc86d6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997246, "uuid": "f43fb6b1-11c2-4cc8-a069-2a2e6862f9ba", "comment": "Malware payload", "value": "a83940f19ba7a724890e5de546adaa1fd7c9648178bdf18aec4a1e7f36464486d3a980aad69948a003cbc5f6a6334438", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997246, "uuid": "3c392155-bcca-4777-bcc6-6bd914d09403", "value": "T1BE4442814B5114B24B5B6E226B3094A5DBBE1E7582CC5A8BF45E3261FBDEACCCCD1331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997246, "uuid": "b90cd732-1bd1-424a-9b4b-c681be554b18", "value": "3072:j3Lr17MxnEeCCENFJD1TJ/fhkN+M15bOY5RVCzKlCnXqv1pr:Pr1wmCENDDhkNFrbzDeoCnXqv19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997246, "uuid": "de3cc4ac-0269-4676-aee1-996045abbd0f", "value": 272362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997246, "uuid": "c147223c-740f-4921-af42-57060d699d09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997246, "uuid": "774b67f0-ef7b-4bdc-a645-5d4e4b555842", "value": "jasminaceae.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b582772a-faf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685018591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018591, "uuid": "ca2f4018-dcfd-40a3-a3c6-a1e42ed414aa", "comment": "Malware payload", "value": "6ed196ad69bce2ce5034e9e8bc2cc378", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018591, "uuid": "57c258f2-da01-479e-b89d-aafbf98e44c5", "comment": "Malware payload", "value": "a98d3042bc3b2333ebdc8208e6e1a7fe274bef4241bd4c8af69dfa5487412156", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018591, "uuid": "a3e568ab-4a63-4cf6-a292-10f903c2cf45", "comment": "Malware payload", "value": "cac765a372327fab567c1beee58bfe718cc82ce8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018591, "uuid": "6830b0de-2518-4196-b26a-9199ff2f0bee", "comment": "Malware payload", "value": "48b66f0c2f50c7ad1ab00de74fdd593b3a39826139661e4bcdf73e166078d5b2a805c6623b0da5df92daf64eb193b552", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018591, "uuid": "5a5b7439-d771-4ece-b571-dd2a372ac58c", "value": "T15114B8804B6524724B577E2A6B3094A6DABE0E7182CD5A8BF45F7260F7DE6CCCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018591, "uuid": "53d8eba4-bd3c-40a8-b9a1-7e813342b6d3", "value": "3072:t1lITFYMr4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:t8CtDqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018591, "uuid": "7fa3185c-3988-410d-b29f-8a3e6da64a7f", "value": 207120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018591, "uuid": "c8530757-7e0c-472f-bf1e-51e23928fdbb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018591, "uuid": "7a7b7414-3ed1-4534-8572-cf75ebfc276d", "value": "Apkkkv.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1365f3-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997104, "uuid": "5c0de564-03d8-42cc-8987-cf46e5f021b2", "comment": "Malware payload", "value": "4b960db8050087f82c6fa69d7cc2be84", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997104, "uuid": "58213495-8db0-45f2-b8a9-0e9aa7bca9f2", "comment": "Malware payload", "value": "a9ed6b73d789592818b13c02fcf778a3bd022e620dd222367975651c3b4dd956", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997104, "uuid": "34333a9e-33c1-4024-8261-9f58b3e09033", "comment": "Malware payload", "value": "0bd36bbeb65e242c26661628bc2db79c78c59254", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997104, "uuid": "eda7eca5-4f07-4116-9435-ad1d4207f973", "comment": "Malware payload", "value": "d7c556993ab39592928052df70380a29e255a03b8b9030d4a49638343884fc2b63cfce391e249fd24ffd3e33918f0969", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997104, "uuid": "82cee534-74f8-4c37-a492-6fa66387525a", "value": "T1B86422914B5564B64B9B7E26663094A1DBBD1E7082CC5A8BF49E3250FBDEACCCCC1331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997104, "uuid": "284edcd2-5c97-4617-8423-1e141309ca23", "value": "3072:43v6cyMqgkIah4T+fYu/sI9k6qXsTxldObqs0:JDMpkIah4T+fYu/F9xxld8qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997104, "uuid": "bdb4a815-9e0a-4a9a-9e9e-e73c0e9ad79c", "value": 308930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997104, "uuid": "820f4abd-43b5-40cf-b345-278e99cc690f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997104, "uuid": "0bcc0f9a-c39a-46ff-b7b3-07e419f8f93e", "value": "naziritic.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d509a8-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997036, "uuid": "82bed01a-04a6-452d-98cb-7c3d9ce695c0", "comment": "Malware payload", "value": "51f19bd9558bf9fa0df2a666236bd913", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997036, "uuid": "70a3061d-f7bd-4f27-85dd-942e656e385d", "comment": "Malware payload", "value": "aa0a00892f578a20b9558487b7a7f557b4587749a9d46dda1dbc5d56a3b74a06", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997036, "uuid": "07bf808a-10dc-41de-96da-5ab2f6eca17e", "comment": "Malware payload", "value": "9e620d72a9294757e3610741f898390d4ac940a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997036, "uuid": "0b7dd4ee-bce0-4b07-9dd7-0c15bbbe2b67", "comment": "Malware payload", "value": "426e7eb56a8606a4dc5ec14c1597110862eeed299cdf01be2d6f97b881bf37966810ef694ad4fe3a9da3fe850626161b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997036, "uuid": "304d18dd-ec8c-4fd1-b89e-ff67dc8af7db", "value": "T15C44A680475519A24B5B2F36A73054B5EFBE1EB9C2C8588BF46FB250FBDE94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997036, "uuid": "da25ee4e-3587-4f1c-8737-e543fdb43f31", "value": "3072:WZLxZP30ZyCd+rQ7YcZq75aLrGdXpmydTKikYX9dmp0G348bfjO:yx987bZq7x8ygCNrGDfjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997036, "uuid": "7251e904-da92-40e6-a801-8433b9c1de6c", "value": 261992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997036, "uuid": "d0105b3a-127c-4571-bf32-9457473bc585", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997036, "uuid": "5e138009-0da9-4c9a-b875-09525746e149", "value": "nonspirituality.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45990441-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997788, "uuid": "9359ebf8-2ee0-4eff-aa22-9c8eda15c8e3", "comment": "Malware payload", "value": "02a5fb97d3b7d2536d2226e9416ebaac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997788, "uuid": "a4b703a4-99db-4699-a6e4-a1dd9bb5278b", "comment": "Malware payload", "value": "aa0b40d7d04c9e22eec1c8e845657d15d50c5545a25e88d6d05f4916d86070f4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997788, "uuid": "b5824ed3-51bd-4fa8-a1b4-5d7d068313a1", "comment": "Malware payload", "value": "3ffb76f113e33b9eba75cba5d3db85dae7e17643", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997788, "uuid": "ef44b341-cd33-4933-b4eb-f902216b699c", "comment": "Malware payload", "value": "2c2993f241f0d122da6aac9b290a9c84b8b4d84baa39ef8a3f16701e790743f85d7249d3f27bca5f317ea3bbea20a9e3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997788, "uuid": "550c6612-470c-4098-839b-f23cfe5e7793", "value": "T1F24455814A5114B24B9B7E266730A4A1DBBD1E7482CC5A8BF45E3260FBDEACCCCD5731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997788, "uuid": "1084acf6-3960-4b0b-bcc9-030b96407e58", "value": "3072:KQVwSKH8YKusw5YmRDz9PF0vYpTLQgRxx3WX5Z3guHUUOtiYLx0Hq5BGmHYFJfgN:1GzwORdFFxQ7YKYSfY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997788, "uuid": "52f9b8e5-658e-4292-ba9f-6b2c41405985", "value": 269288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997788, "uuid": "0015dc7a-bb80-465f-ab07-b0aa84c21eb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997788, "uuid": "ac6b6cd6-4314-4bd9-8aac-844e7ef0663b", "value": "Pronymph.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add9de3e-faf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685018578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018578, "uuid": "9ca100aa-47f1-434b-a204-d1d93ec9cdd5", "comment": "Malware payload (Quakbot)", "value": "b03fea25ae557aa8911e7784262806ed", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018578, "uuid": "a7d3fa96-df70-4cd8-abd5-f078f45afa8e", "comment": "Malware payload (Quakbot)", "value": "aa11cb5fe4d422867bcc83734380ba17e2fda100f76ad006cb388d19766c85eb", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018578, "uuid": "31b33006-5a30-4d18-8d41-bc94f716be9e", "comment": "Malware payload (Quakbot)", "value": "ec16cf2b88abb42dd92b1344498161c25a2a18db", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018578, "uuid": "3cce8055-7b4c-43e3-a087-40cb754e0c94", "comment": "Malware payload (Quakbot)", "value": "03fe4bf7a365caa56a2f7e6788373c6cd909283c7a6d1e9bd3668873f734dc6e574dbc450d91735dd774a56632204d00", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018578, "uuid": "ae739399-2445-4435-a475-26c5ea0ecd8c", "value": "T1A0731A5F6341133A55620124690F6BD1F3B48878AB62DB78945EC26A3352C38D7BF6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018578, "uuid": "58b7d6a0-b0e6-4215-8831-f6075e5f9898", "value": "1536:RaBhLmtZP5UJm9+FWbS8PavlDhQGjI+UO/k4VoE:ehQ5kFiPavlDyP+UN4VoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018578, "uuid": "31443b88-d393-4aaf-b00b-8d893549a723", "value": 77787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018578, "uuid": "faf98b59-0816-45a9-a689-431197596261", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018578, "uuid": "cc859fbc-6b2f-47b8-83d9-fac14f5fbc15", "value": "Claim_A650.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cbc4ef-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997897, "uuid": "67844c7c-e1f4-4b36-877e-c737aa420572", "comment": "Malware payload", "value": "476fad0a9b9f0b665b416beb78b55cff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997897, "uuid": "f7c81818-cdad-4e6e-81cc-2c696a46a1d0", "comment": "Malware payload", "value": "aa18039b1459c1054b2ead589186d0c3e1e02cdfebf5f4642e1b5cc13af8c104", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997897, "uuid": "22226e70-d066-493b-aff3-b265761200d2", "comment": "Malware payload", "value": "c5631292a9e8c5887e3674c819cd3ee4aab786dd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997897, "uuid": "9ba3f205-731d-4b6b-b752-6f65147aed1c", "comment": "Malware payload", "value": "40467b7c22156f636093cbb683a549c77becd097011dc460e4fc4501c67f01c2a1c80c7351ce3f7cf6ae6394311c1cbb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997897, "uuid": "91f953bf-a110-47b9-a35b-936fc44878f9", "value": "T13E649680471518A24B4B7F36A730A4A5EBBE0EB9C2D4598BF46F7250FBDF94CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997897, "uuid": "6214c0ad-fd87-4fcd-8b4f-44c66bdeaaf6", "value": "6144:ZFfjJ+xra8vNL0KrsrFLH3XcHso+wZjWCMoowzZa0hmGbmgLMa:Z5jJgl+R3XcMmjDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997897, "uuid": "81b25f10-becc-4e04-abe3-6ced887457db", "value": 320228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997897, "uuid": "99807047-a6e5-4f61-94eb-6239742ea44a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997897, "uuid": "49a3bee1-8337-45ca-8820-69fe905d4378", "value": "Semischolastica.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e744203-fade-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Meterpreter)", "timestamp": 1685006956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685006956, "uuid": "0e231d10-0220-44d6-822c-bbb3b8fd0ef0", "comment": "Malware payload (Meterpreter)", "value": "47dea1104636b3ed6aa7ec14ba2882b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685006956, "uuid": "9282e8e5-e25f-438b-b806-d58f5e25a064", "comment": "Malware payload (Meterpreter)", "value": "aa3c3100712e0f4d8dce28f9f3690326b0519336eb95decbd9c941d6cb3ce906", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685006956, "uuid": "838a4d61-152a-4c75-bb19-8eeda3879919", "comment": "Malware payload (Meterpreter)", "value": "68e315dace1d0d5c983f451efa71d0c88faff275", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685006956, "uuid": "445dc222-f8cb-45f8-9cdb-3c2124f9f688", "comment": "Malware payload (Meterpreter)", "value": "0e6ca3fd240c0fb583cb6e3899216a49b35404de1c77f46745ead45e5f1d5ab1bb2bef7fb17c9586473fcfcd3cb2b935", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685006956, "uuid": "97c2f2a7-4ce0-4bdd-9bdf-029525bd7744", "value": "T1E2134B4FF382A8BDC46BD2B482DA93739D727C122530AB1C1B74E7513E209A46B7DE44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685006956, "uuid": "a9d07541-d97a-41ce-8a7e-896907a156a4", "value": "1b170ed3d008ad9b4d1768ab531079c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685006956, "uuid": "b97abf2f-779e-4e56-b403-5e44b845e506", "value": "768:Ftsv2z//u5KsjyfPeDtkOFJYgLa1jqRmb4QR+y0z:bu5LIPOeqLa29pyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685006956, "uuid": "08c09422-30c5-44d7-ac4e-531803e2b30e", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685006956, "uuid": "02347917-49d1-4a90-943b-3f34c0df5b72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685006956, "uuid": "38f4a2af-3473-4dd5-a3cf-b70594d067a4", "value": "aa3c3100712e0f4d8dce28f9f3690326b0519336eb95decbd9c941d6cb3ce906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c3ba04-fafb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685019296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019296, "uuid": "2de19a39-f0b6-46ef-950b-8a6ed7f14954", "comment": "Malware payload (Loki)", "value": "546d1acfb459a73036e392e5b0d2ec4e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019296, "uuid": "1bdb5b13-8cdf-4dcb-aaec-1fb6a4db5360", "comment": "Malware payload (Loki)", "value": "aa61d7e7a1009e5a8f3bb77448176ab7cfed35c0ad32f35ad581a2993b88a4ff", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019296, "uuid": "ec500d5d-8cb1-4a3b-9f60-281d6868326f", "comment": "Malware payload (Loki)", "value": "9ffc288b56b7c4aeb277e51cdbe0eee09c4ff334", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019296, "uuid": "f58b4875-aa08-444f-9b68-6e8682e3be92", "comment": "Malware payload (Loki)", "value": "a38c04dd6b5776a9e80ed35504ff097c2bf1f8d5c70b10b58850b7d408af14898b8df99db5b3504d50fccf029b5f879c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019296, "uuid": "2c386002-f901-444c-9215-129334a61401", "value": "T1C903295EE79B02648F911373231B1E899ABDB22EF35050B1746C933433EDC7A46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019296, "uuid": "6f797df9-0a1d-4aea-b5a5-e1e7c126fdf3", "value": "768:TFx0XaIsnPRIa4fwJMokzXtxmEb16UwQ/xJgyXoQdKeE4Hi:Tf0Xvx3EMoeX+Eb16UwQ/xJg2oQdR9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685019296, "uuid": "0238a05f-ba93-4800-8e8a-46e4d88ee40b", "value": 39596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685019296, "uuid": "0007d47a-cc4c-4b52-b7aa-4ec1278729d1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019296, "uuid": "f4efbf84-98a7-4cbc-af19-948daf4aeee8", "value": "Quotation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9925ff8-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996721, "uuid": "732bd45b-6b27-4ab7-b251-229dbed8de81", "comment": "Malware payload", "value": "9d83cc64e42b903eb9799f629a058590", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996721, "uuid": "b49fb120-3be4-4fea-8f30-728e000e0999", "comment": "Malware payload", "value": "aa7ff82b821f237242444d3814a7c1c17f25a8ef8d5d73ccef8fde4f03b6ce1b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996721, "uuid": "cb32a387-6fc0-430c-9c34-7212df0712ea", "comment": "Malware payload", "value": "46751caad09abff5862cc91d252c72c59b99d08b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996721, "uuid": "7a0a66ea-e384-4dea-ae19-4d6b50a35763", "comment": "Malware payload", "value": "4bc252c372d34223ddf82a232af474b3f14868c67a4913b0736409e2a8c9f623e246c76311dd1e2db6c1a2d2a921bc4f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996721, "uuid": "a3750452-7a37-4751-b58e-96565acfa5c5", "value": "T14F44A8844B1124B24B5B6E36773494B9EBBE1E75C2D8468BF45F3260FBDE98CC8C1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996721, "uuid": "ff12d345-5eb5-4000-b0f4-39477f351201", "value": "6144:yYXO7Vj/AJnaZBrbmS7fCbFS200SoCkeA:U5jYUFnWXZOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996721, "uuid": "9aa587ef-d4bc-470d-b145-5f6e12db58e2", "value": 277046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996721, "uuid": "f1a8f1bb-c61d-4117-9b2b-b354945be1a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996721, "uuid": "c4f156c8-fbf0-49f1-bd38-829724b387c6", "value": "forewarnedLimac.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673707d3-fae3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685009011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009011, "uuid": "7b62193c-a68f-4696-82a2-72e07bc3f282", "comment": "Malware payload (SnakeKeylogger)", "value": "a3083561095d45a1ce7a5966a457696e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009011, "uuid": "da75ab21-4521-4593-a051-589ce2305d17", "comment": "Malware payload (SnakeKeylogger)", "value": "ab08bdbb5cee3c7c6fe2d7de4c8b7c383316fe7e7dd467f6dfa81dfbe443680b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009011, "uuid": "6f0e87a0-ef2a-4941-a469-5a442694f6b1", "comment": "Malware payload (SnakeKeylogger)", "value": "6d36a80de80664a4464cd23a5ff5c655edf1a22a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009011, "uuid": "c2e7a2df-2f96-41f6-b587-33ed442cc24e", "comment": "Malware payload (SnakeKeylogger)", "value": "06380c3dcd877c3bb602cda67a354d3c55f4ee978df9b504fcc332c906a1fe5ffcf3d0601d1a43856fb2f49c6858f4e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009011, "uuid": "2d4f2ca0-056a-427b-ab21-ee87b8db7896", "value": "T129E423A43965D610E6BF47B11412A7F0137F9BE43962EA274C87F9C8DF43B460462E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009011, "uuid": "b9e5489b-1333-4b2f-8136-6a9bf1e1409e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009011, "uuid": "85433688-60cb-4257-930c-ebae8ed6afef", "value": "12288:4aWIm6lVvtzZBEP85jpoM8IfCfKbO4usHMpBy8fga48Krp:FTmIt9BEP8hm8CfYO4/spByOgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685009011, "uuid": "5a52fe57-c7e1-4e00-a2e9-aeecacc26e79", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685009011, "uuid": "b3264e45-8353-469b-b113-1faf0f55b02b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009011, "uuid": "f4221b91-22c2-44c6-a238-d0872d7f045b", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1d5bfd-fab3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684988241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988241, "uuid": "a3b035cd-d1b5-4ab5-9f39-73be9d892b4c", "comment": "Malware payload (Quakbot)", "value": "c92623410a159a02d1f61328936c3b38", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988241, "uuid": "dc798402-b7ee-42f3-a8f4-e7fec6fbefbf", "comment": "Malware payload (Quakbot)", "value": "ab822468b29a886865b71735e4b46398080fd01dac266b1c347edb73d17351a1", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988241, "uuid": "c8b70f42-148e-4c53-bea0-5696b5134853", "comment": "Malware payload (Quakbot)", "value": "34682794e80619b7836de8d2163f3ca854a56449", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988241, "uuid": "b8867f4f-8086-41e8-b1df-42df8f89b934", "comment": "Malware payload (Quakbot)", "value": "f29566fc069c83a4ef871dc9948d1ac65c5246cf59a1e96137a051ab1065e928a1a38c562616179300aa4333abd39d15", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988241, "uuid": "6151fb73-da03-4370-a16d-75f8c13bf631", "value": "T1CB832A5BA380137956220254574E63D1FBA588387761DB68E88EC3AC3341DEDC6FE9EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988241, "uuid": "2e8de913-e52e-4e03-b5e3-578cbe971bf5", "value": "1536:QZOVqscfjDyj/tQlt7ymXEss+ooO/1EySJtQlQcIjn:QZOCjOj/tQjs+ro1XSJtQCjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684988241, "uuid": "a6906e21-55a1-40c0-96b1-a202bd3c3f84", "value": 83241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684988241, "uuid": "f62e2204-7f4f-4a5e-84a4-801db5bef06a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988241, "uuid": "23368e16-4272-4bd2-a5cb-58fd6b576273", "value": "Claim_A320.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43de1feb-fac3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684995208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995208, "uuid": "63c69c09-ee9f-49b2-b705-10816f68844c", "comment": "Malware payload (GuLoader)", "value": "9ba1290d5021aa43ff6c403b57db3735", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995208, "uuid": "1bc5c465-dac6-40ee-b963-6ac70498a978", "comment": "Malware payload (GuLoader)", "value": "abcdc5e165c533ea06965c60e7a3e7f5dd3daedbcca3578866949b6865aec60b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995208, "uuid": "e0fffbd9-4d20-4c7f-9eb0-1482c31a7167", "comment": "Malware payload (GuLoader)", "value": "6a13f939c0deddac59b293a53093781305a0d695", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995208, "uuid": "25d31df6-8a6b-4f9f-82e1-84eae7c3bd20", "comment": "Malware payload (GuLoader)", "value": "152a289286956cada090cc1c628a40e919f2fc96c226fbbcfdc522036e84c2236af6aa727249353188d0aa45e814a163", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995208, "uuid": "7963bdc0-c895-489b-a3df-38f9f4826b46", "value": "T14BE4BFF0D243AEB28FBA155914693F702CBC1DDF0060B919950C68E9F5C6AB7386CDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995208, "uuid": "aba2545a-22b1-4ef1-8f7a-9c7d64c3d210", "value": "12288:S/63mm71LVP1UZTpjxEmJnGqWg9F6yjB0ziH2FlCccbXGp:A6B0usWgDuiCEbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995208, "uuid": "71868673-ef81-4cdb-82b6-bc1a86a7b6ec", "value": 694282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995208, "uuid": "5ec8ace8-0ab1-488a-b82a-bdde01d6c35e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995208, "uuid": "2a736095-a8ff-40b9-a79b-2044355f4731", "value": "NPO1075800392.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c44ee0-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685003766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003766, "uuid": "b6c5117e-7f14-4c56-83c9-e1f566e1ed4e", "comment": "Malware payload (Formbook)", "value": "13fb4a796023df186d30c586987d8449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003766, "uuid": "4fd0f315-664c-4af2-af61-ede6a23c1c8b", "comment": "Malware payload (Formbook)", "value": "abf70dba588f466608fec7e624bd9cf5f0f3064365139f3076faac8cbb4cd750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003766, "uuid": "015ab89a-66be-4f58-8ddc-feb7f3fd9877", "comment": "Malware payload (Formbook)", "value": "e9ff27600ffa0d53cd80cc9cd9a5d642c9a47b44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003766, "uuid": "206a811f-7064-4ed3-9a52-df2683ee2f60", "comment": "Malware payload (Formbook)", "value": "22833a3b073976cfb93bcdf3604ca0f3f7f1db96afa856d14fa1496c208df38069fec8ce4787d51863fdca03011ec52c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003766, "uuid": "866e9978-058d-4158-b793-33e2f408f74a", "value": "T17F4402C4AF79D9B7E5B1D93048B2C9562F749D36149183172B01BB5E79B31CA880F327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003766, "uuid": "8989f0b1-3812-40a6-b8b0-8b7864fcded7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003766, "uuid": "ee0b27ad-ea5d-4524-abf8-776613742e5d", "value": "6144:wYa6Oc6M8808asLV97wd0Bd8QFlnd/Z1SoDQ1OZh5yyrvO:wYIcegNT7m0P5Fl1eoDQ1OVDrvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003766, "uuid": "45b0e169-5139-43c0-ac8a-dc3c6c820463", "value": 269601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003766, "uuid": "05d5ea5e-ce00-4c37-a186-9265e4a73c68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003766, "uuid": "e83ab0eb-56c4-416c-ad56-d8f5763a56c5", "value": "z01-110 - K1088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b276131a-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999688, "uuid": "48e2ea07-5bcc-445f-a155-a430ee0dd78d", "comment": "Malware payload", "value": "bef107b890ff91ca94f9a3514aab283a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999688, "uuid": "089d5377-bedb-4569-9920-f63a4a25d019", "comment": "Malware payload", "value": "ac2a78d872d81164aa1c5e10de5989db76f36f9f963bf348bbcfa5ccf2820073", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999688, "uuid": "303490f6-529f-4178-b830-951801eabd81", "comment": "Malware payload", "value": "6a0b425a8f3b751fa3d889b4f34a23a12d1ae708", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999688, "uuid": "fd3f21e0-542d-4fb5-9568-c626aedf0dbb", "comment": "Malware payload", "value": "12d3e05a85c83ebe58c8ca94da4eb46088684b9b1ba45b1be00c7fae6661b9da29127069489f068f1ab0ff9de975ee06", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999688, "uuid": "0372ed03-2381-4621-8fdf-92d4ac7fec19", "value": "T12E6433814B5524B64B5B7E26673094A1EB7D1E7082CC5A8BF49E3260FBDEACCC8D5331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999688, "uuid": "8abed511-e08f-4a6e-92cf-3ef491d57cad", "value": "6144:Qu7vQDmgUF8lA/pJQND4FkqGEWVyCXbTiiQtxlADhNErC/OYKO9b1DAfjNdmBy/Q:rYEusJQmFkLEWVyCXqhrADhSrC/OYlF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999688, "uuid": "a8c5e65d-d560-41e6-92ae-0bc074ea7741", "value": 327636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999688, "uuid": "f4f4f7a1-4fb3-4fe0-b2c4-b4fd75cc143b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999688, "uuid": "04f8393c-6a7a-4716-928b-fe5b5c4e3bab", "value": "dartlike.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a4ed40-facf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685000491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000491, "uuid": "029def8d-8176-474a-abd7-fff47d63160a", "comment": "Malware payload (RedLineStealer)", "value": "07798ad6724cb972bb88ec438e1f6057", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000491, "uuid": "1e4e9d1c-cbb2-4f00-9c7e-db3a4d1a95c9", "comment": "Malware payload (RedLineStealer)", "value": "ac8e4e319a6f6849fbc1bc17f072e3947f95dd04767b06c9b891090796c7495a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000491, "uuid": "82192d46-d2a6-4ee6-a35b-17385b944145", "comment": "Malware payload (RedLineStealer)", "value": "60c41516f30bb9ea31fa7de14ab46d29c027c78d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000491, "uuid": "644b5cdc-8b19-41a9-8d32-bc26c40f7582", "comment": "Malware payload (RedLineStealer)", "value": "7a5cac7b280b0b1f9f202831b8be9c66f8eab93e70b4312ccedbe673b1dbb10131b05f07f4df53c8744da22de8600d8f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000491, "uuid": "21fe5825-c9e8-4521-a848-84db92df495a", "value": "T1F225224696D902B3E4F0277065FB22831B327CA268784B4F27169D461DB21D4F8767FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000491, "uuid": "79fc1954-4cb4-40cb-aac8-1993977d4e90", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000491, "uuid": "d62949ab-6085-4df4-a4e6-c3519076ea6e", "value": "24576:nyfztxGLfZoZboelWtgLGmzGVFhE/396GEZJ7K:yZxGDZoZ9RGqG7hiNKZJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685000491, "uuid": "9125db9a-5e95-4f0e-8bc5-be4aaf2cff63", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685000491, "uuid": "6cc07559-982b-4fef-be92-746f26e633fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000491, "uuid": "4f4c3114-ff54-4785-9990-c04653f63f98", "value": "M7R89424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dd4e87-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997199, "uuid": "f1ac3045-c367-44fc-b84f-8a72160f1a72", "comment": "Malware payload", "value": "6b3c2eb883a12caf0669115895f9c822", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997199, "uuid": "a1f2ea57-9dd9-4b59-8d2d-151e12e074bf", "comment": "Malware payload", "value": "acf03dd42c2639eacda3ed90cad99010f3a1c967bd9b5db98b530e2b84416884", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997199, "uuid": "a6898ae0-5ba0-4443-bf8f-f162da9ce268", "comment": "Malware payload", "value": "1ffbd4de829e67e15648dd2ae02829bf4a45eaf7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997199, "uuid": "1b32576c-d99f-454e-8ea7-4d8798fb213d", "comment": "Malware payload", "value": "f934d37ae5baa48dc8ec67b71d4bb4520382ed58483cc0d97da0358e675bab10e2ef96d27b45e7fef9449f9a695fbc35", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997199, "uuid": "a38973d5-cfec-40ef-bc83-d4d9ff4e0a53", "value": "T10054B980471528A64B4B3F36A730A4A5EBBE1E78C2C4558BF46F7251FBDF98CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997199, "uuid": "b8c47e11-fad3-4311-8acb-556fbc35cbb1", "value": "6144:raOU9cEMT3seZiwzEycOTLh2shSoy1D6Vj7sXug5iZATE9qryYjQI4KMAegackuV:KVHlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997199, "uuid": "3200e326-e59e-47b1-b993-4100f237bef8", "value": 282430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997199, "uuid": "96ae08a9-2ede-45bf-b837-5fda1350b4c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997199, "uuid": "000d96ad-3e70-4841-a3a9-6850f4aaccad", "value": "macromyelon.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb08e99d-fb19-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685032371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032371, "uuid": "85524aba-94fa-4c36-afcc-1fa8d4a43beb", "comment": "Malware payload (RedLineStealer)", "value": "7b9e9a82403c895feccbb3abc7fcd6ca", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032371, "uuid": "fbcc4b44-f05a-4415-9696-747b195f5cea", "comment": "Malware payload (RedLineStealer)", "value": "ad6de406918f235ea46c9c377059c17e6e1ddec6e1a642fedfd74345f93833b6", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032371, "uuid": "f95c28d4-297d-446c-b86f-a7f26f46fb11", "comment": "Malware payload (RedLineStealer)", "value": "0375902ced7489fa63f2dcb3ea6764d0363664d0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032371, "uuid": "468334d3-1d13-4bf2-89e6-6042f7c1087a", "comment": "Malware payload (RedLineStealer)", "value": "86bde436320a4f0e88fed84a21c79fe0cac51adadac6557126837529865d1ed4556d68b985d87bcfef88a9767556758b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032371, "uuid": "052d0831-3e1c-4cbf-8199-4b72735d8722", "value": "T105F4131376C881B2D8F027F04DF612930B35BCA29EA887A71B567D5E1CB3580923676F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032371, "uuid": "de13f48f-0937-48eb-9292-11cce6fedeeb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032371, "uuid": "423bed63-c398-4182-9599-5d4abf55d90d", "value": "12288:xMroy90kE/Kyc/fWkagrxzCAJ4pnvuZf7DQpbqbTuFP0qgS+fSavFsjWtEq3y:ZyEKBHWIropqspbqKPBf+64sjSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685032371, "uuid": "9e125067-b881-4e5d-a82d-98c41c15276d", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685032371, "uuid": "80dac788-1f33-4a7f-9130-7068d78175cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032371, "uuid": "fa10870b-a6cd-4737-880b-c85e265f8320", "value": "02244099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b45b7d9-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994791, "uuid": "662d3886-16d8-450d-bf41-8e54ecf96cf9", "comment": "Malware payload (Quakbot)", "value": "b2c9d065f51d04e76be0972d87bf1510", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994791, "uuid": "30d5c37b-437b-49d0-81da-8a4863f30f93", "comment": "Malware payload (Quakbot)", "value": "add1f1ceaafdd30586f2d2ff701c6b7a40e2a82ef8d794b1b0a3bea137c4df65", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994791, "uuid": "63e5cb0d-ee99-4933-9415-0dbb4e2f2484", "comment": "Malware payload (Quakbot)", "value": "4ff21a8e8886e6885e666a126ca9a68c9ae5a0ae", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994791, "uuid": "bd69bdfc-a305-4e39-82b0-6e2e4f207099", "comment": "Malware payload (Quakbot)", "value": "e5dd9a1631ea7086646766da9771785db6638cdbdf924ed1d91f0eac3cd7f4ac09ea7c5460b8dc8b0c7bfccb8c39ac53", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994791, "uuid": "e41ebeb5-cac4-4c43-875c-8858d83e1b21", "value": "T13963F81BA385133915230264974F56D2A7B488787B22DB74A49EC3AC3351DB8C6BF9FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994791, "uuid": "9fc37775-40f6-4135-97a2-c90783378bda", "value": "1536:oiOcIj/tQlsT/1ZOVMbFggmvyvykm+AGYi0OlDhslm/S1pim3DAAG3S:ojj/tQeT/1ZOcFKyvZJsiVlDylm/S1Xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994791, "uuid": "05267e5f-da6c-4f28-829e-377250557dc1", "value": 71831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994791, "uuid": "3d6f24bc-6f4c-4a28-b2ef-7fe8321f047e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994791, "uuid": "1cb1459e-3ea6-4537-bda1-a697a525eefa", "value": "Claim_C604.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84deb24d-faae-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1684986297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986297, "uuid": "1ba161bb-f9b2-4923-8969-8f4d8a14729a", "comment": "Malware payload (AveMariaRAT)", "value": "bab6fa4f7c011c79009c17b8c419cc8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986297, "uuid": "5137bf86-7653-4621-a764-fd63bf66103c", "comment": "Malware payload (AveMariaRAT)", "value": "ae0e8160ba8669893fc7c2dc70ca0c34b35f731921eb44932cb3dff539afdab6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986297, "uuid": "42670d03-1076-41f0-a94d-718b11f1f34a", "comment": "Malware payload (AveMariaRAT)", "value": "fd5342c5ed7559eba21dcd47df77b0eecd1128f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684986297, "uuid": "39f72628-aed3-4df1-9e92-4258014c5ef8", "comment": "Malware payload (AveMariaRAT)", "value": "8b1a53c9cb728a12a82210b68b7c3c3533792763077b9d11186ddd4176fe7379fad1940ea9a5fd1a9694834f4e28dcdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986297, "uuid": "751081ba-d578-41f3-b2af-4b2eb9cf58c7", "value": "T12704F10833A4D06BF06047710D78CAFE2AAABD259DA1171733C47F6F7935A92991E393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986297, "uuid": "29686ec8-fce2-4d08-b448-711c589a190f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986297, "uuid": "375fc692-7c3c-4dc6-bdd9-f5caeda7cb61", "value": "3072:2fY/TU9fE9PEtuvb7JnaICK9sAxVogNRP8r/1qnP/2v7NF+ZXmnt9RK5BO:gYa6h7Jn779sAPjUrdqnS7NF+Z6rkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684986297, "uuid": "f11e5e99-8b69-41d3-b7c1-9e7e4677b4cb", "value": 179754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684986297, "uuid": "11c29904-4ecc-4ced-9a0e-2a691c074d86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684986297, "uuid": "03a620b5-cc55-48b2-a163-979aa9d42365", "value": "bab6fa4f7c011c79009c17b8c419cc8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b962f967-face-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685000129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000129, "uuid": "906fc557-3dea-4719-a7b8-4d04dbb3923d", "comment": "Malware payload (Stop)", "value": "e522dd5963f7837e4c81d27e21dd460b", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000129, "uuid": "7c225792-21b5-4a84-a89f-6d020712e636", "comment": "Malware payload (Stop)", "value": "ae66efca8cc87504c37693456936d0cd1b51a6ea7a9725f9bdbf872f5ae01f6e", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000129, "uuid": "9b0eed0f-488d-4e7e-87f7-3c3da27d5b16", "comment": "Malware payload (Stop)", "value": "cceb29944b5000b45e265123662e1a398677014c", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000129, "uuid": "61ddf62a-1b22-4800-a058-7362fc035854", "comment": "Malware payload (Stop)", "value": "12b9c979b2dca61103c7e16888cf3f4586840b8a2db746c48de2d0acaaec31272e6cd37f38441f1de0c61c758fce5155", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000129, "uuid": "05eb7967-2ee5-4a21-94d8-a9ed56a27708", "value": "T1ECF4F10352E07C60E5368A3E8F2FC6E8766EF5B38E596B5522245A7B0C711B2C67334D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000129, "uuid": "e9bfd5f1-e64d-4aa0-98f9-f26d81ee0fb9", "value": "a2a50468f2f362e6d5d07749761bf2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000129, "uuid": "6854bb04-e16e-48bd-bd3f-9013ef66cccc", "value": "12288:tU8fzN6r2bGGWLKWALRHIVLcthO9hy+dL2xd/wI3tugYbxDgSeq2Tz:yA0r2KGJ53t85oxt8biz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685000129, "uuid": "87515254-7572-4648-aab2-806d1706ce6c", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685000129, "uuid": "20901b71-3e5b-4a45-9b66-a9d47af8c92f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000129, "uuid": "8cf049b1-a097-4119-a31d-77ca159a59f6", "value": "M7R22328.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f233fd-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998053, "uuid": "c71e4e92-7484-4f88-a5d3-40bd05ca1310", "comment": "Malware payload", "value": "85d11d5a15bac592752fcab29b4de5ed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998053, "uuid": "72ffc312-459c-48ee-b256-76b6fc8f8eae", "comment": "Malware payload", "value": "af969507448078fcd0758216dd981f1230c02bfc0497e3c181b374ae69a952bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998053, "uuid": "3a04e974-7b1f-48de-a4c0-4250a30c1303", "comment": "Malware payload", "value": "300c7351e30e6bf1df88a03d94c3fd71ccb30ff7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998053, "uuid": "2595b9fe-c274-4d17-b97b-2e8a7af32c03", "comment": "Malware payload", "value": "3288e74e862b8b82bfae3ce472b1ed87e5d036349f8ad9cf1618f540bc6049b5f3c061d9405a5ef554a27d1d7e48c638", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998053, "uuid": "679c1769-a4d5-47ae-9f93-f37215280d71", "value": "T12364A7808B1219A24B5B7E32B73064A5EBAE1F79C2D4598BF46F7251FBDF50CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998053, "uuid": "e68181b7-903e-4ef6-baa4-fa81b09188e9", "value": "6144:G2PUKxN9yZkQlXmvjIoe8w14jGvbpEfaSX0Z80jxDTf3iwg:DNa1Nvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998053, "uuid": "f2474cfd-af07-4bb0-9b86-8f10bceeff19", "value": 308739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998053, "uuid": "5061bae5-ed2d-45dd-badd-83a4540f2188", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998053, "uuid": "0e84ccd0-e95a-42d1-8e0b-9c6c1a4d68ce", "value": "Unaltering.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bdb76b-fafa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685018865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018865, "uuid": "e9bbfa1a-77ff-4c39-ad00-5d7f75601e3c", "comment": "Malware payload", "value": "fcb49c7f86d3a98238cd404c503d91eb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018865, "uuid": "0d623cc1-8214-4a82-913e-92945ec5c2d4", "comment": "Malware payload", "value": "afadee1e69122ea7a468648e535ef610077c3ebeabd67b157b2760b8f93b5d18", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018865, "uuid": "e2b43916-b937-4cad-b065-7dfb2c095a88", "comment": "Malware payload", "value": "ae67eac180c09499289ce0af8e0ad8ff12b7fe6c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018865, "uuid": "ceebb2c9-b3ff-4d3f-9d40-6e23840b5524", "comment": "Malware payload", "value": "3e4d6b136861b9deb5cd99363bfae30fdd71645a2b4afdcd6d0fd1413da8a7ccb70ba9ed4fe5e369d5d67be5bfc4b25f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018865, "uuid": "d411176e-77d6-4659-bff0-005bbba0420e", "value": "T1D224C8804B6514724B577E2A6B30A4A6DBBE0E3582CD5A8BF45F7260F7DE68CCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018865, "uuid": "c9b5bf30-cce7-4f0b-b518-e587f99eb8a2", "value": "3072:iFJ6ig/r4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:ijRFDqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018865, "uuid": "93918096-bdad-4585-8eb5-725be9dd9434", "value": 212004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018865, "uuid": "02be8db8-5f23-4c74-8133-d52bda1e4026", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018865, "uuid": "3fac689f-39dd-449a-aaa4-4453576ccd94", "value": "Brqlsd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27aef639-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1685003750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003750, "uuid": "5f8cbbcd-9578-40e4-9d88-4b2ed5c91790", "comment": "Malware payload (GuLoader)", "value": "4431f7d54d3f127a4a0340d534f0bef4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003750, "uuid": "32fdcddb-2522-4ed1-891c-bf4827cb6e85", "comment": "Malware payload (GuLoader)", "value": "afe92eb1d1163d53e3fcbe114ae1e2a1347e99121a946e5054ab2424d9775f61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003750, "uuid": "5b414eb2-5a36-428d-bf2b-970a75b1002b", "comment": "Malware payload (GuLoader)", "value": "7bf9c09d4c74a1753e3ddd4905c12a41fb5ee3bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003750, "uuid": "c9219e8d-b69d-4319-a9d7-8eea9dfb654b", "comment": "Malware payload (GuLoader)", "value": "b0b8b89e95dd1169917639ebb42908a557d2336ffdee120ee28d534f4641dc9815f582e4028f0d836a1d661a01330048", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003750, "uuid": "ed29f9ad-4315-4d8f-ba78-3e0467eadcdd", "value": "T14074014237B6C0E3D1AA4671DAB3D2E7BB75FD005A50166B23207B9F2C333529E29365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003750, "uuid": "a4e8f3f4-0605-489c-8444-d5f73c9c40bc", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003750, "uuid": "8ad11cc5-1ea3-433e-ab52-6fcf79305335", "value": "6144:S4t6LsKwbbbbPbbbbVbbb7bbH+bobRe0bHjk26W/9KinKXOl4tqQ+ypN0YqGJRyU:SkKwbbbbPbbbbVbbb7bbebobRe0bHjkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003750, "uuid": "6ffcfaae-dbef-4905-b802-aaaa508a4ee0", "value": 366432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003750, "uuid": "3eb91bb5-5caf-41af-9b6b-037f565e691e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003750, "uuid": "3fb566d4-e573-407d-b6f1-ce1c19dee118", "value": "Request_for_Quotation-7342000257QNR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c3c24a-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998085, "uuid": "d6e22060-415e-48ef-a463-2ccf1b9799f0", "comment": "Malware payload", "value": "f8fa394e9cc1e952ce70f5490e141f75", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998085, "uuid": "b58c493f-8ebd-4085-89f0-220b9443a621", "comment": "Malware payload", "value": "b08e0e7a652e88ccd31752bda2ccc3f0e0f1a1fb3c3d09809ba6b9d82070f6f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998085, "uuid": "8fa4017c-39cd-4bed-a5e9-e1a15c9c723c", "comment": "Malware payload", "value": "ca3a83b27ba01409c95201afb294a59a7d6fd43a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998085, "uuid": "bcb3f5d7-ccf6-45c5-a809-bc744a70f283", "comment": "Malware payload", "value": "499c1383f6e3e3b745ed5b55e5a780d44bbf5c520a588fc9779218f72aba23070fa711eb398d870807066ef7d57c945d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998085, "uuid": "4defc6c6-cb12-4088-8e74-b2058c2d55e1", "value": "T193549880471528A64B4B7F36AB3094A5EBBE1EB8C2D4598BF45F7250FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998085, "uuid": "5da1e986-ddf0-450b-b475-744da91cb5a8", "value": "6144:hWldJ9QNNmikWTqK0ZWK7S2Ix+ldokyDfx:hWu4g+tY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998085, "uuid": "011df8ea-8b0a-4a8e-a5da-b7179723cbae", "value": 301114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998085, "uuid": "99ef98dd-63c4-434c-963a-36caad149d40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998085, "uuid": "fa4b78e8-4c9b-42bc-98d3-06c3393baba8", "value": "Underlier.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e72842-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996694, "uuid": "777a8d03-1bc3-49cc-8264-5c5b3b602cf8", "comment": "Malware payload (Quakbot)", "value": "eb457c757649ec9e00bc7602a0c6dcdf", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996694, "uuid": "a45fa6b8-e079-4ede-8bd8-1190a7e9934f", "comment": "Malware payload (Quakbot)", "value": "b0d21423911729ef177941f18cdf2db225f628e3320c193411e79b8bcd4e2b45", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996694, "uuid": "b5b66f57-f97e-441a-877b-25206d34d70c", "comment": "Malware payload (Quakbot)", "value": "845dca73688c888bb7af840ff678dddd9b23947a", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996694, "uuid": "f7e7e4f9-a6f2-46f2-ae7c-2289ffbd1761", "comment": "Malware payload (Quakbot)", "value": "e071156e20f6469ed683a174f1060ba80239548ee46d665e450a432a4fd1bcf31d0daaf4a4e2b86eb77009c203237e67", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996694, "uuid": "7f1e39a4-7fb1-43d8-be52-2e48901605fd", "value": "T171531A5FA381037DA9220279514E56D0E7E148787B62DB74E88EC39D3361C68C6BE6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996694, "uuid": "5f5c1f76-8853-47c1-9205-e908779af13a", "value": "768:KiD6/1ZOWOCMdW95HWpciDXGO49dFABmn0L8X4rhyCAFMDAU/FU4iMlxIQ+6KxFq:KT/1ZOVCb5ScWSFOmn54fr5iHjxFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996694, "uuid": "2d886a18-073a-435a-8860-60f770da515e", "value": 65226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996694, "uuid": "0ef1c4bf-f467-4a38-8278-f26ae4c0395d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996694, "uuid": "0a8ee339-a89a-4878-8548-d0bdb1a407a0", "value": "Claim_D423.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9047f8e1-fb15-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685030555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030555, "uuid": "fffd2070-e59c-4ed6-94f6-c5753f2e9528", "comment": "Malware payload", "value": "47641ffea7b676f433fbdf9cd66b4b5b", "object_relation": "md5", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030555, "uuid": "a4172d59-7b38-4d62-88d0-6e75acf36d87", "comment": "Malware payload", "value": "b0e13f7370b44797c5c05291a3b03f280286263083d2f7c719defbdd55b42dcb", "object_relation": "sha256", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030555, "uuid": "e2719468-d234-47f0-8199-9e657caac6ad", "comment": "Malware payload", "value": "c44a04b98aae0ed54792ff4685c6dce994d72b20", "object_relation": "sha1", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030555, "uuid": "4e354aa7-9ed1-467b-be2d-71fe87027d56", "comment": "Malware payload", "value": "e495adea8745f16129d036c77492d2ee7fe53c87172ad053836e5f3901f0cfd3221a5d198ced7d370dae8fd27b663924", "object_relation": "sha3-384", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030555, "uuid": "811a748a-4a45-47b5-809c-3f2aaad03a24", "value": "T113C2F1063DB6FC6EF7985323AAC03993DA49472123BB6095322641167FABD214CE5DB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030555, "uuid": "da2def47-bd3e-4c0e-a8de-7ab30f730409", "value": "384:420CGuMMgOuTVcLSm48aSWty+vGjNMagBrwIbJc4ZiJ52+234ANe5k6benM29TJx:49CGuMuGea4jQ+T52767U9HJHOJBmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685030555, "uuid": "86574274-6281-4ae8-96cc-05dc677a87f0", "value": 26844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685030555, "uuid": "ad83fc45-3208-4da5-9380-6c35b0bf6b35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030555, "uuid": "6696c134-d91c-450f-806e-2e8bc3ce47b5", "value": "Invoice-DocuSign-May25-2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ea6500-fafe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685020528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020528, "uuid": "21f11df3-979b-4280-9a98-fe4204bb209c", "comment": "Malware payload (Formbook)", "value": "3284d65c939f0f37fec91640075da78d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020528, "uuid": "72946e8b-cb43-4c8b-9cd2-a27e2a05f78e", "comment": "Malware payload (Formbook)", "value": "b0f2f1f1ca40e62865e6e6024ccb5ef8691431c037289e5544ac69230d9b943d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020528, "uuid": "aaee8902-6150-493c-81d0-4475602a632a", "comment": "Malware payload (Formbook)", "value": "7f64f1b9b941b1c13659f5558c1a7185649cd9a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020528, "uuid": "8184f8ee-972f-4f81-9e67-1177dfdf40af", "comment": "Malware payload (Formbook)", "value": "ddbc0ce3037dbe8c3bca697088d2d5518082d32059574f069ea48ff63e9da99eb92cdd7cb5691494763f157b492b3b6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020528, "uuid": "10f062ef-6049-419b-b948-c0e7174bbdd0", "value": "T162E40292356C3F16C57EC7F98431327853FAA56A7132EB0A0EDBA0CB76BAF004551993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020528, "uuid": "a23e5aa5-4713-4fbe-885c-b5cf820a2aa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020528, "uuid": "8195ed01-fd97-4e7d-9b9a-9f2943a6de16", "value": "12288:B/CmzZBEP857YSrBKNT3bYv9CzJXS5unvzvcOjxDOULewi8S+pl9mbG5nayQYr+6:59BEP8dYTtbu9Czk5unvz02DO4mIXSw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020528, "uuid": "1ce0c6ed-647b-4902-a6d1-4ce360e00a94", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020528, "uuid": "8876f44d-6fa2-4872-9787-765b0a613990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020528, "uuid": "92042156-5ea2-47e7-b5f7-c1d4d22459d3", "value": "CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b5306c-fafa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685018887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018887, "uuid": "095f7cfe-e479-4cc3-955f-e7884a1ab318", "comment": "Malware payload", "value": "e9d34f05ff9459b03e9f86c6f84c6eb6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018887, "uuid": "7f1222ea-2fba-48f6-9dac-beed20815d85", "comment": "Malware payload", "value": "b121cd60432aa6c7d703e36ec9e5aedc4b9e1e7aae807becbcd7ab2d336c507f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018887, "uuid": "2f0dabdd-7e0f-49ea-8b6a-78db45c93ead", "comment": "Malware payload", "value": "440d1b3ea00f7fe6631eced772aaf19bd39d7b9e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018887, "uuid": "f696b2dc-a210-489b-8979-56d15c41a87b", "comment": "Malware payload", "value": "ed0db2912aef45454042f64ba75f2d45174336b339730ee2f2751f988b92fa88a72b80222b6c086a0b86a89b7e25273e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018887, "uuid": "2d8472cd-8a2b-4351-b5b5-9983824b1a8b", "value": "T1BA24C8804B6514724B577E2A6B30A4A6DBBE0E7482CD5A8BF45F7260F7DE68CCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018887, "uuid": "55bc9e5c-c55d-47e1-8784-2a28e0e26b8e", "value": "3072:1K6zSr4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:1K6zDqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018887, "uuid": "548d059d-f29c-491f-9690-59e86a536541", "value": 210612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018887, "uuid": "ca1cd1a6-1d21-46dd-b7d3-216e0a7b232c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018887, "uuid": "6bf98b72-7cbd-4089-8369-cde2a7297302", "value": "Rklgiqdh.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d806ae37-fb07-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685024662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685024662, "uuid": "d186ced6-13ea-456d-a970-f9975b11ba3c", "comment": "Malware payload", "value": "0193570866ccde892ad79e269fa1079b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685024662, "uuid": "78793c7f-8a1a-4843-978a-99e7dd21b377", "comment": "Malware payload", "value": "b152a159305a620a021e7954b08f7759a04d2ac27f6de5e06014a54ad1109d35", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685024662, "uuid": "326ce7a8-dd9a-4abb-9399-9d760ae8b771", "comment": "Malware payload", "value": "61b6251470a1f116470259ecee4b69714953d112", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685024662, "uuid": "f5846750-8788-4fcb-8ab8-ded187805021", "comment": "Malware payload", "value": "7b8cc27fa6a074ba15110f2d4a2dbcba0c7dbfaa7b02855e2b241f59391092f2aa0329d1968765c1a24d6d8775741cb2", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685024662, "uuid": "9ef6f176-e0ec-4d68-b27f-6530d57bd5cb", "value": "T125A43F6013E99A0CF2FB3F556DB952846F62BDE6BD7AC15C132024AE0D74E84D9B0732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685024662, "uuid": "a7b41751-2e0e-4516-a1f6-45fb734e576f", "value": "3072:0UsY/Z84cpLtSF5oNyt4+PvwWgNAO2jjjSNwv/ceB4GqOgU2iCpqIWmL2OCHPBro:dpSYJKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685024662, "uuid": "34a72f21-03fb-4f81-9ff8-01d61db8b64b", "value": 492798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685024662, "uuid": "41489452-363c-4fa2-ae90-a0073fa48f78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685024662, "uuid": "1b0f1313-44e7-4717-b333-20891dc75e20", "value": "DHLR0238.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9f4469-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998065, "uuid": "5038b7f3-c27f-44ef-b550-1211ef4a4e59", "comment": "Malware payload", "value": "dce8de06038daf4d4996ecb092f805f4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998065, "uuid": "38f2d2fa-3b2c-492d-a9c3-e8ac89f4a77a", "comment": "Malware payload", "value": "b2256cd12210ae2a8742f85da5cbd42cfba4155d80aa2d3757f2555844be9d81", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998065, "uuid": "4830eed0-c0e1-478c-8609-0d3d1f728a41", "comment": "Malware payload", "value": "90bd29e16f34c9c27ad8acbb8041653f437865f5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998065, "uuid": "21eb659d-a895-40d5-ae70-70b54febc5d7", "comment": "Malware payload", "value": "77cc0bc8762c7ffb0cd3d52d6188c88ac789e5e4f2aa3f704430428ff05ddf415aa5a8d63dbe2ed6a43dd762123aab32", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998065, "uuid": "d995aa10-fc2d-44c6-86d6-b3efec929891", "value": "T19C74B884471618A24B4B2F36B72054B9EBAE1FB8C2D4588BF46F7251FBDF90CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998065, "uuid": "aa2b55b4-7809-4605-9c43-27c027077c2f", "value": "6144:mXMi02UbRENk/IWZ0bwgYja4jfc/6zgflr:JiVYjaXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998065, "uuid": "ae0722b1-5e0a-40c4-bf9a-034099cd0da9", "value": 349416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998065, "uuid": "2a7cd4f2-1a1c-47dd-bd55-856805a07865", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998065, "uuid": "406610b1-52bb-4e9a-b140-a1f91f5d4edd", "value": "UnbecomeRenaiss.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab98700c-faf3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685015998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015998, "uuid": "8988b776-d6db-4928-9574-c6c2fea38047", "comment": "Malware payload (Quakbot)", "value": "d7ba3067079b116c16b5d9e713b90773", "object_relation": "md5", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015998, "uuid": "f71649b7-fc4c-445b-b218-4794952089c0", "comment": "Malware payload (Quakbot)", "value": "b25115034a50830319ec17085b37ab6e93db294100e5dbb3d6d0403498f3b862", "object_relation": "sha256", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015998, "uuid": "ebe3b0a9-1997-44af-a994-c25395848aa3", "comment": "Malware payload (Quakbot)", "value": "17969470fd311c5240422df796163503cd93620b", "object_relation": "sha1", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015998, "uuid": "e7ee58eb-9aa2-433e-9d00-2fef252bf568", "comment": "Malware payload (Quakbot)", "value": "d9deac7c1cb2bd9af9ac4d885836f04fef7130b98193d65411a492809518807d7ad8672852b82b703fea5c35f5feb319", "object_relation": "sha3-384", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015998, "uuid": "a39163bb-2fef-4ef1-b80b-dbcde8728d3a", "value": "T13114B8804B6514724B577E2A6B30A4A6DABE0E3582CD5A8BF45F7260F7DE6CCCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015998, "uuid": "982335dd-aa01-4c13-a663-648d5cb234b6", "value": "3072:e4+w3X6r+r4l1qDvatIVFcWwblWrj6/ns5JoDXn0PnC:z+k6XDqDvatIVifQJorKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685015998, "uuid": "56a2ef95-064d-4880-90aa-c6aaef0ee94d", "value": 206510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685015998, "uuid": "96e0112e-30b2-452a-8ef7-1cb9d14f9813", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015998, "uuid": "8e9ef2a9-0f8f-4e9b-8eab-61315f2edc3c", "value": "Semiobjectively.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5801af-fb2b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685039967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685039967, "uuid": "c025df10-8ac6-4714-bb9d-90c0191677eb", "comment": "Malware payload", "value": "803e0c67b76960ff5d9ccb360ba9636b", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685039967, "uuid": "ad8b02db-d169-43b1-a436-4f80b6e37512", "comment": "Malware payload", "value": "b2876080a8892ec02a11cc322cc18952d45f9e419c1cb6d4d070860c59fe87eb", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685039967, "uuid": "2ed62975-4bf9-4b73-a1da-2bd97ec27f86", "comment": "Malware payload", "value": "836d339682618638c6b2e3d156ad66a56e4f9ba5", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685039967, "uuid": "0fa31671-c69e-4c26-9734-93892b5fc798", "comment": "Malware payload", "value": "d24812556c74848e895c75308234e1ee57cbdf99efda0232fb3c640619a6c6362563b5ce019fe5dc65cbad12629bac58", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685039967, "uuid": "2e92438a-8480-4b01-abb4-77211d87bd5e", "value": "T188034A193B6BDB36CE0C0ABA0E7001C5876DC359F707D75BE5A40608D623BDA9262B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685039967, "uuid": "0ced5a7c-8e32-4d3e-92af-955736d52ee9", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685039967, "uuid": "a3c1d269-c495-41bf-81f3-66fa996e6b4b", "value": "768:G510wno1Zbwnfel+/Qq8imerlQ6wwVx7nO2G:I0hbwnmUYq8RerlQ6woVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685039967, "uuid": "c66b3ced-6f7c-4f21-96a8-670149885ea1", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685039967, "uuid": "f9b55138-168e-4d07-9a4d-59d17edd46b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685039967, "uuid": "54cf8d6d-4201-4bb0-9f29-fca608fa4b6e", "value": "sc0pe_hidden_pe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457291ee-fb25-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685037301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685037301, "uuid": "9c38c962-7346-4273-9ab6-3f806f737efd", "comment": "Malware payload", "value": "a6498c3be18caf506c57ccc583f62461", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685037301, "uuid": "4176dd0c-a372-4bd7-9c32-9e1021fe6ead", "comment": "Malware payload", "value": "b35472d4bd71abc436d5eeef223b81aac4ad00813abc2e66ed862b19165db479", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685037301, "uuid": "81f1756e-067f-42d7-9d36-4d829ffffca0", "comment": "Malware payload", "value": "f741f89c69a5d6dfbbdf05ca48b4178c0feb9fc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685037301, "uuid": "9c377c61-6526-44d5-8a8c-522e909e4082", "comment": "Malware payload", "value": "229fa1727f1649979ecd3dfd3048ac0cad840cb66a69effdc68b657828259ccc0c98f64283399c084851cacab7113741", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685037301, "uuid": "9bca3b09-ba6c-43f1-9faf-17a26f133376", "value": "T1D0F41212B6D85033E4B517B00EF713D70B3A7CE0DDB88A7B1756A9AE0873694A53172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685037301, "uuid": "27b85d13-e20a-4a3b-b375-812b5dc0d676", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685037301, "uuid": "86c6145a-1743-4be1-a2ae-289c3bd77956", "value": "12288:gMrzy908qGD2td9V5zszsOA2ZtCbPv4neFc5nsClq41MKJY2xdxPwUgS+fEavXsG:DyBqGDA5sZ6bMeF2ns+qSMKJJxnPrf+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685037301, "uuid": "7b0f496a-c187-4094-8ed3-4196f9146456", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685037301, "uuid": "c264a0a0-5a7a-4194-879f-4d5dc05bf061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685037301, "uuid": "f53cb389-6094-49cf-acd4-e00015802da3", "value": "a6498c3be18caf506c57ccc583f62461", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287c0261-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1685003752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003752, "uuid": "ef44febd-b01b-40df-ba8c-9240629bf9d4", "comment": "Malware payload (GuLoader)", "value": "f44d9e2b4871cbbb589197518f9614c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003752, "uuid": "a8f0ba27-f166-4907-ba33-1f8f05e01dc8", "comment": "Malware payload (GuLoader)", "value": "b378e58f55bd300d7030614667c7193f5d101f00ec3e756ade9408a9a1aed912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003752, "uuid": "c6feda96-05a3-4055-8c11-a8f94d506b6b", "comment": "Malware payload (GuLoader)", "value": "3efe701e205b7ce0da99ff7943252540a7783751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003752, "uuid": "f8ab6e1e-1e3e-4932-8d7c-43a96369e912", "comment": "Malware payload (GuLoader)", "value": "c652230941535d5d4ddfd5c8d2aa7bb8d2afb748ddd894b41f115d9e35b80d6dfbae8af0943bd09763a73e24fd18f5ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003752, "uuid": "3b2e9e84-8f8c-416d-8103-1b784bd14eb5", "value": "T18D340129B161C8A3DA5F0770497ECA64EB69B9481C56027F33A07F8A3CF7362871F159", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003752, "uuid": "dfcf2940-da04-409f-822e-28aa9b27547a", "value": "7c2c71dfce9a27650634dc8b1ca03bf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003752, "uuid": "2a3bfc9e-805a-45d4-8e2e-755bf431befe", "value": "6144:BQLFhKj4E05xikmnFEPfhRsVmukmzt/SdReBVtfwgpr:qFW4E0OkmnkRs4vi/OSwg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003752, "uuid": "e377b711-95e0-4628-ac10-6d2010b0c602", "value": 248440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003752, "uuid": "68b4c5b4-4aa5-4280-91fa-aceb533d7526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003752, "uuid": "a0629699-e461-4e79-93fe-d87181426c4c", "value": "RHG0987654345789000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bf2084-faea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1685012074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012074, "uuid": "2cbbfe56-b6f5-43b8-af73-4d82504c04a4", "comment": "Malware payload (YellowCockatoo)", "value": "6509004646c36b369da456c0bfd78965", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012074, "uuid": "aa96eeeb-abf6-46c7-9291-0df1391a4a3f", "comment": "Malware payload (YellowCockatoo)", "value": "b3bb8f346f6919aee3f06b996bc3be478d0e96c323c46ae8961b6940b9447f98", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012074, "uuid": "3c0ab1cc-c01b-47dc-b0ab-729c311ae21f", "comment": "Malware payload (YellowCockatoo)", "value": "c5cc36fe53918c7db09035effffd3e104d006794", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012074, "uuid": "7cd7bff1-e1e7-4e29-be98-a822a8c4dacd", "comment": "Malware payload (YellowCockatoo)", "value": "7dff768127806c17e2038510ce9c03465b65a7cd9a7447f876d64bf23b26fff1e7812fadcb9f24b9dc0e339f9e18ae30", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012074, "uuid": "7b4bb2fd-600e-48dc-bb88-b9e06bbc72c0", "value": "T1828533633A5558D0236FF6BB08FC750A3D5F9C99575912B8AC80F0D82BF5BA8444CA3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012074, "uuid": "6362d9f8-9f9c-4b03-841c-4a6934379ae5", "value": "49152:Asbj9Z420CBo+5wOWLL6Pn4UGR1xDFQtbt0oj4zNg0w:Asj9ZBoQi3sn4ZJFIfMzNg0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685012074, "uuid": "01cd13ba-ee34-44a7-b5f0-8938764c4a8d", "value": 1730132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685012074, "uuid": "45f4f052-d221-4921-b22c-4c1bb08c7f4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012074, "uuid": "c89adb3f-712b-4bd0-86f1-6d0882d6ab5e", "value": "057aa4a06395c384a2a9d29f499b410ac1da6fc2c10aa61908eea3e67a32b872.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266eab59-faca-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998165, "uuid": "797a5650-b95b-4871-8fff-e6423ad6856c", "comment": "Malware payload", "value": "a83fcc26b891c57eed8a7e6606c97434", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998165, "uuid": "01e29b14-33a2-40d3-b775-5153ef56d065", "comment": "Malware payload", "value": "b3dcd44ea27d5742efd32ed5717fd0bb15ab2ace46800f24f593eb92c3aaf8ae", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998165, "uuid": "f2c73096-5be7-440d-b52d-1c48366b1f4f", "comment": "Malware payload", "value": "9a1010f678eae741c263b72a1d167fe67dec2a74", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998165, "uuid": "5c29c095-a4c9-4f3f-b9ef-9b94b3244314", "comment": "Malware payload", "value": "5592a1c88b5ecb8ab5e1e634dac08cd7e90c54c0bfb9f0bc686a77fdbf592df86c1b97b684203a3145b79669b5a7e78d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998165, "uuid": "141795e5-0a18-45eb-af7d-a956d412ee84", "value": "T1056455814A5154B28B5B7E266A3098A1DB7E1E7082CC5A8FF85E3250FBDE6CCCCD5731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998165, "uuid": "8abc8567-c7cd-4aa2-91cd-1e84897f238f", "value": "3072:YWeMTioZS2JwnJoL1O6QC8IOvxvPHNQJLI6L1NTOxaNyy+GZw6tfCaZPB:hblE2JwJoZO6eIOZvfsHz+GZttfCgPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998165, "uuid": "1553c3cf-c084-4489-bbfa-32d921c7309e", "value": 316649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998165, "uuid": "7269a008-216d-4e19-bca9-8d9db39f6498", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998165, "uuid": "0b1c8470-f54e-44b9-b6dc-31211ed1bea7", "value": "UnhookAverment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ebc67a-fae3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685009029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009029, "uuid": "4c575429-accd-4f97-8eba-eab477784d70", "comment": "Malware payload (AgentTesla)", "value": "438669903956588f4d2d38af36d8a576", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009029, "uuid": "1311ea08-5e45-4a2d-984b-53cd19a242e4", "comment": "Malware payload (AgentTesla)", "value": "b3fbab4d8090fb6109b890d24c1e457db6e3f6bd5e17c6be2f2cb8448d53d5ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009029, "uuid": "4a54f0d5-7fa7-4728-9aa7-d95a2a0ed1d8", "comment": "Malware payload (AgentTesla)", "value": "c11b8cd74cc94a355e52b1a7c3b847e826c3a6c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009029, "uuid": "5112df38-df31-44bf-b11f-2fe9846fcb6b", "comment": "Malware payload (AgentTesla)", "value": "1e935b59d1a214ab4078980ac3693f79926a8200a2aa1e1bce45c11f7b45c65d25a30ffd3359e5a5c1b247417078a2ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009029, "uuid": "910dbd1f-5a59-455d-b445-841fa80f08c4", "value": "T1C9E412A0D5165248FEBF0FB00914A7B42EAEBEA9B4B0F2171C4BF1DDAA327470513617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009029, "uuid": "951fad81-823d-4620-baea-8d9f4994fe84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009029, "uuid": "72226e26-cb0a-4b21-b86b-a75d1eb8329b", "value": "12288:8aWIm6lVvtzZBEP85HE19rt764nNwXWjdClE1JOjXFE6gtffEWtHEZmxG:RTmIt9BEP8JE/rveqdClE/g0tNBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685009029, "uuid": "8435b3a3-edd6-4e40-8af3-a8ebf425be6e", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685009029, "uuid": "34e6fb97-424f-4085-8d21-778628e18813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009029, "uuid": "9b4433e3-1240-4bef-b026-3cc196020439", "value": "PO451033200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb06986-fa94-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684975310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975310, "uuid": "65422ee7-af95-461e-b6e6-a467a4d14a07", "comment": "Malware payload (RedLineStealer)", "value": "f0c6811c62766421c4c431ce213d5761", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975310, "uuid": "03e10b0f-d192-4d4f-adb1-4f9965c0a5b6", "comment": "Malware payload (RedLineStealer)", "value": "b47b381b7a5f551b7cfb62199b046420d5a3a1636f4893a87d1d5ace0d92ad39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975310, "uuid": "cce0d208-5c38-4542-abe3-44d60a182985", "comment": "Malware payload (RedLineStealer)", "value": "5a05c76ba9c25a6e12355d514adb103064717dad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975310, "uuid": "ec86bcf3-d5cc-4ebf-b5bf-535d471d4f22", "comment": "Malware payload (RedLineStealer)", "value": "f91f3c7b7d59755f45ca556eab2e92fbb79696fcd44dfd08dfff66b1944c72031bbf89e4901126d3ae3c51cf4993afaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975310, "uuid": "2966c793-eaa2-4f99-ab5b-2138cc95475e", "value": "T1FE25234B9BE94073D8A623B189F703A70B36BCB1DE784A4F22C495590CB26D464357BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975310, "uuid": "ad1f824a-07c1-464c-93ee-3c3481bed0de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975310, "uuid": "fc6bf52f-06fc-48f0-9d45-3b2a92497284", "value": "24576:/ylSKw/23guy7FGR+TGoqhn7pyI3LFqkfUNC7:KniuERGIGdhn7pJ3MdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684975310, "uuid": "3ec79b9a-14af-4498-9721-f76bd9746b56", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684975310, "uuid": "844ce2f9-cef0-44b9-bb0d-eff7609f444c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975310, "uuid": "ec038615-68af-4562-8bff-881ba14986f1", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2951d56f-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685003753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003753, "uuid": "9f173cab-e0cd-41db-a317-e74177d6f252", "comment": "Malware payload (Loki)", "value": "68a776690f12ac8aa78cf7ebb7e60d7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003753, "uuid": "4e07b890-4dc2-42e4-9414-d6902edbcb2e", "comment": "Malware payload (Loki)", "value": "b4887c43c8572596584d121bb4a017659d2fd6813cb1151b3c5e7902ed7ac12f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003753, "uuid": "d63c7866-b702-4aa3-a568-533c54c327e5", "comment": "Malware payload (Loki)", "value": "a30f64b2e17b9b173b5492f1343e05b2c630a5a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003753, "uuid": "b75b6a98-3e3a-455d-a3f6-ae553aa20bd6", "comment": "Malware payload (Loki)", "value": "07f3e46fb56b47e763ba188d12f68dfee85afe9422f81b789c1beeb9c192412e7c7ece34915d5ba464f3bd903d8250de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003753, "uuid": "938908e4-ab6f-403d-9926-c4562402aeb9", "value": "T186C4E02027E9C70AD16B437980E1C2F05776DE84B5B6C7934FD9FC4FB28A3A66321256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003753, "uuid": "8582bdbc-90da-4758-9cc6-2d521a3e60f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003753, "uuid": "98f4180d-c299-4757-9057-3709b958f1ed", "value": "6144:txfHtW45yDwEtTaMsYWGhpv1C90YIjQ3RxgqmAvzKv+Lp8I/pNDSEvI1y3twfuPk:tGgMsUhpZuvgqtbKPI2EvLuW9tlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003753, "uuid": "60786416-c63b-4d1a-8f7e-206219e26bcc", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003753, "uuid": "65e33789-4345-4e62-a412-b53e15e88940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003753, "uuid": "44db177d-adbd-48ac-95e3-8a410a239be2", "value": "SCANTT01_YEON23030119.Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6fc788e-fb18-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685031935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031935, "uuid": "1fab9835-780d-4216-851f-46b5f86c28a7", "comment": "Malware payload", "value": "5445b97be09366edc9c0a4bc745a8695", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031935, "uuid": "a533c278-0b7c-48be-861d-c2db3f94aa2c", "comment": "Malware payload", "value": "b48e8268c9e65b8e333f8f1b85e92084e4c240ca952150db39c6a875c98da24b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031935, "uuid": "73d615c0-8eae-41a5-a745-fa5858751244", "comment": "Malware payload", "value": "dd9b80e5d5c50bf96bd4e7afaabc060f79844eac", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031935, "uuid": "ffb41c43-064a-4c36-9388-cfa3d06cbe22", "comment": "Malware payload", "value": "384904c7ebc7972e68adebc022267bb18f24079e9f3198b336118cf421b6456f51bb2bf959b8868f48bd3ddd5d765e43", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031935, "uuid": "7272c17f-976c-4de8-94ae-913212a1cff2", "value": "T11D8733151494F2EBE90956A12D9D6C75BBD280F0309BCB7E0EC2E5AFD24187FEE50B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031935, "uuid": "cd8359ba-1e53-4c38-bdd0-03ebe88f7644", "value": "786432:yDEBQu7UPiXqkoo3k5VRaFGjbeMFcrPFN6mTyyEC8c+84Qxb:JQqUeqkt3mVSGjCaQN6mWnPc+84Sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685031935, "uuid": "2315d0b3-6d83-4a63-a14a-5b16f417d4ef", "value": 38095477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685031935, "uuid": "8857ca9c-6d1a-43dd-9772-44416fa5e7e5", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031935, "uuid": "6074e3dc-408f-4f26-a3eb-d44191990058", "value": "MalwareDownloader.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0460bec0-fafe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685020442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020442, "uuid": "c516df6a-078b-4374-882b-83222bb6c9f4", "comment": "Malware payload (Amadey)", "value": "74f3c381bc5b84f02a66708763dae274", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020442, "uuid": "6aed2283-7f85-4ad9-b61b-734e02f79bda", "comment": "Malware payload (Amadey)", "value": "b512b7a9ab0750307710ca627a6bf724fa2222bf211584c084b519e3824da078", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020442, "uuid": "958a6061-f058-43f2-92f5-86c7bc988593", "comment": "Malware payload (Amadey)", "value": "6646a2855674a77adbd408c484c59c7ae531a905", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020442, "uuid": "bff77e0f-d30e-4cb5-92d9-1beaab6d7a6c", "comment": "Malware payload (Amadey)", "value": "90c2641b2db2b4f5215bffa4bfedf7be788facbf6ee2e0ecffc1d82cba52ad0b03ebda514a762dd2f0d6e25feda1c6aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020442, "uuid": "8ae5cf77-00fc-44c9-ac95-6a7015c82aba", "value": "T1A4352353F7D88035C8B817B02CFB02930A3ABCE95C6467976795649A3C72BC4D63B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020442, "uuid": "8a6b5939-e8e5-4192-a5e0-dcc835a32002", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020442, "uuid": "30b67e3b-6edd-48ed-908e-d495019449db", "value": "24576:zyjhEtls+bTfZnZ5TxrX+5eUhhc3IlhGaX9N5VX2tj+0vf2O:GjhEnssb5BXBUhhcYlIa7vG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020442, "uuid": "92c05097-0402-4b39-97ba-25f42c14bb5d", "value": 1071616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020442, "uuid": "b67a378c-bf25-42a6-90fb-fe6768525dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020442, "uuid": "56bf8ade-29d7-4405-843c-0dc07f2cdda3", "value": "74f3c381bc5b84f02a66708763dae274", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729aab2e-fafd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685020197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020197, "uuid": "9abe0fed-a2af-411b-839e-3b8ccae3d771", "comment": "Malware payload (RedLineStealer)", "value": "1bc6c1729b93a30c81eedc8c4dab6c93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020197, "uuid": "96011acb-c6cf-45b3-b854-8255ffca99d9", "comment": "Malware payload (RedLineStealer)", "value": "b55f4dbb3ea3e5d354f4296de9d3dd797abde7d243fcf75320f5c8882ab5166f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020197, "uuid": "da92df28-daf2-4546-b70f-0eb9ba7fefb5", "comment": "Malware payload (RedLineStealer)", "value": "fba8b89493b66f54f36ace8dc329ec68d5fb42bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020197, "uuid": "b5748c87-9c1f-4908-806f-db3afd00a00a", "comment": "Malware payload (RedLineStealer)", "value": "8d42712620a014fd4934aa7f0e8a34e6e302504c04eab9777c09aafb06e6beceee67de6b5ae78de330cc22a49a3b59c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020197, "uuid": "4dddc9f9-e0e0-4ab6-8d14-1b65b995233b", "value": "T1B7352323ABD241B3DDB85BB069FA02870A7B7CE14994479F2B417D9B0C729D1953233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020197, "uuid": "4f3276ac-c5f4-4af9-a700-1523b020f715", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020197, "uuid": "2a9d4878-e4b0-450e-90e8-9f1e74b31fae", "value": "24576:syvbVgoTnTgf+yoLnu91qdC2B5oLNtFEZFy0yf4Hb:bvJRFnWCfB5o23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020197, "uuid": "d0703482-a673-49df-a890-ad6420ff9a08", "value": 1071104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020197, "uuid": "7a8bf8d9-bc39-404c-88b5-22f0325bcc16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020197, "uuid": "e40529e8-0c04-4f81-93ad-f89aa67fe81e", "value": "1bc6c1729b93a30c81eedc8c4dab6c93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a940c80-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003702, "uuid": "999b6776-e211-4161-a71a-8de616778478", "comment": "Malware payload (AgentTesla)", "value": "29d6f0770960c8fec1286b389c9c87a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003702, "uuid": "68476313-5ce3-48fe-9c45-21abc70af1b3", "comment": "Malware payload (AgentTesla)", "value": "b56b1cd85f7629245b8688d774aac1a87bf4d79bacc7a0207157f00894c7d405", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003702, "uuid": "f4a52903-c772-4888-a977-9e4ee8bfb342", "comment": "Malware payload (AgentTesla)", "value": "a04dc8cb8e4303bc6ed05a8ef91200596bb1ffa4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003702, "uuid": "c15d9a6d-47ba-48ff-9fa4-ee52286be2a5", "comment": "Malware payload (AgentTesla)", "value": "70f573e94002060c7f00478ffa91a4f1ce683ec5456d762ee2bb64d12c90897371817f1617abff59b3762f3c64cc48ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003702, "uuid": "2d2a893a-54a3-4d51-a3da-627c7bd0374e", "value": "T1C4F34B695EC98DD2C3ED6175DB710A08CBB2A1434617D76D1DA0A9FE3F063C3331A866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003702, "uuid": "f2bd851c-c677-40fa-a30b-21fa05c981b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003702, "uuid": "751aca86-8a80-41df-9ea9-b2bb5e1d4ad5", "value": "3072:ECcN88ELAG1LABs46OtvAul8UdAHBW0AVXFyoNRh9N5:RfojuKAQ0do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003702, "uuid": "8b5c4d07-e973-447a-86d3-5e1c245e8fb1", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003702, "uuid": "a1584f42-3de6-464a-94c6-47d63139eff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003702, "uuid": "3cdc39b6-f242-493b-a7fd-3e16d1e5c1ec", "value": "b56b1cd85f7629245b8688d774aac1a87bf4d79bacc7a0207157f00894c7d405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65b3b16-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996688, "uuid": "78320157-5727-4635-b918-456a97953d6e", "comment": "Malware payload (Quakbot)", "value": "8bb84ab6833f67bc15f94e58d99c1787", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996688, "uuid": "aa9c1c22-d272-4cc4-8ddc-fc9cd0ac1f6e", "comment": "Malware payload (Quakbot)", "value": "b62ee2d8881ce91e8840141bceeb6d2a06f261440eb49ba108d49322b780c3f5", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996688, "uuid": "66975269-0364-464b-948b-d5633c3f54e2", "comment": "Malware payload (Quakbot)", "value": "8ebcc9f160e4ec901d43139fa83cafbf23cd3668", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996688, "uuid": "da34443b-b42d-427b-8f97-9ef045631a4c", "comment": "Malware payload (Quakbot)", "value": "19f8e13679de5eefc47522fb7a4d50a9d4577dfd2e2122105c43f73de83a5143dece7bb915298babd56bd9745a60a728", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996688, "uuid": "18f9d7ed-d634-4ea1-9159-457a9907bb64", "value": "T11B83082BA3440335156202646B4F67D6B37484787B26DA64A49EC2AC3352CB8D7FF9FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996688, "uuid": "5b5ddbea-9504-47fb-9eca-9a5059887008", "value": "1536:4mimj/+wZOHgoKnSXmQzX1onPvhz7lDCoJPMCMS8mOGNh:4lmj/+wZOHgxS3WPv97lDCoRMS8mPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996688, "uuid": "7d7cda36-e0fc-4725-8a56-e2d56eb2d13d", "value": 88448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996688, "uuid": "3d314519-a271-422b-954e-70196e55feb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996688, "uuid": "b2f1eb8f-68b3-4bea-ac24-f7bd288bd4a3", "value": "Claim_D396.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc16b85-fb1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1685033718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033718, "uuid": "7e45decf-c494-41f2-b780-3df09e20bba7", "comment": "Malware payload (CobaltStrike)", "value": "2d7da0e32ac4bde3fed1e1307a10afef", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033718, "uuid": "16d9f68c-883f-40b7-80f1-3b97d0499513", "comment": "Malware payload (CobaltStrike)", "value": "b6eb73da6c308532e9f160bcd06bda91799de0cac7a282ff1f404f23ca6b694f", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033718, "uuid": "9e1b5778-97f5-48a6-bd62-6f1816fd63eb", "comment": "Malware payload (CobaltStrike)", "value": "4a808abef733f5539306f4d8eb4b1ad10273a8f2", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033718, "uuid": "7cdb9dd3-a7a9-40bd-90c3-3c3336fec3be", "comment": "Malware payload (CobaltStrike)", "value": "93d69765ccf889f4d44834ae97b4ae7ab1695acee2c879d074504b4c0560700c4bbf93693abc07eb04ebd23cb78a331e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685033718, "uuid": "36c67d37-084e-4b93-b31e-7d1e37af22bb", "value": "T199059E42B5CB80F3CA25193058AB6736DA34D64A0B24DFCB936ADF695C331C1EE37256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685033718, "uuid": "2b26c904-4f67-479f-91d5-17b933ea62c6", "value": "3e4459d6a92c4d024cfccdb754c0fd71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685033718, "uuid": "774be54e-e20e-46af-906b-4c59c578d4a6", "value": "24576:yNQzQp+j647BqemTyAPei0j/yDDjm+E2e:yN2njEjTyzi0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685033718, "uuid": "d7532a11-fb65-49a2-aa8e-9a7eaeae52ac", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685033718, "uuid": "8ccb7a89-06d8-43ce-bdea-c92e06d9125a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685033718, "uuid": "4004b67e-f91f-4d76-8a39-a7aae9161173", "value": "2d7da0e32ac4bde3fed1e1307a10afef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d6d743-fb0f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685027967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027967, "uuid": "edbdd922-2e55-4121-9323-3defe7d7c132", "comment": "Malware payload (SnakeKeylogger)", "value": "fd6f5ad342bd34d709e24b76355bd516", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027967, "uuid": "a244d98e-6596-41b5-a910-8605601795a7", "comment": "Malware payload (SnakeKeylogger)", "value": "b718cb54129f0eceb9bdfdc9342e285c4e2541f85c9095f2f838ec507596effc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027967, "uuid": "9f45b305-40ed-4519-a729-9df24680fe8b", "comment": "Malware payload (SnakeKeylogger)", "value": "b57a2cfe1394064dd13c9ae8481634b18602db64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027967, "uuid": "b79ff32e-23f5-4116-bfcf-de502091f893", "comment": "Malware payload (SnakeKeylogger)", "value": "e7879468adb1cdecc2fcb5d7d6ed0add3073eabb44ff5e90be6cc3112c557dff4a0b618b29abfa6aec731d4f58dff191", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027967, "uuid": "7b80f95c-21e8-4a6e-a8af-352eca83a63f", "value": "T10825128432297F47D13DE7FD9425383093FB79AA3122EB5A1EE7A0CA7075F02064499B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027967, "uuid": "b8c34f59-f1f0-40f1-a15e-c230e5e3d893", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027967, "uuid": "badae5d4-b2be-4933-a977-0a05d85a6eff", "value": "24576:u9BEP8gerz1GXATiojI7dPIn0RjbHn0PYM:6Be8ge31hTisIOn0RhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685027967, "uuid": "247c4099-343b-4aee-ad37-b5fc2b04cc0f", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685027967, "uuid": "51371e22-f1a7-4481-94bf-24e86d5bfff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027967, "uuid": "dc2bf401-7a55-4576-875f-1daf3f035c08", "value": "SKM-zam\u00f3wienie5572023 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f04f85-fb2b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685040100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040100, "uuid": "4eeb2f91-56dc-4066-94ee-e2768cd1fdbe", "comment": "Malware payload (RedLineStealer)", "value": "a1cbcd3700dbe18060624299d7399f25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040100, "uuid": "0c5c04d3-98c8-4cbd-ba04-0d77f3d13e9b", "comment": "Malware payload (RedLineStealer)", "value": "b7aac8ec6dd60ddcbeb7a693aaeb6ad14653807953acfdecd664d31cc4f9a59a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040100, "uuid": "c6fbb9f3-0ebe-4998-81ab-182dccbbfa4a", "comment": "Malware payload (RedLineStealer)", "value": "a876add8c4659265460c9a3ea0a745d8ec450989", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040100, "uuid": "dfea6951-807e-4640-b204-efabc5116681", "comment": "Malware payload (RedLineStealer)", "value": "4e9071c1788407e425b8f71b7b70c42876c1bf8def23f7d5c10885b934f0698ce4f03edc6be39734fe39697cb97ec196", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040100, "uuid": "4f09b7be-a97b-44c6-9fa4-bb14bca6e3de", "value": "T1F1F4225276D8C035D6B027B019F703A70E31BE708E79826E1349AD6E2D727D49A3672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040100, "uuid": "4258beb9-3e4b-44bd-8670-6121e844f08c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040100, "uuid": "692b39a6-0498-44ef-8791-7033b0c56e44", "value": "12288:qMriy90ww3r2aJ8gzXVuJnILRHEuP9l9Vx91utaPMOGgeOn0kBtPnMLtIW+OEjRP:oyRwSamEAJn+euFl9v91utFpgx0k3PMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685040100, "uuid": "b8083b93-6cea-4aa8-86e6-da1aea62213f", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685040100, "uuid": "943dfbc6-4cfe-4cbf-9b32-603412521b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040100, "uuid": "97e1a172-6a98-42dc-bd9e-f07763f37a28", "value": "a1cbcd3700dbe18060624299d7399f25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65cc5ed-fb46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685051771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051771, "uuid": "b7888c95-9576-4049-bea5-9bea1935bdba", "comment": "Malware payload (Mirai)", "value": "58c4112fb9ddff90e381763d258927f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051771, "uuid": "d01ff2b1-9ba5-430f-b7df-baa5b4a6891e", "comment": "Malware payload (Mirai)", "value": "b8577da827f10dbe3909cae50c0465268ae5aeed89a20271d50095ba9c021341", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051771, "uuid": "f06af30b-5b00-44cf-9d3a-4cf87bfc2e74", "comment": "Malware payload (Mirai)", "value": "9375a20b2f6d9c23b8eec6b5493d8c17d91533d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051771, "uuid": "976f3767-46e1-4157-bd42-17edbda2beda", "comment": "Malware payload (Mirai)", "value": "c848f224fb1307b76d6d84dcefc364677f0b4122c646b42073d9b63a0d71e3c1ca32e85fedb9ff10e61d909ca228557c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051771, "uuid": "0b081559-a883-4572-b42b-20050e97ba56", "value": "T1CD230271890E9EF124303C76EA959793BBE126B1C6673023D6180B382FB5B531E57E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051771, "uuid": "7ad9afa0-68a9-45a5-841a-92d93ebe7701", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b32d9q3UELbUXfi6nVMQHI4vcGpvp:DECFd+A6YHAxrLRQZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685051771, "uuid": "d488705d-5bce-44e7-a7d0-6a803a4b759e", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685051771, "uuid": "b95c06f5-977b-4a4b-875f-a6990bbf4b57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051771, "uuid": "e9e6d3e5-94bf-43d3-bab4-d32ce880f673", "value": "58c4112fb9ddff90e381763d258927f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06db337-facc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684999363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999363, "uuid": "6d2519ee-1c28-4207-8728-418ff930cb30", "comment": "Malware payload (AgentTesla)", "value": "53e92e7aa87b164606ae392d3b9b4de5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999363, "uuid": "0cf830f5-9d16-4d06-925b-947af36884a9", "comment": "Malware payload (AgentTesla)", "value": "b900827416c1c8a451b62e64e4fb153c46db878270af5bed908bea78a32f7823", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999363, "uuid": "b8768c20-e220-49dd-a736-899d6b54bc2e", "comment": "Malware payload (AgentTesla)", "value": "52f3da0a717efbf08c7335ad1b17dfdde9dd8639", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999363, "uuid": "af97bd80-413a-4702-b9c7-7df812b1b082", "comment": "Malware payload (AgentTesla)", "value": "5c734bae75586b64142e85fe8ab0e4f4716aa1b659c848a94a1637eb7feffc37cec367456e24a0cdc8ee67e78b304688", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999363, "uuid": "55ff51ef-4ebb-466c-927c-93766d9ebd66", "value": "T1B445BEC91903DACECA3385366FA23A593CE2C7E8CF69D319649803692F155A6CF3714D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999363, "uuid": "c6c1be03-8b09-4ccb-8944-3a3bb96099b0", "value": "12288:Uql+tdvMsmeN/ECtY+MtyEMLVqYR3dkb3hnc:C/vMsmeN/YvtylqYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999363, "uuid": "a09753dc-5319-495a-bb41-69515ae8eef4", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999363, "uuid": "11872a54-2ebe-4a57-ac00-9fcee6bfae46", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999363, "uuid": "145375a4-09b5-41e9-8367-320cb43ea689", "value": "Boardelectronics PO 25.05.2023.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3d7aba-fadb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685005666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685005666, "uuid": "b18afe66-180d-4147-8b99-8a3b359f251e", "comment": "Malware payload (AgentTesla)", "value": "2fc519d8eb05a64a586895daa93f10c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685005666, "uuid": "034af4f5-eb37-4441-976a-5478bcd68bdf", "comment": "Malware payload (AgentTesla)", "value": "b9129e7533b6b2e4db2b5a65399e6761987c2d3d260ac6be681b02948544b565", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685005666, "uuid": "e592369c-7422-45f5-b7ee-3ea592f50fb6", "comment": "Malware payload (AgentTesla)", "value": "e6e2722f40a22772214a5715de929ebec86e6a98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685005666, "uuid": "2ae765ef-ebdd-4140-90ea-d7dd558d3742", "comment": "Malware payload (AgentTesla)", "value": "70c04780178e62aceb495694940ea5fd7bd6287c8094716ac957f2ac318e35272d56c07b60f0f8370ff5f47230fc1a64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685005666, "uuid": "aace1f33-7199-4e08-a332-d658cd26ad6f", "value": "T112E401A275797F42C43AD3F884303AB413FAAA6A74B2F74A1DD7E0C76066F411542E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685005666, "uuid": "1ef9096c-7f56-4f71-9ed7-e7703772596d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685005666, "uuid": "82e89510-2d9d-4321-b8af-12ed80355148", "value": "12288:eEmmzZBEP85U1MQTdCwyucOy1Bz8squKJMlLRGQHJQgXSxVWtLMA:v9BEP8WT4wYj7lqxJMl95pJX8Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685005666, "uuid": "18952016-e67b-45a1-b54a-7d73e3c5c841", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685005666, "uuid": "8355c06f-2da8-4c68-8f9b-4dfd6e0f7e86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685005666, "uuid": "8243d39e-ee79-4ff2-a47f-b17a0f22caf5", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdca58c2-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996808, "uuid": "26cb957d-a20b-4456-8030-48b68d395e24", "comment": "Malware payload", "value": "a75100871ff6bcfeb0a94f5a822eb53a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996808, "uuid": "f44b7699-cd7b-43c1-959a-eaeb20effcbf", "comment": "Malware payload", "value": "b95d6733f7d883e20ff9941c4ef8880d565590cff5b060baee71907f887510e6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996808, "uuid": "4083c2d4-142b-458d-adb6-a1c5912380e4", "comment": "Malware payload", "value": "f9ad90ad409b06f07fb003847dd802c8b18251c5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996808, "uuid": "b02a7eee-d5ac-440f-943c-f913291eee05", "comment": "Malware payload", "value": "dc162e4daac6d8dbfc4fe4d5b4a5d552097f558c7e66ccb7c8cce89d8a1b93a74e32ef2feabfdb404ef0c2bfae7611d0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996808, "uuid": "5c1c6dd3-15e3-4913-8972-7446ab8eccc5", "value": "T12064C684471119A24B5B2F32A73054B9EBBE0EB9C2D4598FF46FB250FBDE94CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996808, "uuid": "6f4d6392-e5ab-4ada-8ec3-5a4e11714c62", "value": "3072:jH/qi7LCho4Tkbliqe06zvunZtV/cK2OGaIMH6Yxnq1iqxj1POl1a+rgpw:jqi3Y5kRi7WnadOL99q1Tj1O1a+rgpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996808, "uuid": "40f176eb-ef12-4b08-9960-2210c60f6163", "value": 306579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996808, "uuid": "9c719323-552d-486e-bacc-4a3f054b8de7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996808, "uuid": "efdedb6a-f961-4815-aa7e-8df50df1da73", "value": "hyperenthusiast.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eeb550c-fafc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685019761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019761, "uuid": "9b572291-fcb5-4173-b97b-3b523f77db8c", "comment": "Malware payload (AgentTesla)", "value": "189625072aa081fc9270955cfae5df5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pw-9CNELGT7BK7qyUE", "colour": "#F8B203", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019761, "uuid": "c93d875f-4556-4d72-8776-4d567669ccdc", "comment": "Malware payload (AgentTesla)", "value": "ba6990670841fc63a46cffe8d7c81266fbb53de52834dac78a2c4b8b398fe8fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pw-9CNELGT7BK7qyUE", "colour": "#F8B203", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019761, "uuid": "90ff3ead-3f41-45bf-8066-60a970a2aba9", "comment": "Malware payload (AgentTesla)", "value": "d36e8ecfe0b1e2d6d8544a35de7d44a67cf9875c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pw-9CNELGT7BK7qyUE", "colour": "#F8B203", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019761, "uuid": "3a272db6-0a0a-45c8-bdac-cf84e755855c", "comment": "Malware payload (AgentTesla)", "value": "596b5b858be0dac4f9b49a2ba2c7ad9853690963c1b6c9372259c3f250e59cb7be4e69b53c88a62b24d63689970b09b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pw-9CNELGT7BK7qyUE", "colour": "#F8B203", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019761, "uuid": "b329df84-c2e0-4874-95f1-fda1fc2c9b58", "value": "T186D42392F1E8B5E30D25077A603AAED9D52D28BC38F0DAD964C7D770D450B1F482BB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019761, "uuid": "7340f1d6-0f75-48ff-b573-11108136cd0c", "value": "12288:GzDLkWnFnfeeXUuQGbsIL9DR+Og7bYXP5C83mnF0YrlM+VTdudgX:skCF5U+PLl9g7UXP38F0YJ5BQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685019761, "uuid": "50d8741c-0e47-4263-b5aa-73a850a9865f", "value": 620725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685019761, "uuid": "4f8d00bb-36ea-4c4d-90b4-7780a0bddef7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019761, "uuid": "0ef309e2-8626-4465-a714-4f8930a73977", "value": "9CNELGT7BK7qyUE.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb46281-faca-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998152, "uuid": "7fbc9a54-0826-4c69-af7a-33daf72bfd93", "comment": "Malware payload", "value": "75c7879d3e6e288c9e280a43e64ed4ae", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998152, "uuid": "eb5277aa-05cd-4977-9cdb-65994048c6c5", "comment": "Malware payload", "value": "baf05050ec4067c5e0a152f7ec1e25c51da0c4863936b46f3015f9f0353102e2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998152, "uuid": "c253c028-9183-40fc-aace-4c3b9273a3c7", "comment": "Malware payload", "value": "ec4ad18de0e2e9a35593981457dd9d71a0dae03b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998152, "uuid": "dbb7ae18-f16d-4ad5-995f-cbf3b388b9bc", "comment": "Malware payload", "value": "548935348f1da85cac552967a7d1f7077610804001490c2e363b823efa9e9ced3ea31273dd80b224e45094eac391675b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998152, "uuid": "2412f943-bd53-45f1-940c-cc13ef549f59", "value": "T182647480471528A24B4B7F26B730A4A5EBBE1EB9C2C4598BF46F7251F7DF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998152, "uuid": "bc81ee27-c2f3-4784-a462-74ba067ac24c", "value": "6144:7kKc/lcSektgRGC3XNA4Jc5d1RMeu+1nwo0M:jlhURJLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998152, "uuid": "8d4c52fe-f390-451d-8d86-acb833b28072", "value": 336003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998152, "uuid": "42527435-b659-433d-bc8d-dfd7a6559977", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998152, "uuid": "d1bd23ab-5d41-4901-9ec2-02e4b3247b5d", "value": "Uniquely.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae98e17-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999676, "uuid": "75c9e31a-bc0d-4017-9b5c-89b0295d668c", "comment": "Malware payload", "value": "61f669f0cf13350c40fd8d05d7339e77", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999676, "uuid": "940f9da0-3981-4bfc-b5fa-6084fba65bb5", "comment": "Malware payload", "value": "bb44aa511ae970251801784e363cbe8e2ceb3e8082cebde6ecefbabd78e991fd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999676, "uuid": "8a396ee9-9680-47ea-923d-1be598277574", "comment": "Malware payload", "value": "5e4aa6e38e52a81541070d49b2f0a5f6ffa91474", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999676, "uuid": "ee615efd-d9ac-4a04-b619-c7f719b0bc33", "comment": "Malware payload", "value": "f6b53ceef702c9dfd36cdf5960f7b6721848bd4b30af2671faf2d51b0910617d3e89f783abbb0b6e1ab698be05f0410e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999676, "uuid": "59bca8b7-fdd4-465d-9915-d8d905c29a06", "value": "T11654DB884B2129A64B5B7E31B724A4B9EBAA1E75C2D045CFF45F3261FBDF90CC8C1521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999676, "uuid": "2b1569f6-4ae1-42ff-aa65-ea9fc468ed73", "value": "3072:D9fybuRCDruEoX3pI/4Zx3GUXW8pDhCux6SAZL6xWVsnaTKhb:56aRwCEoHK/4ZLXfZhZAZL69aGhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999676, "uuid": "038c5e79-f47f-48fb-8f44-9aa9c2cf5d7f", "value": 291081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999676, "uuid": "1d9bde3f-7994-493f-b5c4-ae7399a7cb1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999676, "uuid": "07172ec0-e31c-4f91-ac6e-11a6cb9bb7af", "value": "creeshes.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd79eba6-fb0f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685028080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028080, "uuid": "217687a2-3ca7-48e9-922f-2b3a6228ce9e", "comment": "Malware payload", "value": "c8c163d8c2cf1ea0fe9a1dde5c45f964", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028080, "uuid": "380adc43-564c-4c64-8fa9-c0efa12afcce", "comment": "Malware payload", "value": "bba88b37335b59e3c9f6556b22bdf8d6d0e2bd6e520ac430a07a909639755724", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028080, "uuid": "76c48013-4a1c-4182-aa42-f3030a3a2060", "comment": "Malware payload", "value": "86661461c13f43301a390e0ae668aab99a03dafb", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028080, "uuid": "b5a197ef-ceb0-4377-81ba-d6fa3bd3ea4b", "comment": "Malware payload", "value": "505902f7df1df197e4ad5920e1750be83356199fdd0a74758668fcdf8c04b5bc73408ce5359ed23eda0e845e5b157ab0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028080, "uuid": "ca6352ab-ab62-42c5-b3ea-243e29cc3d6a", "value": "T151411F5F8D8B93738D730E749E4E52BAEB48252F26160A497A4DCD897F3026CD2D12C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028080, "uuid": "c307a51c-ff49-4389-940c-0d133e2a35a2", "value": "24:Kq7VYnt26G2t/hqlFjDxJqfHJbKpVhJGATSIhauKM6WphgfK2l9ouwZn/LVBFG/b:+tLHBAfNJthJGTImkmC2wdn/jwf8veP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028080, "uuid": "56b3e881-1717-4502-9cc9-1439bb4717c2", "value": 2402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028080, "uuid": "966f91ae-209f-4e6a-a5a9-a97bf231da85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028080, "uuid": "0287d191-a32c-48f9-883c-65b8d47ce3a1", "value": "Scan invoice-Payment Document pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe1ca05-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999684, "uuid": "0094cbac-3252-4c2c-999a-fce542a2dd2d", "comment": "Malware payload", "value": "b76cc630b206efe80264f1ce4372b0f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999684, "uuid": "fc71660b-0d5c-4d76-8c06-19f606ced53f", "comment": "Malware payload", "value": "bbf61faa7c5a4198a00f354d6fab598deeb1d3efe88203f719eb01308415e374", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999684, "uuid": "8719e7ec-ba4d-49d3-9092-e9b60536d602", "comment": "Malware payload", "value": "9bc16c4ed15a4e20a59285bad0016698e981dea6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999684, "uuid": "6aa600ab-8370-4110-a71d-f44ac4acb85f", "comment": "Malware payload", "value": "03c02c804dc5086914d23d6af783baf779b3c578a14100ec6308821572b6d5394b6eabea44972164874a2554ec32da63", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999684, "uuid": "d2bf612c-5dd3-4407-a029-16df8e5e2e38", "value": "T17B54C984471529A24B4B2F36B72064B9EBAE1EB9C2D0588FF46F7251FBDF90CC8D1521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999684, "uuid": "db461752-d770-4a0c-8b82-692b4b867459", "value": "6144:5n7I3hVrePKTn45JK0Grt+lARwcUEO3JrYnm+b:t0U/Ym+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999684, "uuid": "42499bd5-05e6-4214-b63f-6e104344b015", "value": 294160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999684, "uuid": "5f6fedf2-f2ca-43a9-95d2-11841ed9b50c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999684, "uuid": "4f4f5c18-2e8c-4b9c-8c20-f111169e96c4", "value": "cydoniumEntabla.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d63cec-fad9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685004878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004878, "uuid": "f2e6757e-10f8-4a38-9171-8c387b748d49", "comment": "Malware payload", "value": "1d60dde0b4ba13d3d843cea761b9f4ed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004878, "uuid": "e7fb30b2-460c-43a9-8eed-7db062931843", "comment": "Malware payload", "value": "bc1669a5747c1c381b74017308f30427d1bdc0d70a3f3cbf4b28d8c78aa5503d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004878, "uuid": "04a5c2a2-e250-43ef-adc3-7c58583a15a4", "comment": "Malware payload", "value": "1c7fa4c63acb86b5de8b2c5443c09a58dc4d0ff9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685004878, "uuid": "94431f3f-74e6-4ad3-b4f0-05b0de190fe2", "comment": "Malware payload", "value": "1c7c8e8093753077f7c3c29e08a60922aac64d01862c2f53e0ce860bb94c5e1c0ff5a86f34306a7a195fec39be3817f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685004878, "uuid": "4f72d96e-e0d0-4c61-9815-e49d4ffe7249", "value": "T15D7633E453A81CF5FA7BC13E8C628118D9727C1647A0D28743AA875A0EB77B13CBB741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685004878, "uuid": "9f119b87-b437-49dc-a0b8-f2428b8b1fcf", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685004878, "uuid": "c275ed9b-b4cd-4d0a-80eb-ccfa18e1966f", "value": "196608:gulZ4dQmRrdA6l7aycBIGpEVSE0gLHAy9Y:R4dQOl29Fzgr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685004878, "uuid": "5c17c1ed-502b-4d9b-89e1-69a9752ee94a", "value": 7273677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685004878, "uuid": "9d543e30-0983-4902-8164-689b7d5bf561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685004878, "uuid": "8e340c52-5edf-4096-80d9-6ed2fb0042af", "value": "M7R90691.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352b09ac-fab3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684988311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988311, "uuid": "264ca3b1-8746-4e3c-b4c9-0fc72c0234a4", "comment": "Malware payload (Quakbot)", "value": "55804877262519f3476fb94b0e828257", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988311, "uuid": "a501c999-8082-41c0-9467-c50d4cbf8603", "comment": "Malware payload (Quakbot)", "value": "bc3911a4f3214ce8c9974750c7215cc18e512a8327e86a9cb6ef1ce4d85697c0", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988311, "uuid": "666032aa-fdf6-43d2-bb9a-7968daab7b78", "comment": "Malware payload (Quakbot)", "value": "453a72085843b4e9c2af26437abbb3f1e1e169ae", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988311, "uuid": "9a7de8b1-0719-4b61-bd0c-19c0608c5d58", "comment": "Malware payload (Quakbot)", "value": "97a6689456e9f1ccaa581065d18690c6c94f007cf3da29160b62c31655582c67042169f458cb310ba217360987afb054", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988311, "uuid": "3543e65c-3cf4-49fb-9cf9-f6f148d6b542", "value": "T15973F96B63850336152201646B0F5BD2F7B844B8AB76D6A4A09EC2693341C74D7FFAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988311, "uuid": "aa93a5f1-fca5-4434-a2c3-e79a65bd834b", "value": "1536:ZlX3DsaU9lDhALGWP1oEWSQ3Y9m3WF5i3DbxMdezSQi+VX3NlDY:ZpsaylDCaWo2F5ibLzd3NlDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684988311, "uuid": "97bd3b71-43a4-466d-a794-099d263836d5", "value": 73920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684988311, "uuid": "35fd25ef-92d6-4b49-816e-6c953181d4ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988311, "uuid": "c8ecf155-6178-4fae-b8ff-3f114fd87595", "value": "Claim_E370.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc87def-fb10-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685028239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028239, "uuid": "a4b733e1-0b21-4c45-b688-8f73550ede63", "comment": "Malware payload (AgentTesla)", "value": "78d33860fdeaf3d6c5949135869dc472", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028239, "uuid": "7d51dad3-9f47-4bf3-a262-6e1726320ccc", "comment": "Malware payload (AgentTesla)", "value": "bc92e8f1b1033b1a264b513f2b7118404014823e73ae7237f9b75557118beecf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028239, "uuid": "96592157-bc6a-4e68-8426-96eebbebb116", "comment": "Malware payload (AgentTesla)", "value": "b501f1ae86d25289f775e22b7aa7a9b097aa41f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028239, "uuid": "995f7b6b-738f-4d6e-89d9-578f1f6d1221", "comment": "Malware payload (AgentTesla)", "value": "d9515a0c1381504b6a81b320128c6221bbcca9f5008e80886cb8fe7d00803e71151cac749c5b690e1d927d3eb6b91e61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028239, "uuid": "49bbc6e2-29e1-4e50-b5f1-10f5fdee64db", "value": "T170E402613A683F16D13AC7F948303AB853FF6A6B7132E3966DD760CBB165F410A00987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028239, "uuid": "249f58c3-ac42-45d9-ab80-975476e6b7f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028239, "uuid": "95c18798-892d-49dd-af54-255605b1c51a", "value": "12288:VWumzZBEP85ZWZ5BYc3ZCBLmrwKttQgrxkc5eaAnvN1qNjP5Lqo9MV+lsL7yMjaT:O9BEP8kB9CFCX9rxkM+nF1qtP5LqDyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028239, "uuid": "af214d43-f8c1-48a3-bed4-1efdf2aa9708", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028239, "uuid": "782be8ac-c5ba-4f4b-8582-28415eff16fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028239, "uuid": "96e13cfd-4cf5-408c-862a-151e228d7cca", "value": "DHL G\u00d6NDER\u0130 B\u0130LD\u0130R\u0130M\u0130_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29d985e-fb38-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685045725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685045725, "uuid": "68389b11-cc6b-4901-a502-109d54127f1c", "comment": "Malware payload (Amadey)", "value": "746b8ab3a0abc20cc32632106af924b1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685045725, "uuid": "091d0bdb-d3b0-44ad-81c7-5d3a3c67e757", "comment": "Malware payload (Amadey)", "value": "bc9ad6db3925e9363b7e661fb9621a22c255b62dbe725d0607b5d37d342ada68", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685045725, "uuid": "0b697246-a1f4-47f9-9e41-2cf65a4e18aa", "comment": "Malware payload (Amadey)", "value": "4caf145bc75bf5746690865e0d2b6cdaa766eae5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685045725, "uuid": "68ddec8e-bed5-482d-a001-2f355f8c67c4", "comment": "Malware payload (Amadey)", "value": "5ca944d53ab149a6e97a71d18cb0b39ab9303765ee3f6f7edd2aabff33d1b1c275e2142df61fa48978572438c2bff67b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685045725, "uuid": "c35788b4-7535-4181-84b7-0b18f260af3d", "value": "T1CBF41243AADC807AC8F61B7068F607874E3ABDA289744B7B1345795E08B3AC4657133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685045725, "uuid": "a7b576b5-7d84-443a-8a7d-b463be02f677", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685045725, "uuid": "15e52760-8aa7-446e-b9fb-202e10782a64", "value": "24576:oyTaxWLD76WgBhSnXPF1TB6q3dk7QMM1+2CB1:vuxWf7NGhtq3aQMM1+7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685045725, "uuid": "9d5a5aeb-c104-49d6-844d-a38886c7c25c", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685045725, "uuid": "e69bfd51-57ea-47df-9e39-498d01eeded9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685045725, "uuid": "a8c81b2e-bef6-4073-97bd-fdbd7f33499c", "value": "746b8ab3a0abc20cc32632106af924b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da95fb4-fae8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685011223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011223, "uuid": "6f18e79f-4d90-4504-a603-857713b2dd09", "comment": "Malware payload (AgentTesla)", "value": "1d779405ca4403ac6eeecf7aafacda83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011223, "uuid": "b1136284-d651-499e-8c3a-3c6a4e53d75f", "comment": "Malware payload (AgentTesla)", "value": "bdc2674f2a97b86c7ad40c521aaa21dc112acb9a8076f163929b992875288e7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011223, "uuid": "d927d831-386a-49b5-9f65-59f16643432f", "comment": "Malware payload (AgentTesla)", "value": "f3c3e10efde989868fbb90dda110d124286198b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011223, "uuid": "d86f22af-626c-493b-8a5f-92ba7f45621e", "comment": "Malware payload (AgentTesla)", "value": "f4c32a67c03cc41b4919d0551d29de0a319fe423893696948cbdf7e79c8cce639278fdad9dc725ef7a206f8a8dfcbc9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011223, "uuid": "631cbb4a-0d85-435f-b9e1-5d1f0ea41599", "value": "T13DD4225AF71ADB19C47B17F148822270133F9D89BC32E60B2E52F1C6A325F4A5651F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011223, "uuid": "c8c845e9-505c-49a2-b309-5813405e56da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011223, "uuid": "436fabf9-0593-40a7-bf7f-5614a7505ace", "value": "12288:S2N8jiZ4zypIPdtPplTY6RhKu9dQtp0vWNoSuT/bxpF0ufxZEJITNqhhg2dfLm6:S2N8jiZ4zypIPdJTDELvKSoXS3vfxm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685011223, "uuid": "8c473a47-fba6-4674-9ed7-df8ff8cacd95", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685011223, "uuid": "0ba8bd46-1af8-4a53-bb16-580f337d0c01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011223, "uuid": "8b302588-1e24-4251-8ad5-ff14f6c5e8d1", "value": "rOrdendecompraPO.043-2023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97777365-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996637, "uuid": "2d00b84e-9f5b-45a8-85e8-9d84e3b66ef5", "comment": "Malware payload (Quakbot)", "value": "dbc1014d53e8eab9f5b3619cc0c84f4a", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996637, "uuid": "e1928304-22ae-4ac8-81bb-5748488ca7f9", "comment": "Malware payload (Quakbot)", "value": "bdc3efe328eb756b94cde1bce678198aa8efed2a7d31c2507dc9381860531477", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996637, "uuid": "9607f568-7198-41e9-a07e-6c7aaa546c2a", "comment": "Malware payload (Quakbot)", "value": "ecb4495d4168c6a390ab32deb242a7afaf16db9a", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996637, "uuid": "0efab66b-0dc9-431f-b581-1bd3f6d3c77a", "comment": "Malware payload (Quakbot)", "value": "afcb3f85e109faf6fec589b120bd0339a5aad9c42f8585f91a61ec7a313d0389953384be5917c1fc70bf830761f7845a", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996637, "uuid": "75b30bfa-1e9d-4418-8b8a-8ce79bbf06f6", "value": "T17F833B1BE381137559220354678F63D1F7A488387721DA68F88E83DD33519EDC6BA9EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996637, "uuid": "e608e9f5-b3ab-4d49-ab94-7a800616e7d1", "value": "1536:JtQlW1ZO0wivyj/tQlVL9HmN9spK7C8m2hls1ZOv1ZOKzsOQjm:JtQY1ZO0wXj/tQrLG9spK71thls1ZOvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996637, "uuid": "b40c3772-c8ed-45de-804b-fe7b975b4e29", "value": 88560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996637, "uuid": "fac8ea83-8a30-4b1a-a4e8-0e9ffdc39880", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996637, "uuid": "c1d5ea6d-1fe5-4b0d-b707-f65ed4d4870f", "value": "Claim_B859.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe962e0-fb2c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685040620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040620, "uuid": "e95eaf21-30b8-42ef-a4f6-2efb3ed466d9", "comment": "Malware payload (Amadey)", "value": "12691d8c48432ce687e624854c652a35", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040620, "uuid": "7e8e69b4-0a48-4468-82c5-d7be20ae4c1d", "comment": "Malware payload (Amadey)", "value": "bddf9e6fbcf108175bef4d8e7491cd9fe94ad92efc77f3f8883a3827af609a3c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040620, "uuid": "dcdcefba-568d-4eba-b95e-04783a20898e", "comment": "Malware payload (Amadey)", "value": "66c21b4b1eaa9e3c6d8f58a44a2edc0f11540cf3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040620, "uuid": "92908194-af3e-49bd-9c99-5135d9707270", "comment": "Malware payload (Amadey)", "value": "0ea1d74ba0e00ab86c0ff51433c9c80ac96c3ed794bf522ca9a625e758a93ecdf660d8a42c44b75aac307d2ccbc02fce", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040620, "uuid": "21855977-2575-4bfb-8cee-21180a72c9ae", "value": "T1A7F42363BDC4C032E8B427B02DF213970F35BC556D7A436B2786A65E08B36D8663572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040620, "uuid": "559513c6-6047-44ba-9360-1686a1710e8b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040620, "uuid": "a3f718ae-bc74-4172-b2dc-fa67bf1fca41", "value": "24576:TylEC0ItAaA06ZgNQhOaLU0ku2ML1+1+X:m+gti06ZguhOaUy2ML1+1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685040620, "uuid": "79f702cc-6d0f-457e-820b-94ea759e914e", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685040620, "uuid": "529462e2-49dd-47b3-9783-a6b971fb83df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040620, "uuid": "bdf2ef76-646a-40c8-b02f-2c6f33fa2b67", "value": "12691d8c48432ce687e624854c652a35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b11c50-fb41-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685049381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685049381, "uuid": "d9d4ec07-5bba-4b07-acbf-dd1cf224c1db", "comment": "Malware payload (Stealc)", "value": "1c9ae05953771899771c2482b508fd03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685049381, "uuid": "266b9979-3996-48f9-b610-c6c7bd80beda", "comment": "Malware payload (Stealc)", "value": "bef14d51446ab2f7d3bc07a09398587253a4e844331dfba145ae9508e8aa30bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685049381, "uuid": "8b638f46-5b2c-45b1-8afe-3dcfca288a1f", "comment": "Malware payload (Stealc)", "value": "caa13036d7bbc931e3d822fc8f1c4a593a53b740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685049381, "uuid": "38be7ef0-8523-43fc-9e8b-ebc8223c536b", "comment": "Malware payload (Stealc)", "value": "3794a376d78c8690bcb45e303e3e049551621d476b74d53d26a5e2bf91a4abc40d1792a08a7fb1246cf8d8133f4e04aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685049381, "uuid": "a3225061-d597-434d-b0a2-eef9c947bef0", "value": "T1C7644A03A3E17C66E5269B728E2EC6F8761EF9508F4937E76234AE2F08701B1C172755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685049381, "uuid": "26704f76-031c-4e67-8606-4c3d63e4c0cd", "value": "2ed2010eb38299ab16b0c3e5615a3925", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685049381, "uuid": "dfe33b03-febd-453e-9502-285c17e8c10f", "value": "3072:P9mHooB1FzMAWdpZRTsNI3n5h14g7dY/a1SSFuUnxtKhwWTQQXGzcjAhUxGMOZtI:VmI6FgDpse3n57Aa1GUxtMQQX90kG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685049381, "uuid": "89fc3552-163e-473f-b080-131b9cc802f7", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685049381, "uuid": "caaf6ee0-b89a-43b2-8667-a90c984846b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685049381, "uuid": "68e57b1e-c0bd-4a1b-9eea-0cfe928f1025", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eaf8f8e-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003708, "uuid": "5f7bc005-5807-4e00-912d-06f08b46d99a", "comment": "Malware payload (AgentTesla)", "value": "f6cb6c356dfaddeca9f177615cdfe8df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003708, "uuid": "8dc0f118-6b82-4c09-b5ca-46b469067e28", "comment": "Malware payload (AgentTesla)", "value": "bf49f4089e64221fd32b9f9519c64c5b97ba0fed26a97d1cbb6e64fb2822e464", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003708, "uuid": "9fed8d43-08e1-4798-a0ad-802effbc1b50", "comment": "Malware payload (AgentTesla)", "value": "ec7e61ef7e0d48fb054da144bbecc0d09d9747a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003708, "uuid": "c9cf9401-0e50-4140-96a1-3a6f0e87841b", "comment": "Malware payload (AgentTesla)", "value": "f6dfd54790bbd55ab209c327c95c5a719a88c1a7ab816d19b7cd8f3f568661883575fb3acf18cbf4096faf836ce05df5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003708, "uuid": "b07c33d0-df22-4752-9c1b-9cb8310efa84", "value": "T17BD4DF8B2A5B8F26D17103FA5621E5B913B52FA82123D316ACE7BCE3F139B435905427", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003708, "uuid": "05912fe7-2be8-44ad-a3a3-ec5d7718a9dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003708, "uuid": "1331d1fd-6e2d-4a2a-b4f2-c55cb4de8101", "value": "12288:/2iN/lzU+kNByuw4FhkjXmoKD7emdDYULIu1Hs9iFn:/1hlzUR7/kJKD7dNIu1HNFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003708, "uuid": "e7bd4eb7-7272-4b23-80c2-a151b9c7c3a1", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003708, "uuid": "e0ea61a8-ab47-4191-97a1-f12f313d4fa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003708, "uuid": "cd685c11-93da-44ec-a903-e702e05c3413", "value": "Curriculum Vitae Adriana Silva.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22df01c2-faca-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998159, "uuid": "dae17ebb-44f7-4a5d-bbae-dc7a11b94d99", "comment": "Malware payload", "value": "631db9874d1e67d9c6fec38285f99f91", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998159, "uuid": "43d15252-ec0b-4c46-a392-bcc825fcef9e", "comment": "Malware payload", "value": "bf8c5c4ec2ce59686549b6067b1f758d0579f946746d122ec6d33ea9d6c50f21", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998159, "uuid": "b95bc443-cc21-4756-92c4-08ddbfb994bd", "comment": "Malware payload", "value": "5dbcc1d2f72defea0a4a8b90676effdc5225febb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998159, "uuid": "6e5e7f68-5829-4147-9dc6-c370ae0fe0fc", "comment": "Malware payload", "value": "3d74fad7449782737c06af7a1345e3b5fcea7f1a1ebcb3a3010b83d90428783851de0df5cb6bbcfe3f65e2931c2795f9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998159, "uuid": "1e866b5b-fb8a-45a2-949f-89068dbfed66", "value": "T188647680475518B64B5B7E26AB30A4A5DBBE1E74C2C85A8BF46F7250FBCF58CC8D1321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998159, "uuid": "e6ed6b2e-9a20-49b5-9fa9-d322fcfc06db", "value": "3072:Q4tqVsIDwZKvvb2rf7W/teVYVnIsLj2CkamJT/qGl702+pJZAPHIvHBkn2OHjcJJ:OSAbAW/Y6gamT/qC1Hc+n4rqwFpV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998159, "uuid": "791380b4-cf03-412b-a5aa-bb6716cc217c", "value": 310977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998159, "uuid": "8a3cb8f7-9681-49f2-8886-2506fcfb934f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998159, "uuid": "8c319013-686b-4493-acde-105781b6c607", "value": "UniphaseUnresis.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db30d14-fb2c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685040321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040321, "uuid": "6172ea7c-5904-4b22-9421-9de752441d46", "comment": "Malware payload (RedLineStealer)", "value": "be0136a44193ae32a79ca11a058cef98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040321, "uuid": "a55696ed-ce70-42b5-866c-4f1451385a4b", "comment": "Malware payload (RedLineStealer)", "value": "c02a223964b53dbf4af77558d554259f44f9d2981b56a92c3d1bf5815875955f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040321, "uuid": "ba0d2cbd-eec8-4906-8b9a-ca64be7b0614", "comment": "Malware payload (RedLineStealer)", "value": "62d86280b095e7371d70d415ee0b96d9c197b0e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040321, "uuid": "d4b14194-1c22-40eb-8011-6771b2c9b8a7", "comment": "Malware payload (RedLineStealer)", "value": "c4678e802055c74621f9ba4880b1509748e717ced1557f95b86f35c484ecc76d4d8743f58c2ae4673b9409645f49da50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040321, "uuid": "b68506ad-ff38-4ecc-8a89-23d1c5ddedbd", "value": "T140F41212ABDCD432D5F12B705CFA0353063ABE61ADB553AB2346E92A1C722D0A57173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040321, "uuid": "90925f1b-145e-4930-8cd2-75bc33dbf2e5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040321, "uuid": "70605d13-9dd8-4c58-82f5-45cde4186191", "value": "12288:3MrGy90Gyei9iiz6HHq//ztBcNpZVVCY5Z3PF+WQBbv/ognn0kBoGnMLtIW+4EzV:pypyDhz6HK/rMpZaq3d+WQBL/oW0k2Gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685040321, "uuid": "c4723c56-075e-4019-b607-366e4f9cdffc", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685040321, "uuid": "e8e84af8-07ca-4e9c-b61d-4e8e7cbd6b79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040321, "uuid": "9f064684-e78c-48ee-9913-ac373b3b3ace", "value": "be0136a44193ae32a79ca11a058cef98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97287bcc-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997065, "uuid": "cbe8934d-756b-418f-898c-dac2e9e83811", "comment": "Malware payload", "value": "49f944fc5631ef1d2ecd51d351e07e8e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997065, "uuid": "3dd2bb98-d4d8-4f15-9347-f5b6139a1af8", "comment": "Malware payload", "value": "c0666da6430c6378aa954c1c5a919f37dc50a0cae753ad0f1dcec27ecf79e996", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997065, "uuid": "f161c045-913b-4873-9a48-75a59f6966a7", "comment": "Malware payload", "value": "f7fe3352aa885ef3f9405b45429c28f0cc7bc7e8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997065, "uuid": "6a6eb970-a3af-4b42-9bbf-5f0bde980e14", "comment": "Malware payload", "value": "c5a5db8e9879f4c35873f0a6f6fc7db5f20477f498b98746141f014510e51e93c6eca6496191bb8792f42ae798fdb174", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997065, "uuid": "14031b9b-7a0e-4a33-a2b8-57f2543b671c", "value": "T1B85455814A5114B24B5B6E266A30D4B5DB7D1E7482CC5A8BF4AE3260FBDEACCCCC5731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997065, "uuid": "e98a2edb-8dc9-4a9b-a59a-fbf33d23e2f4", "value": "3072:a9sNJZxVaKXKyL84Nuw+0bGip68uGzQvGIYAmPiujcI0HeD8GLYb:zJ7Hnw4NM0bGol3iuIM8GLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997065, "uuid": "c8538ed4-2ac8-4a7b-94f8-a6e366b12fb3", "value": 286521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997065, "uuid": "e6bf84dc-c241-49d0-b196-4391a7ac5915", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997065, "uuid": "f8741fb5-1c1a-4d42-a6e2-8eae0be3a7a4", "value": "noninheritabnes.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4cc834-fb11-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685028749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028749, "uuid": "3b3e99c6-abef-47e5-b001-6e42a44ffb1a", "comment": "Malware payload", "value": "fa0789eeca52e74fe911a05e84d1bf12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028749, "uuid": "631bbc2c-f857-404b-a1a7-117fdc3546ac", "comment": "Malware payload", "value": "c0a0339fb57367f8be5ee007c5217c8ba75a5183c3850c40987f73c1a664608c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028749, "uuid": "c6a50dc7-627c-4b2b-9952-b4b297967106", "comment": "Malware payload", "value": "e57b6fc1b500dbc59606e0bba47a20da96a53b40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028749, "uuid": "5b0c2555-e2dc-4000-83cd-d4dab4407830", "comment": "Malware payload", "value": "17e0efd2ffc515ec3e2d7a41b18ca064adb1387c4a3ac64ee3b42145114b8c9800af9b3088b57ea6e1e4c2834e7c14ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028749, "uuid": "26cca6e3-bee1-4df4-bfb8-fb90b50591e7", "value": "T1D3D2C543AA91C4F1C2B19BF22E21B120E6BF65657130D722C7549E4C3E3F057AB36E66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028749, "uuid": "2bc738c4-f823-4e5e-a24e-7969f3ae8c12", "value": "384:rFW8IMqq5a6nW5AjArOEtbMhsgVOGqCBS9U1dUwHM/WG9Y:/5BnnAwRVOIkG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028749, "uuid": "e8450f85-9a66-40e6-9b0c-e959d6d8f405", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028749, "uuid": "f2369d6e-68f3-4979-9ac8-94978f57f495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028749, "uuid": "4e5ca23d-a136-48e3-86c8-25a4946c996e", "value": "SecuriteInfo.com.Win32.MiserySign-B.21162.16963", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a8c076-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003747, "uuid": "dc9c8673-c678-45a3-9611-f427460f927e", "comment": "Malware payload (AgentTesla)", "value": "560cae7af423b2d9acc4b66003894c8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003747, "uuid": "2769856a-71b2-4943-b272-3d2294484a57", "comment": "Malware payload (AgentTesla)", "value": "c0d2175379d5613de7a562df8a96a3aa3a9c1b740380aa4a43026a534fc39ef9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003747, "uuid": "5add15a4-3050-42e4-8433-60138cffa762", "comment": "Malware payload (AgentTesla)", "value": "b0b38b5edc9f7d855002d8b4fff46889b769b9e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003747, "uuid": "6430a8e5-2fa4-4d99-9eab-81b431eced79", "comment": "Malware payload (AgentTesla)", "value": "0c8896c72a7eeaad29b28d18a063694fb1c3ca2753fcc7cabea3e8517d62dc2787464352dd1787f94b0dfcc36cd6d943", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003747, "uuid": "afcee820-b063-4d26-be2f-48aec7c3239d", "value": "T1CEE423198A175602CBDF2B7818282635A2399E4B7422F3071CE2F7EEEF3D7561651CD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003747, "uuid": "7eb4e4d0-60b1-44d1-9efa-704aeb06753b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003747, "uuid": "a8bc9591-4f86-4826-a3a5-62393f1368f9", "value": "12288:W/tPplTY6RhKunGL5FFt54Y34yyqraoB5nMZO2Kaum/gDwb3PNGEADNAf:W/JTDE7SWzyQnMZIauBEb3PNUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003747, "uuid": "4d9dc047-28da-4622-9762-0b9d4aec48e1", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003747, "uuid": "649d2998-c59e-4d5d-8e8a-21f6709d00eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003747, "uuid": "b0c50fa3-b243-4bac-b992-2c1633d0b58f", "value": "Purchase Order _PER 001 \u2026scanneed 00101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6f662f-fafa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685018849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018849, "uuid": "cf2ff4b9-367d-4f43-89bb-6808704f9853", "comment": "Malware payload (Quakbot)", "value": "172d7af10f8d7ca716ca35db1a653458", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018849, "uuid": "07bf2c37-396e-4a83-9f93-f0d279f57b6b", "comment": "Malware payload (Quakbot)", "value": "c13610b0fc89ae7ce98f9897a6d36f18128d22fe42b7487b4bd8e7c45182f577", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018849, "uuid": "d5e9b35d-4e1c-4878-8171-e83fb7b991a4", "comment": "Malware payload (Quakbot)", "value": "ae4f766c729ace797843386a38e43c6c4a654b14", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018849, "uuid": "4f252ac2-62b2-4eef-af46-d1a9a0475bae", "comment": "Malware payload (Quakbot)", "value": "339993a4e770ddf6542bd36799a5ff12d2fbf0d7e686ae5538c13b98eea1ba2b4aca3ae89d897940d231677ada07183a", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018849, "uuid": "3a7b825b-05a8-4eea-830a-2656172fb936", "value": "T15A5308AF6381173869220224250F5BE1E7F04878AA76DB78E44EC3693351D39D6BE5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018849, "uuid": "8423b041-d5ca-4b9d-8599-17bf64b329be", "value": "1536:YaB5xvAkjSmRSZFysHVYlDC6jIoqMFAjVwQi3QiJ9:j5zSSsSlDCboTAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018849, "uuid": "4fdbf262-29ba-45d7-9811-4fa737d9b0c0", "value": 63262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018849, "uuid": "4d6e2791-d12e-4d95-8eb2-b2f480fb7381", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018849, "uuid": "24a16b87-6d98-4a4c-8743-bbfc83d39792", "value": "Claim_F752.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e04b3e6-fb27-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685038174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038174, "uuid": "34ffa804-ebbd-4140-9aad-08e6e4ca1024", "comment": "Malware payload (RedLineStealer)", "value": "6992e948c973e10e701b2069fc8a50d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038174, "uuid": "a97ba5db-ca5f-4245-b7ef-719bd0a9b588", "comment": "Malware payload (RedLineStealer)", "value": "c18d461cd880e179ec078722740b182ece28ff886fc63711a906e473bc83d750", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038174, "uuid": "cefff708-1d1f-44a3-9374-474559127724", "comment": "Malware payload (RedLineStealer)", "value": "ea5f7f816c970df9e1436427ba89cbaa23312f3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038174, "uuid": "e1b031cd-f848-4b70-9c17-9d5ec8ad70bf", "comment": "Malware payload (RedLineStealer)", "value": "752d47256a5b1514f9ead144eb026c02910295b6803262d61f3a1a31f3cd9a6dd84845327888f7402c27e66f73250377", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038174, "uuid": "00214e5e-3b68-4f82-bc78-3571bd1acf2e", "value": "T10EF4121366E88033D4B26B704CF323872B397EA19EB6832717569C5E1DB26D0E572727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038174, "uuid": "473e9ead-7ff2-43fb-96f4-b0009745fa12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038174, "uuid": "0c5d35ac-df8c-401a-b47d-8972c7ec5fe7", "value": "12288:oMrPy903jRGGvqlXLeNkLshwQrGun8uOlr0e3mHybRNgS+fTavCsjWvEzM:3ysY+YbeOshHrGu5DsRNf+bpsjVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685038174, "uuid": "454c1190-4bd0-4b00-908a-18593ff5ddc7", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685038174, "uuid": "f331247e-56a9-439c-b057-7cbcc78f3aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038174, "uuid": "c3ddcf12-ff0f-4298-a24e-70533ba5415b", "value": "6992e948c973e10e701b2069fc8a50d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affe0e6e-fae4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685009563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009563, "uuid": "2ead921a-2275-4ff9-abb4-5ea873e639be", "comment": "Malware payload (Quakbot)", "value": "31893a60c292a9a72ca9d7231f8945eb", "object_relation": "md5", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009563, "uuid": "249de5ae-474b-4177-b909-01cc067f83f3", "comment": "Malware payload (Quakbot)", "value": "c18d497ecc35bc2721e9b25017837a8ada4e4bbe6e4486953598d952907f684d", "object_relation": "sha256", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009563, "uuid": "3e91e8b0-735b-4854-8830-785fde6450a7", "comment": "Malware payload (Quakbot)", "value": "0a02c4b0e518fa44c1b4c3830d1b0da6c1aa5702", "object_relation": "sha1", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009563, "uuid": "38832ee7-2168-47fc-abd7-29137fdeb046", "comment": "Malware payload (Quakbot)", "value": "1ed0ba478766b0a45f08a2ac86b88f0f5e5a2edc1e42fd46e21bb81c3572b8ba98b45cd6a37b37a4489fc8cbf081590e", "object_relation": "sha3-384", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009563, "uuid": "3847e7e6-a329-4b13-aee8-b8c89822802b", "value": "T12D15D413F592AD67D7E812320091F5355622BCBCC3A31AF73EC476FD39A69405F6AA20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009563, "uuid": "6d51a5bd-7511-44b7-ab4a-6e383b2bb19e", "value": "69b5a2b4c355363112fef443743090f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009563, "uuid": "acf9a6fd-f8cf-444a-acba-1b9393099a6c", "value": "12288:COysJ5nhFvhxaiz8hC6CSvqdRcVU2cQpbls6csdCVsM3c:fhFhxaizH6CCqdRcRcQpbxFCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685009563, "uuid": "29daeb11-6a95-4521-a2f6-2a22c43159b4", "value": 943284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685009563, "uuid": "753440e0-6514-4e22-ab22-b4aa2a430a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009563, "uuid": "5ba49a01-3064-4391-9ba0-cefe91070e4c", "value": "EGloe.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77eee996-facf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685000449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000449, "uuid": "3576526f-e0af-437b-a03e-9067240d178e", "comment": "Malware payload (Stop)", "value": "dcdfd1fe9acfd4bf325a851b87ec8f02", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000449, "uuid": "b7020338-64cf-405e-9735-ed6bd81b945d", "comment": "Malware payload (Stop)", "value": "c1a48d3a68737c6275ef9eb5361c47fac3f268f94d6e47b18eca07082b946280", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000449, "uuid": "d7e74758-1b72-403a-a2fd-f7a21d9d5e5a", "comment": "Malware payload (Stop)", "value": "3a6ad47c37ce048fb719dff912406bb01b129488", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000449, "uuid": "cbedba25-63b9-4ca3-9d79-4c1f0fa09aef", "comment": "Malware payload (Stop)", "value": "2009db18b9bc6a8c3bab32ab64c46da8481a78083ecfc3beeb1b4a123bb457e06593db84b4ff5744da98bea409ea811d", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000449, "uuid": "bd7a0a24-b84f-41ac-8a9a-23532006bb9d", "value": "T12CF401027AC0D071E59709359962C7B99A3BFCB24B618AE73B943B7E5E302D0CA75743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000449, "uuid": "5609a20e-7161-4c95-b2bd-559e616d9122", "value": "761a416c92dda0b5d3a5091999204e5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000449, "uuid": "32f0a96b-4c79-4798-93c4-13494977dbfa", "value": "12288:2DMaQ1UkadLa6oYNzDj/Ddlb+FcsGV69V6RhspMhGyX1dZHvEjcVpvGg78/4iFzZ:2A/+jdqW/RRV69URh0mGdjWpvx7A4iF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685000449, "uuid": "1553c6a9-6d64-48a5-a909-ae741c8170fe", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685000449, "uuid": "69b22313-c048-46d3-a076-4f10c2e7f58f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000449, "uuid": "d93c3aeb-001d-46fc-af99-9fcb3223dc09", "value": "M7R81891.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff689b4-fb17-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1685031279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031279, "uuid": "aa3ee760-3a56-44aa-91af-6c4f587bee88", "comment": "Malware payload (GuLoader)", "value": "7d131fe663e316890234bd712c7412a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031279, "uuid": "1b338b4c-802e-4b02-9f68-ef26381a53e6", "comment": "Malware payload (GuLoader)", "value": "c202341f6d54b9b2bc6ee1c53e51260a0adf11a81f9a509429f9039ef1d00600", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031279, "uuid": "e7838b27-87f3-4d62-a9cc-16a2ad41cc14", "comment": "Malware payload (GuLoader)", "value": "6cf5321a87b37bf68a1000cf6e2ea0ffff8cae71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031279, "uuid": "25de9015-2406-4271-af7c-e39d78e47eb9", "comment": "Malware payload (GuLoader)", "value": "f8c1be2fcde1b30400b04fc67546ea4d464400965c59eb5caf709329faa456332b5ba7ede2fb9f92a5e15c6c87afd661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031279, "uuid": "1d1e8743-2a96-441d-b030-7b60484db69b", "value": "T1E80559311F98C813E35194B871E2CAD8EE75BD0C365ACD52AEE7786E627C6C168F9103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031279, "uuid": "76209dc8-6c07-4dc4-959d-4703fe129e3f", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031279, "uuid": "2e6d9250-01e3-4e90-b598-c050f55fdb31", "value": "12288:9PKcWfPW1nUOMaq2LFbicxjMOJQVZq+F5S9vqI7a2CRbB:FWonUZaqMx2DvSxh7a31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685031279, "uuid": "9c506ab2-75be-42ff-b8b3-50f36d638cc9", "value": 822619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685031279, "uuid": "bae77144-e20f-4bda-8fb6-d6b8ac51976b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031279, "uuid": "515a1155-fd6b-4fbe-85f3-155c5b5c09c7", "value": "EXTRACTO BANCARIO.PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9c703c-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1684994852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994852, "uuid": "29a794fa-0fb4-48ae-8baa-8a347db00fc4", "comment": "Malware payload (QuasarRAT)", "value": "40d785e478fc5056c5f6bf8004d6df3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994852, "uuid": "d42e71e5-87c0-4f6d-81bf-0c3b15a77f48", "comment": "Malware payload (QuasarRAT)", "value": "c2386eeba5474480c139756e0899c729db65c6d950c20a9923077b6dab5dba9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994852, "uuid": "588ecf88-248a-4a8e-b6d2-efdc9ff68c64", "comment": "Malware payload (QuasarRAT)", "value": "ac9c0de734798725e0f1fb2a1872ebbf6270f49e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994852, "uuid": "e4a22014-34f9-47dc-b01e-75799da109e5", "comment": "Malware payload (QuasarRAT)", "value": "edbcf3bdd280d26c517f32029b23981bc92797ab4abeb5ab567e0b6ed1d3572b53d3489925c6e23b69803a0626a0e1d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994852, "uuid": "8fa0744b-cec8-4028-9c62-e5429312264b", "value": "T1CBB4D00276C585B1E57329325A399B20AA3FBC205F3689DF939C191E9F735C09A31B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994852, "uuid": "88c256f7-ad63-4e6a-9e70-28742d73f295", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994852, "uuid": "26f44574-fc58-4cfb-b916-1b48a350523c", "value": "12288:PgZXEAO/BUdG3gVdt7K7WX+tWb6PG2hCWtcfNWJkJT2m:PgZXoZUTVdt7K7qb6PG2hC6kNWsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994852, "uuid": "aa2e9ee0-8cd3-47a9-be57-d9c3722f09ff", "value": 512933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994852, "uuid": "4843cc41-0123-4361-82eb-71df324a091f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994852, "uuid": "1512bb1d-cfc4-41a2-9882-ac1c08736aa1", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7ac3fa-facf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685000373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000373, "uuid": "bf54422c-8f58-49f7-a3c0-0df2e7aba9f6", "comment": "Malware payload (AgentTesla)", "value": "24fc1b788089d81c274e16e075676e6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000373, "uuid": "c87d7a41-76f2-4b1b-8f9e-a931c8d2081f", "comment": "Malware payload (AgentTesla)", "value": "c35535ac9dffd7d1deee7c979749480c6ace5562f83d3bcfa005c2dbb2a9ee95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000373, "uuid": "eaa5e308-4e37-412d-9635-f7bcec13efdc", "comment": "Malware payload (AgentTesla)", "value": "6f41454bfa71568f32749bb4a9840634cbcdcc78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000373, "uuid": "deb6aa26-a4da-42cc-bbff-dcc1fb223d01", "comment": "Malware payload (AgentTesla)", "value": "96258fdc192041487858fd3a107c5fedfbc40973931223f74122d352a723daae62bfbf93805c00f82a0dbaafd069af6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000373, "uuid": "50d529f8-c252-4a37-b497-357b3a6b89cc", "value": "T136E4CF2A369B9C33C52505F95852E2B893712FB47127C3AA9CD37CA7F1F87831906687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000373, "uuid": "75756a06-8f88-4aeb-b5d6-1860e25f63d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000373, "uuid": "a37d4f85-afaa-4b81-9c14-0a15baf0bd7b", "value": "12288:hKV2iN/mt0BvLA4lSg0/vHZDFWMRNbrYponCNt8bJQt4TZ3PW:wV1h60loRHZxPrMyGsFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685000373, "uuid": "7ec53f0c-95d7-4820-881e-5418d9d41ae8", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685000373, "uuid": "62159a0c-2062-4f8a-883e-0bed5137d82a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000373, "uuid": "58a9526c-ca5e-4559-848d-14dd43d746be", "value": "M7R68311.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97d0a5f-fb20-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685035321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685035321, "uuid": "d5a94b1f-d7b7-4c32-8855-4e5f61f34dc7", "comment": "Malware payload (GCleaner)", "value": "a475c40b0b188ae9f91447f0a7277abf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685035321, "uuid": "256cdfec-b6b8-454e-bf75-fd62790b20ba", "comment": "Malware payload (GCleaner)", "value": "c4dd08fe1d78680d41e799cd87cf4702e47946a27c89d6cd0af59f717807e448", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685035321, "uuid": "d031e4c1-ef66-4d80-ad51-c7e97214fcb4", "comment": "Malware payload (GCleaner)", "value": "e9823bf44cfdd3d56382ebf7c5d13fa5799feb7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685035321, "uuid": "58796d7c-d4c8-49db-a0d0-6bbf66d2c72c", "comment": "Malware payload (GCleaner)", "value": "623a010d9eae29e104ec5c3c4ab0d5f64e0f0d9302b31f0204ee19662718882b463d8abb6e0751002fbf9b02ece8e08d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685035321, "uuid": "9c78a72d-b2d4-4511-a566-423d90f8629f", "value": "T1D9947C0367E07C65E9255B328E3EC6E8771EF9908F4D7BA762586A2F08701F2C172746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685035321, "uuid": "9f51574e-c4f8-439c-b22a-3a95a9cf0850", "value": "f7a21c5a25f4fbde0c4ce2c503f4a18f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685035321, "uuid": "705a69be-f5a9-4f66-a162-7bc68499dbb7", "value": "6144:a+wgnqUwxI9DT7+W7NIAFdIDflA3z319q5ICAA1Dfa:aQExI9D2+IAYD+31g5IBcfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685035321, "uuid": "2e294a5e-5d33-4e66-a16a-747fe3e7338b", "value": 419328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685035321, "uuid": "6ff7f223-b3a0-4f73-b7c3-4a2c0b966847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685035321, "uuid": "6b64b9a8-1833-4afe-bf21-f1e2005cb686", "value": "a475c40b0b188ae9f91447f0a7277abf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dabd97a2-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997179, "uuid": "42cb43dc-e17d-4206-af6e-895f81958244", "comment": "Malware payload", "value": "51c2b57890a8d763b3e45f4ca8d22e40", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997179, "uuid": "b84d27eb-a95a-45fd-8c42-36433e580e47", "comment": "Malware payload", "value": "c4e5540034809f0cdf8953d57b5690f0769a7ce8bd4905601cc2053764b7033c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997179, "uuid": "19044cfc-fc76-4ddc-9a9d-75f5f3d335f5", "comment": "Malware payload", "value": "b317c1231193a2a72aa87964fa27f48d4bfed19f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997179, "uuid": "5dfdd19a-f91a-4833-8d32-48af52dce165", "comment": "Malware payload", "value": "2f1dbb42746a8b382472677c14b8b0a9b6613d9dade517617466f97dd63f03ce4b0e61f28933949a8c4123a3e4354b63", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997179, "uuid": "05d43609-54b9-4e78-809c-9bc33a6cae5a", "value": "T1FB54A8844B2129A64B5B7E32B72464B9EBAA1F78C2D0458FF45F7261FBCF90CC8D1521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997179, "uuid": "3389a7cc-d840-4f6d-9cf9-c340f209e74b", "value": "3072:fdWlM2whyBA9CMrcF+Vd9eXtR2uvgNxpRFqeK7rY+mpLO:1WlBA9VXeXH2uvgNvIc+mpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997179, "uuid": "7e88353a-320c-4879-9f6f-bc6a643275ad", "value": 299863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997179, "uuid": "ac0a5c3a-8b62-41ab-bc7b-ddc5e656bc47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997179, "uuid": "bf29a7e7-ce88-4dce-aebe-4a43210bfa90", "value": "masticator.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91723291-fb34-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685043871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685043871, "uuid": "1f6c3977-5877-43c1-bb1a-491c8d7180e9", "comment": "Malware payload (Amadey)", "value": "7ec7758999fe516ae67d9f143a3f8947", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685043871, "uuid": "d06aa656-edc8-4678-8edb-9c3549ab077e", "comment": "Malware payload (Amadey)", "value": "c4e73871c57abe6d12f3db844577afc109aaa9b31470b884c69c28f5c999ec99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685043871, "uuid": "090d9083-23f7-427b-a9e0-a4b4d850c888", "comment": "Malware payload (Amadey)", "value": "ff26102ce260b03c4e5bc400322ddad04191d67d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685043871, "uuid": "efa87594-df2b-4161-a47e-71ea566be291", "comment": "Malware payload (Amadey)", "value": "0fad3d91010ca4591d39484e5290356e2e997a808aacf3f61dbbc44515aea2baba4742423f408b1e75e96fab9dbbfb1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685043871, "uuid": "1f10cb17-0e59-4967-b840-55ed54bfaf81", "value": "T18DF42343A6D89532E87107B01CF713930F3ABCA6DCB443AB2745AD991CB3A64A535B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685043871, "uuid": "d910d1bf-8d6a-47c2-ae5d-d4e5c0e8423d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685043871, "uuid": "3fe0bfb0-0fa1-4956-9d96-04e485539de0", "value": "12288:BMrMy90A+2FDAdbpNmj99mOcCWdm2L1QiSwur9lYTLZn0kB1nnMLtIW+IEsCk2:NyzAxkc7dL1QLbYT10kznML1+W2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685043871, "uuid": "ce574018-1be7-45a1-9845-16b5543ca34c", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685043871, "uuid": "98b26ee8-2fe7-4e78-8bd9-0d592d682ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685043871, "uuid": "dad92628-d516-4270-9f07-59441fdae335", "value": "7ec7758999fe516ae67d9f143a3f8947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506c997a-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997806, "uuid": "b6390958-b0a3-42b4-badf-d0bd20b46817", "comment": "Malware payload", "value": "b62bbd52ba30ada5f628727cdefd3536", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997806, "uuid": "0fed181d-ee05-4068-969b-62fcd1cdd753", "comment": "Malware payload", "value": "c4fc56eab91d0479aa5d677564044d081a5d9b865cbee9b6f1d05e32f9bfa9ea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997806, "uuid": "27c4bb83-9e32-4be6-9814-8d073978f37f", "comment": "Malware payload", "value": "5f872c554d32744ccdfb3dad048888eb46e8caa5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997806, "uuid": "afdb5e5d-f666-4aec-8e21-f3c46b1b9e52", "comment": "Malware payload", "value": "42e580cefd78ab93415590c4507f866cc91c251a0ba1e7881c328a2f3cce251a3b402fdf4c3e3ea75f7bc93211eb127e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997806, "uuid": "2eb52ac1-daf2-41ef-838e-c79e73c32f99", "value": "T1E86454844B2129B64B5B7E227730A4A9EBBD1E74C2D4468BF45F3261FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997806, "uuid": "a36c04d9-7163-4593-b248-8319f6355770", "value": "6144:cyRmysMDS8jLcyjt1w+oFZ8SprS4f9BoIMT2FPCugPczd:7ACI6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997806, "uuid": "d8f04384-491f-4b38-9d2e-564f71479a12", "value": 324563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997806, "uuid": "cfc54e5e-31de-4d4f-befa-0de6307c9d59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997806, "uuid": "70e29ce3-5adb-40b7-9d21-596c2ff25313", "value": "RacialistsSucro.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd685f3b-fb46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685051729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051729, "uuid": "eb69f27b-fb65-4b6c-b908-f5719df74901", "comment": "Malware payload (Amadey)", "value": "ad070db51e77e7aa8d72473302e7e4af", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051729, "uuid": "70c4d587-e850-446b-92c6-e5f83b698733", "comment": "Malware payload (Amadey)", "value": "c54d613e267f7454e559c6147712b810e60e13c38e75e34ce2d85064999b4037", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051729, "uuid": "b4d0ea21-437e-439c-bdd0-b8cfd4ece204", "comment": "Malware payload (Amadey)", "value": "02b4efb711b7406c4c91132cde5a14c9306bf8ed", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051729, "uuid": "b4ac075a-119d-4fb9-adaf-f054a6c58b5b", "comment": "Malware payload (Amadey)", "value": "f5479d2141137dd47e5860c16e3aa3e63f6ed92d3058e61020c3539476868d176a4d003fa82f5b6943b2b20b0d27ceeb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051729, "uuid": "8c66863d-63db-4968-9b86-91137111b11e", "value": "T13DF41221B6E44132D8F51B705CF303930F75BEA28DB84367279A5A5F2CB3581A93272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051729, "uuid": "9b85ec2b-070f-4732-b7d3-32480a958c7b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051729, "uuid": "0fce7d51-1bd2-4448-b1f6-8a11a106cc16", "value": "12288:vMr9y90i2E9Ewv4WXhfUQWauwaSBxRJ3m7N9TuNBRWOmXuKbn0kBjZnMLtIW+eEX:Oyv2eEwcFwaS1JE0NBR8Xum0kBZML1+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685051729, "uuid": "ee433c0d-f00a-4f14-a2ca-f28d6a121194", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685051729, "uuid": "3e9da500-24b5-4970-a95b-e5ba25147311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051729, "uuid": "22888402-c55a-4d82-8926-3bfd3754137e", "value": "ad070db51e77e7aa8d72473302e7e4af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc478c0d-fb0f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685028078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028078, "uuid": "feef0b74-bec2-44db-af22-8865aa7b8d97", "comment": "Malware payload (AgentTesla)", "value": "6a686b0fc9805dacef8bf2ac4dda02b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028078, "uuid": "cf293a6d-c40e-464b-962f-eadadd7c6533", "comment": "Malware payload (AgentTesla)", "value": "c581ee5101bbdd7618aaf46c993dfce0b12f96e8ff8efdb3ac46cb6abfc52bf3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028078, "uuid": "e3210b96-990a-4fd0-b2c9-51f035fe4ece", "comment": "Malware payload (AgentTesla)", "value": "4083caa79787a88e38cf9757cca6b6f5603501e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028078, "uuid": "9f2d53cc-1854-4020-8b6e-d236f5f21d91", "comment": "Malware payload (AgentTesla)", "value": "073f040e6a210d60ffa11fc6b0804c9500ca43c984a357f630e50bde4e9a482116f69281e475e92e180c85ebde5ba73a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028078, "uuid": "36a72c7c-9207-4329-8a5c-799e389bb1fb", "value": "T131545442DB9A21C8F3E27A408BBD11283B57B485583F9D5D049CDB3F37EF94498217AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028078, "uuid": "c1047a44-ef9d-48a8-a6a6-59dbd10cd809", "value": "1536:nJmlZOi1bxqfiFjBG+b7/LrkjkxkZDIm26NZ3LRV0ubIGkikGkFjGkikGkKEt0eT:n+1bxwiFb//vkjkxWfTVJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028078, "uuid": "2c131aeb-62ae-4d4d-8f0d-7fa27c4dd14d", "value": 296032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028078, "uuid": "0ce7ead9-ebdc-44b1-b9c8-3798cf04d89e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028078, "uuid": "de6232d3-4ac7-47a4-a8ca-77c2a481b63e", "value": "AWB 20230525.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df94792a-face-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685000193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000193, "uuid": "d4f19550-4b8d-4127-a0c7-023ab5946666", "comment": "Malware payload (Formbook)", "value": "b4b792f802c3ffe79c4363b303582544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000193, "uuid": "bcc27016-fcb9-42e3-b11a-263a24d105f4", "comment": "Malware payload (Formbook)", "value": "c600d764532a73a55f4eca84c27637dab39b4d47b06b13c71a691cafffbe7aba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000193, "uuid": "d0339620-e223-44f3-9012-cb76fe378ae8", "comment": "Malware payload (Formbook)", "value": "5fc4dd713ae499cee1d3fd02325ad75715b723b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000193, "uuid": "4f86bed6-bccd-4365-8dc2-c60af63ca87b", "comment": "Malware payload (Formbook)", "value": "1390c312ecb68e00098a6328391ec449d0ecfa031343a831ff5fa851ae5c62c8d7cc6468bffb76dc3601b11818a1a89d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000193, "uuid": "96dbc862-df10-43bb-a5f4-2ebcb9a4a3a4", "value": "T16644121063D5C097E9E245B02FB99992AEFBBD2924A5824F3754374E7CB2383990F317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000193, "uuid": "11af2227-29fd-428a-890c-2a8e13be97ac", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000193, "uuid": "a29dd7dd-a688-4bd1-84bc-d71ab68c186b", "value": "6144:pYa6w89kcA3Z43WKXJZCpE29780OAhXH73lvinL2QLOXr7:pYu89kciQXJZCq2dr7VviL2pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685000193, "uuid": "830fb77c-3c53-48ec-a843-534f75ea763c", "value": 259382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685000193, "uuid": "1e0f5a93-3a44-48a4-bb83-cde041067557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000193, "uuid": "6c91bccf-206c-413e-b299-2fdf16a82eae", "value": "1247-60720-ARMAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d86f5b-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998008, "uuid": "c5089803-41e2-4633-86f5-96e5d9ea2402", "comment": "Malware payload", "value": "0a0efbf2a8ade6e2258c9bdf81f1d2ae", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998008, "uuid": "936e94d6-a09e-4b05-a826-11dd6fcd91e9", "comment": "Malware payload", "value": "c63c266a5ae45ab0ec61d423e45e1d9a43e71f4b40c3e9425036a8a32f821caa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998008, "uuid": "3f858c3d-d656-4090-907a-6fba83bfc2f3", "comment": "Malware payload", "value": "ec9f45ddaa03af27ba65d764c412714c56adf8a8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998008, "uuid": "9bf53e93-2d6e-4a18-b63b-59bd6c7634ff", "comment": "Malware payload", "value": "ed08d2b21cad38316983cf47cedfd2ad3f4b76fb13cccf56587f4229cadef858dfb1d324772fa7bd7a74682042e5516f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998008, "uuid": "16a76ac3-ccd1-4fcb-8fe1-86bf468f048f", "value": "T17B44AA804B2519A64B4B3F36B72064A5EBAE1FB9C2D0458BF46F7251FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998008, "uuid": "7e2a40f2-d32f-4995-87a9-dc740bc44ad3", "value": "3072:6elQBMto42GbpFhcEgDioNElqvNJm4rhAe3ANMVPxMufVDvtsXWfenAxS:6eGMto42YThbgDioFDmmfJnJtiWGnAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998008, "uuid": "9c01b2df-60b6-4439-a0cd-5ec15743be50", "value": 272925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998008, "uuid": "a47620cf-f4fb-4311-946b-cfe616d8ee4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998008, "uuid": "4238b466-20f7-4034-9b92-bc3956978499", "value": "TittupedOdiums.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ec4c33-faf3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685015773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015773, "uuid": "38113ba0-ccc6-48bf-b0bd-1c8138635b23", "comment": "Malware payload (RedLineStealer)", "value": "e34e3a6fd4fd9dfee3bd2840dc466a40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015773, "uuid": "4d0fdb9a-a4d5-4f22-bbaf-46ffb2cbcf60", "comment": "Malware payload (RedLineStealer)", "value": "c6bf2b63cde4d90d3e9031a3f47d7a8a798cf73b2434b84461c0836750879b74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015773, "uuid": "defbd32d-e1db-4302-b3a9-5993d8db26c0", "comment": "Malware payload (RedLineStealer)", "value": "373be4cca5424ce1233b57923dfa68504600c266", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015773, "uuid": "523a2527-2801-4b03-9717-f593a8da073f", "comment": "Malware payload (RedLineStealer)", "value": "bea8b3de895ee14ce63482879ba292af4e5b51cb92ff64995ba0c735d20a5c685ea29b4fb34c6be61d02ae84fb1a3e10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015773, "uuid": "0a7b8044-74a6-4ac7-bf88-9a4ffa141e08", "value": "T1C174CF02B2D2AC71E51A5B318E2AC7F45B2EFCE18F556BDB63447A2F09702E1C572706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015773, "uuid": "24f8e0b6-8eb4-487a-a1ac-d04f27289594", "value": "4dc3e52c058b03af2b7dec3a031b4e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015773, "uuid": "c7020177-2682-46de-ad57-87d45440f710", "value": "6144:Ufeo6aescsu1qGr8ytcJFLL4+d2E0E7TTw4j+:afesc5v8ptd23E7TE4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685015773, "uuid": "e0a17013-6749-4f82-8c41-54a65df0323b", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685015773, "uuid": "d4872cc6-eed3-4e38-bfe6-38dd80b919b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015773, "uuid": "4597300c-9158-47fb-9012-87ebb89299c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec5414b-fb17-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685031304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031304, "uuid": "249bf4d1-7ea1-41d5-8877-bbb5ae43ebe8", "comment": "Malware payload (AgentTesla)", "value": "e0b1800a3e2130e054ccb47449deaf40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031304, "uuid": "f9376c32-fe84-4e68-b39b-8ea9314f0271", "comment": "Malware payload (AgentTesla)", "value": "c7057a9a9f625dc07c2d893859df339831330e74a0cfb6b7677bf973f0af279f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031304, "uuid": "75b1e4d4-fc11-4fc8-b577-928dc7642f6c", "comment": "Malware payload (AgentTesla)", "value": "0607caa0928ba90d7129371dc3c927a4e6738149", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031304, "uuid": "b11f1cb1-bee7-47c5-ada8-5732303a273a", "comment": "Malware payload (AgentTesla)", "value": "7c774531dae26d769f8823664d19dcf8179a6c92006d1e1c222a5f89ef6c855d601ed0bd1305ed529774dde1b5f4027f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031304, "uuid": "ec81d984-2120-4d36-bd8d-c3cb5b670fe7", "value": "T1CEE40251212E7F5BC93AC7F94431363963FBA92AB432EB260DD7B0CB7665F010A01997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031304, "uuid": "61a7a410-2237-41dd-9670-1534aedd516b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031304, "uuid": "3c5dea10-5c3d-4039-9249-010f5fca57bc", "value": "12288:P5ymzZBEP85fOqOPwoGzVqgH2qHQVBS1YbS5YILRjSBZVGSjrAArtJiRC:l9BEP8BOqywoGzVqw28QVBSQsHljeCOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685031304, "uuid": "40c5e28f-fc41-49b4-b906-a1b2a7ad81ce", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685031304, "uuid": "7cc9a132-8b1e-4fd0-b313-e837869c0228", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031304, "uuid": "5e1388f9-73dd-4345-9041-41bdf421e5f2", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8dace44-fac0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684994116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994116, "uuid": "ba83ccdf-d44e-4384-8daa-2a0e426df0c6", "comment": "Malware payload (RedLineStealer)", "value": "0fcd965a3fc6b830751b6c0e3398bc26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994116, "uuid": "d13a6b14-30f1-4291-bc27-126f341945bc", "comment": "Malware payload (RedLineStealer)", "value": "c741fefc9b8dd17e18e92378a9f6f48a9b422fee6cb53f23784d75efd515331f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994116, "uuid": "f370f224-f9f0-4558-98fb-836e02733955", "comment": "Malware payload (RedLineStealer)", "value": "52634d473896f49f125d72262d24ee237bc0e136", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994116, "uuid": "87962a46-fdd2-440b-99fc-696ee1761551", "comment": "Malware payload (RedLineStealer)", "value": "87b8b00070248f6e5b5f96457e1088e11a4599bf675ed3b3e08c1417e72d7282c319259e39dada39dad3aceeb9f6946b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994116, "uuid": "d7484b96-ff35-4f2f-a389-951c38e9cea6", "value": "T19F5633C75F2B50EEC43372F33FA9E2C3A31A91E76309718D671DA2914DA62B47A64704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994116, "uuid": "4082e87c-5e54-4694-a72c-d3843e0c2a19", "value": "968fe7eb2710ba43db1e5b6909744004", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994116, "uuid": "f94ff66c-97a0-4500-8a38-6dc1d7bef519", "value": "98304:gCNSHBOZsosjcLq7GQk4DSh8DxY+xS49vIQRTuoAVubN0YBSOs:UHwZsoBLJiSaHIKvIQlA8CYgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994116, "uuid": "d507f64e-d522-4fb0-85ff-24f8b4d8aa3b", "value": 5950464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994116, "uuid": "6d8642b4-5d2e-4f82-9f54-049c8989a055", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994116, "uuid": "69ba9113-8f91-4283-a1be-8cb47d7bbd33", "value": "GTAhlMWYG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6ad522-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997024, "uuid": "7a0de3d4-a3f7-4541-a267-bf0540045ecb", "comment": "Malware payload", "value": "fc3f110b4557fd95494b5cff83648eed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997024, "uuid": "ee81c662-8de0-4465-979f-ff12dc75efc3", "comment": "Malware payload", "value": "c79456d984aa6480555d37823a43688aae60efa36f642a647c5e5b48ff32ad6d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997024, "uuid": "a77f8530-a174-4110-abbc-f5c2d5e36137", "comment": "Malware payload", "value": "74482351d00e39e68f71fac5b0f4ad4cba228af2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997024, "uuid": "eef2cb40-24b1-4b7f-8cf9-f489fcc9952d", "comment": "Malware payload", "value": "8d9aeddefef4005646ec7300b3c02318dd0d7bcf007b52a4670279aff9a4dcf495548549f3918e9f67455d90cc91ddf4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997024, "uuid": "f9a04a01-6043-4d0c-9e5e-c2f4a30a7abf", "value": "T1175476804B1518B64B5B7E22773094B5EBBE1E74C2C85A8BF45F7261FBDE98CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997024, "uuid": "f44c12d1-ecde-4c86-a806-38469cf139b8", "value": "3072:+gmY3dJc5HHJaRkcPG/YuUxBNgBYnn5y5eJg8JixSn9omGiz:+DY3dJyJaRkcOeweJgFxSn9+iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997024, "uuid": "a9feb00d-6020-410d-8350-4edde95a7011", "value": 285743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997024, "uuid": "19470bf1-813e-4fe9-9297-361c9195c093", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997024, "uuid": "58d8f99c-5374-44f7-8c8d-d244160556f9", "value": "nosethirl.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19559c3-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997969, "uuid": "eab5d429-0e45-438b-a075-38f4ace7a478", "comment": "Malware payload", "value": "e607305fc43f4433dbd2248fde0d3d54", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997969, "uuid": "f27b56a4-b863-42d2-8c44-098890b47da6", "comment": "Malware payload", "value": "c7af6be0fe389d1bc8e4f05ad74b8ea6d90443aad986b57c0e1330880e6a1a63", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997969, "uuid": "5ff4fe5e-35cf-4167-9552-1be313e5b785", "comment": "Malware payload", "value": "ace107096591b6fe84b89e76ad4164d6ffea36b1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997969, "uuid": "84190ddc-d4c5-4e41-a02b-dabc967f0299", "comment": "Malware payload", "value": "b03a5dc8ae095c4fda280fb4f1e3c548c690c31e9f177c3c5910ec0c19755b6b850bc91b11788379aa89ffd23a5871c8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997969, "uuid": "951e5b22-a0ef-4c9d-9dff-2d50d8b671ce", "value": "T1146477804B1518724B5B7E26A730A4A5EBBD1E75C2C8598FF4AF7250FBDF98CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997969, "uuid": "57feb586-4715-4981-a630-51fb5c8e9104", "value": "6144:S+pEIPtY4jrYE0aQm9Tj95M3VaO5KNZ4Lu/vAy2KT:JtUUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997969, "uuid": "43544b3f-c855-4c1e-8c1f-15351dc8b387", "value": 317893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997969, "uuid": "b0675374-c5d9-45c7-8c01-3cf4c25d0fd1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997969, "uuid": "d234a411-6386-4145-8a09-9677c4df9072", "value": "SubrotundityTri.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c9a06d-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997030, "uuid": "5d8e7a07-5db4-4d17-839d-7d2b1a917172", "comment": "Malware payload", "value": "f5d408778b03087c8d98ff91c8349817", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997030, "uuid": "1525eecb-b715-46bd-8cb5-44e10aa10432", "comment": "Malware payload", "value": "c8718fc5d31d328a1443622abb86e433be6d3adcfebb95c2dc9ee51a92687478", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997030, "uuid": "8bd93685-b9c5-4cbd-afe1-f56723e5dd81", "comment": "Malware payload", "value": "df2d48df4751d357cb1bf1a864ddffcebaca87eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997030, "uuid": "7d8afbf7-379c-4073-b854-84aee4bf8130", "comment": "Malware payload", "value": "7eb6f5b9ab26531e753ee614db1a0a0e4e28973faef041a26120a30f07359d189cd3b51ed851363ea7d533aeeff4b24d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997030, "uuid": "2c819043-c9b8-4c7b-8231-f78ba549d505", "value": "T1D1748584471528B24B5B6F22673094B5EBBE1E79C2C8598BF46F7250FBDF98CC8C1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997030, "uuid": "d7afa45b-bf3b-42df-82bc-6187574160e4", "value": "6144:Ja8hESX41Olf+u/GksY0ele5H/koRg7XNjw6d2/uurFZ5w0Dq8EkZ:JavYI6h4/W+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997030, "uuid": "4217644a-78eb-4956-b111-adbace50bda2", "value": 340205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997030, "uuid": "4b7eb78e-4d02-4ed0-b2ea-2c1e56926625", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997030, "uuid": "21d9dc43-0893-4df2-8625-3ebffc6fe861", "value": "nonstoical.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05c5f71-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997215, "uuid": "90e146ab-86e0-4a39-a409-195dcd826244", "comment": "Malware payload", "value": "372d39e08013ced6846434e0422919d1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997215, "uuid": "1e2c4163-437b-4010-8485-994313c335f5", "comment": "Malware payload", "value": "c8f6cf9e79aaddb9c89dcf35319cd642512d5d2469b6c7c635916a405bcde8b3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997215, "uuid": "927c9fa9-e6d6-4efb-8289-a49fd106e462", "comment": "Malware payload", "value": "b7c8f24899c18ba29000bc152227d6b2873a9a8f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997215, "uuid": "86877046-1185-4d67-9c0a-ea10becfe6a0", "comment": "Malware payload", "value": "be6ae123d7f425fcf3ebd53a1315efbdabd0cee2a4cc7a06049858366efbec9ab8e79571150b3d162de0cb0e19357320", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997215, "uuid": "d263284a-1565-4c98-82f1-07a7f8030e81", "value": "T1386485844B2128A24B5B7E227730A4A9EBBE1E75C2D4468FF45F3261FBDF94CC8D1521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997215, "uuid": "9c92cea0-6dcc-4d6c-8a26-da627c8f0e82", "value": "6144:qbOQDTaptXGsEFZJBlEBS76OZSfXPgq153OZ3:qDpjCa6XPnG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997215, "uuid": "8085ec8b-f870-46e3-8b41-4de29493f97c", "value": 328989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997215, "uuid": "2ccbfdef-1ac7-4523-8b3d-13bc1ada22e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997215, "uuid": "dbbde87d-397f-4229-ba71-37e0a56c2ecd", "value": "lizzie.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb63d73f-fb46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685051753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051753, "uuid": "7d099ffc-d12f-465e-b17a-67ff617d4d40", "comment": "Malware payload (Mirai)", "value": "d00e880bfd7598454a0a8e60cbae6f66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051753, "uuid": "aa9f54d1-7450-4224-afeb-4f61f91fb562", "comment": "Malware payload (Mirai)", "value": "c90e2b54921ab6553e2567c34b4f7b1ced31c18b0b826bc0e8971f6cda3af898", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051753, "uuid": "35ab3095-e679-4ab6-8cbf-e4a363121589", "comment": "Malware payload (Mirai)", "value": "025e99dec0ea271023007644377a8a3d69c1879a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051753, "uuid": "2e8ef0ad-c933-4b6a-90db-2a852916f397", "comment": "Malware payload (Mirai)", "value": "773f55672f3c771cd51749ec398a6682542dfe3216639615f68d709b5b59248ab273488248360c6af5d6df6d421a7195", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051753, "uuid": "8f17666c-4db2-41ea-906b-2a4ed216131f", "value": "T123B2D0CD61543084CA8DBC7C1B8D4A665F6CA1C0BAEE9B25E354CD98B3BEA4F345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051753, "uuid": "645fbb12-fb99-4516-bf0f-8be087c29b15", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpSIZqSWvU:4QlS07FUXqIYSXQKquNqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685051753, "uuid": "ed30a2d0-507a-47b2-bc9a-8040b69b3daf", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685051753, "uuid": "7dacdaaa-2832-450b-8aeb-aef44d6c3b97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051753, "uuid": "f5002cc0-831b-41ef-be4f-1e1777cd2e26", "value": "d00e880bfd7598454a0a8e60cbae6f66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55c5387-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997089, "uuid": "745d3122-b610-4415-8d1d-5dcea4e8ab39", "comment": "Malware payload", "value": "c1c992158a9363cd26e7ea2faadaee18", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997089, "uuid": "61660c68-2171-40e9-becd-26c7738cbd69", "comment": "Malware payload", "value": "c916c6786e042d0bb623b65a0c9087c17378ce33e3c1658c3218c1560ea55c0f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997089, "uuid": "c750f903-38c4-4b78-a56b-cacf27213839", "comment": "Malware payload", "value": "637771afa046cf760557aef94cfb724e206f4727", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997089, "uuid": "d03c957b-7555-4b27-a684-fbfab222d4a4", "comment": "Malware payload", "value": "8fbb62b402b90125fd1acef507be7ff945b90118d06157657356ac546ddff5864ff3f1d8e28a8798d11f4974043192f2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997089, "uuid": "66815892-e5b2-4b92-9103-1ce50152c42a", "value": "T16C54DA844B2528A24B5B2F32B72064B5EBBE1E79C2D4558BF05F7261FBDF94CC8C1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997089, "uuid": "d037db3d-1210-41fd-bf53-73c49644ec22", "value": "6144:mUv/N6BkFD3x4f9TPqqwj5ut/El1cXCts2yWZ6p:mUnHcx2CkZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997089, "uuid": "1be34810-51ad-401c-b930-7aacac072a8a", "value": 284335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997089, "uuid": "a43db602-76f8-467a-afd9-cfc516c3e0de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997089, "uuid": "d380e5fc-5805-4a49-8b6c-4eec4a2620e4", "value": "neoexpressionis.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275bbd32-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996878, "uuid": "77fe41bd-15a2-4599-99d9-b804c904942a", "comment": "Malware payload", "value": "d28f4adc5315762496d0d84ccd67ef04", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996878, "uuid": "8c5eb586-146b-4aa1-a610-88a883a9af23", "comment": "Malware payload", "value": "c957c9f0016d79925b373f56e649f5150d06d19cd7dbfe8fc70cdeaeabffeaa7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996878, "uuid": "085dedc0-e27e-4790-b317-95041fddff87", "comment": "Malware payload", "value": "6b4a993e7652a8e7af10ce8de11f522f6fafd184", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996878, "uuid": "e51ab810-8257-4e98-8ff1-354878ed9cbd", "comment": "Malware payload", "value": "533f6bc880e202bdafa5cb50514e413f6e859e93c090784b494539eb0027e794e393ca357e60c5742ae9617ea97e9569", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996878, "uuid": "162c6b53-879e-4db7-afd0-b4fe42a42814", "value": "T1F35499844B1128A64B5B3E26A730A4B5EBBE1E74C2D4568FF45F3261FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996878, "uuid": "eea396ef-0514-401a-abee-c4030da3ac41", "value": "3072:r90DG28yM4lM9dNC/ksw8rhEF+5N9Kg636UxBZhkh7XfuTD0VCoIQQbwrhpgrGaK:r+M5Naz503dZhk9fwHIB70Fqmv4IU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996878, "uuid": "f497eafe-445d-4a93-a663-826d7ab84e97", "value": 287301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996878, "uuid": "ea4ee084-a39e-4192-8f09-888de4fa33b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996878, "uuid": "b6125fb0-6f24-4642-86ed-85be94b0a061", "value": "indictability.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0beb42-fae2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685008586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685008586, "uuid": "db6a5ee6-2b80-4e0a-a583-6e410b9fb1bd", "comment": "Malware payload (RedLineStealer)", "value": "48d6736d22319dffbb5460c6a956a981", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685008586, "uuid": "dbcbf32b-c7e5-4e27-96de-a0eebaa19649", "comment": "Malware payload (RedLineStealer)", "value": "c9eaa3dd30801af4b224ae44a2b47e9ca53ea0586952b55856d7d3f92ec30ba3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685008586, "uuid": "e55206de-7744-4a35-9597-754bb8d2fd81", "comment": "Malware payload (RedLineStealer)", "value": "50d558b398343d15a0d8839caf374b2d26de7c2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685008586, "uuid": "12766242-c8c0-4896-8668-7217ee9621f9", "comment": "Malware payload (RedLineStealer)", "value": "6e5a58a7780244aa277a896f3bc6bc28df111523ba3d062a20e39d77c610bd91776c152dc6b1b6141320f54a4a325dae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685008586, "uuid": "ffc3070a-4be7-405d-b7ef-dfe6bf468a1a", "value": "T173958D0474818533E1231433C5E89AB48AAC7F795B517CEBD7982A9E4FAF3C0B335566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685008586, "uuid": "5e110d1a-235c-4e3d-8780-bcbb962e6752", "value": "ac4e45ef98fe94fd272b083fed3c156d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685008586, "uuid": "80f28217-891c-4bc1-9adf-8f116bfd1b41", "value": "6144:bESHt8S5SWeAHK2NWv4AOqstzHBgXmnhcs5D7P1kei2AN6oYOc:JHt8S5SWWYwstzHBgWn+s972/F6NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685008586, "uuid": "6c7c15a6-4507-4ec3-a63d-94643ba304c1", "value": 1943040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685008586, "uuid": "08c6e021-6709-41ce-bb54-77739a26fc46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685008586, "uuid": "1e09626f-e91d-4cb6-b4d9-c3c0369d9ff9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c67b59f-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994766, "uuid": "d57bebb8-f148-4463-8dee-5d98552995dc", "comment": "Malware payload (Quakbot)", "value": "1e196cdbe52bcc3974b0e4d37e9c2c98", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994766, "uuid": "bfb05b3a-a14b-4dc2-91ba-84ec15e6c22f", "comment": "Malware payload (Quakbot)", "value": "caa02bbdd05a9703aa317ab12a8be346d7f0652557a949b1fc830229bb00b384", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994766, "uuid": "ad78c178-7a56-4110-a2ee-e8d7230d577b", "comment": "Malware payload (Quakbot)", "value": "ebe495e24e2619e46b76f771de491a28f7916dfb", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994766, "uuid": "7a1efa69-5266-4ff2-8187-9e4a516e1b61", "comment": "Malware payload (Quakbot)", "value": "15f64613093bce22c2ddcd5cb0cf8a129e29b13dcad620017a399f0ce4a8e766a71f743a19acd1b81085dff42f9cc256", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994766, "uuid": "6526afb9-5663-4a79-8d4c-b602c94a818c", "value": "T1E453086F9381133966210135660E9BE1E7A094786F72CB78B48EC2693351C79D2BE6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994766, "uuid": "e8fe7f14-bc0b-46d8-b9f7-ce1b848a55aa", "value": "1536:Z3NlDc4GBV1l3DBb3NlDf43Umr5wP+GfI/A2xvVSJ:Z3NlD0ZBBb3NlDfI3HGfudiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994766, "uuid": "cf23d1a9-de25-4179-bd21-209ec46fac19", "value": 63178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994766, "uuid": "ade27056-eaf8-440d-ad76-fc2300acd933", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994766, "uuid": "b50f4b56-7344-453a-82ae-08f980985da1", "value": "Claim_F596.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb72ef3-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997154, "uuid": "754fe091-aa15-4b6a-95b6-4edd2001ba81", "comment": "Malware payload", "value": "8bc5f2b99f2bcc2beb4fbd820d5f9468", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997154, "uuid": "e35c8f09-b8a3-448c-aea4-ccfd0079c025", "comment": "Malware payload", "value": "cadb92e5b875f21b9f91389de09a0b9320cb4c8089bc8726a07d74e22603a360", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997154, "uuid": "554ca976-4a23-4e57-bdf2-03086d3bb380", "comment": "Malware payload", "value": "e0ec9bcac29c8c1abdb95811d4ce7c03f299adf5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997154, "uuid": "3710992e-af70-4b7c-a1fc-5b8f7b03d53b", "comment": "Malware payload", "value": "2ca95a53071b95f0ff44f466fe4178b79e7e560d9f1a4e422efbe2c4d31786475e1415430a083fec3397bc86c9aa51d2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997154, "uuid": "13df37f4-1827-4148-b663-d0406e9c6c48", "value": "T137545580475125B64B4B7E26A730A4A5DBBD1E74C2C85A8BF45F3260FBDEA8CCCD1721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997154, "uuid": "b2dfec96-d96e-482c-8e55-935ddec7fb62", "value": "6144:Aev0sHS5mkeY8/21DHE0FOcLFf4chEXUmVSVrWe/YDvUfqxii7ySfDfe0bNVQEnF:Aev0MOiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997154, "uuid": "694a3e54-b37c-4fbc-8d0c-222b01ed356d", "value": 298596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997154, "uuid": "9bdc8d95-aea7-4df5-89e3-448bd3ece372", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997154, "uuid": "fc3f810f-e738-4aa0-b96f-d29818d146b1", "value": "mimeographistPh.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622d77ba-fafb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685019310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019310, "uuid": "1b32527e-cada-468c-a3dc-479822069875", "comment": "Malware payload", "value": "f8f0d8043ba8f2ffa971c6ac9463ab22", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019310, "uuid": "2a43b01f-231f-4616-9aa7-74cdd6621479", "comment": "Malware payload", "value": "cb46af1427bb42b05cf4ca684f2cce83c56d42ac011f42eb8dd6ab799106664f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019310, "uuid": "9e7913cd-c8aa-4f3b-bc04-bc898025251a", "comment": "Malware payload", "value": "e03db3b3ba7ccbf7bc441c7b2c1745f98430e821", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685019310, "uuid": "7d4cfb24-0577-4ebf-a186-29bf8516bc84", "comment": "Malware payload", "value": "9ea4ffec9e922e89edf7709c29838f4b48d06f700ef6926e566fd5dbf568034ef1f6af1760a4b68944d66e1291af2880", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019310, "uuid": "535540ac-c67d-4c8c-be83-c6d5036e8d8a", "value": "T1F1F2E75EE79B02A58F510377271B0E89A6BDB23EB35554B1386C833433E9C3D42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019310, "uuid": "646dc5f7-a385-4eb4-9cfe-d3da7dd28f4e", "value": "768:PFx0XaIsnPRIa4fwJMHe2Ej0Pozb42Y2KmZl1kx5tUpn:Pf0Xvx3EMHe2SVbt9Hbkx5tUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685019310, "uuid": "857c0c05-84eb-4758-a90e-67b7cf9d053c", "value": 34900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685019310, "uuid": "9e6006cc-0882-47fa-bea7-ec3eb0084b7f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685019310, "uuid": "2cb8b3f4-e482-4189-9170-ec44428f92d6", "value": "HERTI new purchase order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa23413-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999702, "uuid": "ccd0a581-9f30-4f2e-92e6-037bb7bc148b", "comment": "Malware payload", "value": "b6526058c2020348d5115e3151b3d250", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999702, "uuid": "150f20dd-4ba5-4ff2-af02-158822b1deb7", "comment": "Malware payload", "value": "cc9340936b788db3b2f411db9371ac5f80b79d2dad17242f58e4ffbc1587042a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999702, "uuid": "68152564-a094-4ea9-b4ad-b1c5a3b4eea6", "comment": "Malware payload", "value": "cc215355f140abede6fd16f77e2bd56ec14471e0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999702, "uuid": "c5e3c244-073d-4dd4-ae1a-e43308ecb139", "comment": "Malware payload", "value": "69193956a766507f8a041a81f61ffdbe0cfefb93a544412c2c6514a8934e6923e6e561884a3d13744d31ea10e1167414", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999702, "uuid": "50be2946-0931-4bc4-a7bb-7f2fb8cc2367", "value": "T11264A7844B1129A24B5B3E26B730A4B9EBBE1EB5C2D4458BF45F7260FBDF94CC8C1521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999702, "uuid": "e790e828-01d3-4c46-b4f6-30e2ca5ed852", "value": "3072:CDIxSdtT484OyMBr+1XSyvZVaMBUzpfjETgc9tTNKz30n/nGcHDxcqvQ0uVW:CDIxSn48SIySwyH9o/1NKzE/bW4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999702, "uuid": "f8d49de1-b95b-40c2-8bb0-45d68e7125d0", "value": 309538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999702, "uuid": "b418ec25-1012-492b-ae98-7332f548e7a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999702, "uuid": "0fa34bf1-b7f9-481e-97d4-974884ec5f1b", "value": "dulcifiesSootyi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a20d8a4-faca-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998171, "uuid": "1add9f99-b5c1-4b54-b6e4-5084bd58110d", "comment": "Malware payload", "value": "4e83e8245b8c4a51e5b1a3fc9848e033", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998171, "uuid": "c207ce8c-6603-4329-855e-bca088a08710", "comment": "Malware payload", "value": "ccb828034fd412c8a1cff8c98498164af9a2b37da3ab428f6fdfdb9d3ccd5da5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998171, "uuid": "f2cae804-8de8-484a-b3ce-785ef6ba1975", "comment": "Malware payload", "value": "0e37c456c2f2e3467c635c909e9649d985526993", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998171, "uuid": "9d050196-f938-48f7-83b7-27179e8b0a6e", "comment": "Malware payload", "value": "10fe9d8609ace9707b5a96c6bc56df7f99e42517a54984d988d2f5c102756d30c8293b858ecdcce9ef3c670f5b347199", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998171, "uuid": "48786d17-59b5-4e5a-8e44-5156cc361275", "value": "T1C244A8804B5128B24B5B7E266730A4A5EBBE1E75C2C8568FF45F7250FBDF98CC8C1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998171, "uuid": "7562b65c-c603-4d46-bc89-e771cc88e914", "value": "3072:ihp9bMAJ9KOp6/3X67Yv0hjKkZa2NEMjLIU4KBcD:iH9IAJ9KOk/HMhpa2NEcLICBcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998171, "uuid": "42b84dcf-d861-45b1-a9a8-6c7ebba9a83e", "value": 266251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998171, "uuid": "b39ab678-9c85-446b-bc52-8151f4c20599", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998171, "uuid": "ac9b12e7-f041-444d-b9af-7f29673a4712", "value": "UnhitchedGambas.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a1333d-fae5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685009886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009886, "uuid": "da17e051-af38-4449-99bf-e81269dd4ce6", "comment": "Malware payload", "value": "73d3b210668dce044628e838afa1af64", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009886, "uuid": "8f99967f-758c-4b7d-8021-f178c06c2739", "comment": "Malware payload", "value": "cce030806b050bc0b14085ca6e4a37d809d19d67d24e41d17124f9ba43cb4265", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009886, "uuid": "ddc3536c-34cb-4422-a496-99e303dc4d63", "comment": "Malware payload", "value": "502082994d57c7580b2b9796bddc332bc24e8715", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009886, "uuid": "ebeaabac-16a2-4a1b-aadc-8cda517b179d", "comment": "Malware payload", "value": "7e540225379cf190f36fdb13f9db6f68359ba2ee56a83785168c19b30f5b1fb1c94fc7121a7dd628d448c8f88d9543e2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009886, "uuid": "6da61fec-4708-4712-8022-e36accda774a", "value": "T14EF62326719A8232F6BE82355A2AFB76E4F53BE103B244EB56D05DCE2C735D04361E13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009886, "uuid": "d4130829-5181-4140-98fc-a459f0b7d376", "value": "393216:2XavHl61wXebglXpJdILiXnfzlte0FTN4:2ml6iuWrGIbbe0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685009886, "uuid": "46f1d198-6f9a-4427-92f8-cff6a65554d0", "value": 16422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685009886, "uuid": "55540ed4-c7f9-4897-b75f-88d6e5bc78a8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009886, "uuid": "b1e38e3c-c85f-4dcd-a68b-3ea5c67ac7fe", "value": "YWC_jYV_HA.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa0ce22-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1685003764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003764, "uuid": "ed589d26-d16f-465f-adbf-abc47bcd90f1", "comment": "Malware payload (zgRAT)", "value": "a80e83e98e70a95efffd0718641ad93c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003764, "uuid": "d8bd42d7-c952-447e-9430-d5b06327bac8", "comment": "Malware payload (zgRAT)", "value": "ccf87a618732acd7246cf99f557b5bd7ca9004d4339310190f9e9db620f92a75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003764, "uuid": "a0e47d42-5faa-4a2c-8bd5-3fcd74342419", "comment": "Malware payload (zgRAT)", "value": "dd01831945776b0d97fbd74b26556e2424e9d074", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003764, "uuid": "6cd5da18-b037-4120-b135-5bc0a1406087", "comment": "Malware payload (zgRAT)", "value": "505440390512c5e8c02c70ffa4e37f91d5c5bd858523eca28d1c6eed44335b04b53f22082c6f6a079ec1d5f32f56e169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003764, "uuid": "fa01e34c-fd55-42b3-b713-84782dfbb152", "value": "T13434F19A67F35C12C5C9EE309581422A3331C38739B3EF4A758C17558F83BC7661A6EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003764, "uuid": "1e610e06-8f0f-4d10-98e0-0133cbbbcfb4", "value": "6144:AyX8XQu1/2Eb1wl01tvIg6eZqByNqLGh58cmhzzV2Uu2RAvevj5:bXmB21EtvIGZwyNqL4inPV2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003764, "uuid": "4b87b4ad-0fb3-45b0-bd42-b894a6609159", "value": 246336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003764, "uuid": "c3a83c7e-562b-4525-a203-8a127d577ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003764, "uuid": "98495325-02c0-4e41-aa88-4628e07a8f59", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac7d7cb-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684995058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995058, "uuid": "9ea73791-d3c6-441c-aedc-2b8dd01cdf22", "comment": "Malware payload (SnakeKeylogger)", "value": "cd6986320095718284f6723fa482fd2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995058, "uuid": "187b9fcd-5446-445b-9d9a-5a8bc3790ff8", "comment": "Malware payload (SnakeKeylogger)", "value": "cd3f84c42ebdd57e9b3679216ef581b466aa1a646728156155a41055b070e788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995058, "uuid": "c79bc51f-08c2-4350-914e-e7cb0d16c6a5", "comment": "Malware payload (SnakeKeylogger)", "value": "2f4f4538d6777122302a6226db824523e1a7b4b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995058, "uuid": "b26c1bdf-8d40-4744-a54f-1ddd04e58438", "comment": "Malware payload (SnakeKeylogger)", "value": "fc72a9a1f25f37eed5d449d1e17f7e2f294503b657901baeda13ebb02e842dc1575b5d7b12600095c5776e3f537e80c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995058, "uuid": "720a6bc4-cb9b-4ab3-8599-80d86e87aeea", "value": "T14A25239012592355E5BA03F485A89EB0327FDCD43593E71B0E83E8CDEA0BBC545A5B8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995058, "uuid": "e38562dd-db65-4bf3-b48f-ccee64386a93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995058, "uuid": "cd6ec9be-4f46-4aaa-aa67-47494d1faa7c", "value": "24576:xTmIt9BEP8tylbNMcVrlBM9NVROoFpCndORoybDkWOh8Pdj:xTbBe8tylNbMjVR5piKoSD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995058, "uuid": "33accc85-30eb-4899-bb57-f8040e825131", "value": 1029632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995058, "uuid": "c9a36e29-6174-49d0-b9ad-184b3800c148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995058, "uuid": "dbe5d045-37ee-4196-bdd7-85cbc2f75d33", "value": "Excel Document 2502023PPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545d6ccc-faf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685017140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017140, "uuid": "07434661-ea4d-41cf-85fb-157cfb24cbe9", "comment": "Malware payload", "value": "5e2b1df5effbe5123eeff6752af2ca59", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017140, "uuid": "a3dd0a7b-1f97-418a-be18-29ef923d6b5f", "comment": "Malware payload", "value": "cd5d681f249663dde55b694693ead4e63ff1d626e5db57975aeaa41e65205c37", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017140, "uuid": "d8e7c436-9a5d-4fd1-a0b8-e9ee901751c7", "comment": "Malware payload", "value": "2e1597b42c40155aa4f56ed708ea4aeb2a5d8698", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017140, "uuid": "b73649fb-19ce-444f-bd03-b1f074f0d944", "comment": "Malware payload", "value": "741dd5d3414573a26deb60ea953be97e0923428ae1441aa7418b06a414c9efd5e7641562a193d09f887796d31c57a3c0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017140, "uuid": "bd075f20-4c89-4c9e-ad6c-5c1f72e61e99", "value": "T1D1F523638203D807F7D047B4D966F3B89362B7F1E9A78264B9A139EEF524F832C16151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017140, "uuid": "dd26ceee-a18f-49be-a5e4-85120964a47d", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017140, "uuid": "d8663c5b-1070-40c2-8158-4e271795d42b", "value": "98304:mZgO4UAJkCxZt3e0Y6qRlp5CNMqMDstLS7cqjAny:mZg3JlB3gXRlpkMqUM6cqjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685017140, "uuid": "6c67b46f-6579-4c3b-bd10-83ca04a6b656", "value": 3436032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685017140, "uuid": "b0686b9a-4272-481d-a030-e8cbad4991cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017140, "uuid": "4e7f384d-0146-4cb6-8c7a-47b162ad6aed", "value": "005547699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b93640-fb47-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685051790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051790, "uuid": "531f5f29-c5b5-44cd-88eb-a48ea6487f28", "comment": "Malware payload (Mirai)", "value": "47d602531a0890f65490f79df97a132a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051790, "uuid": "bb4066f9-2c7a-4ca9-98f7-d50797c43861", "comment": "Malware payload (Mirai)", "value": "cdd73d84ec18a5c327444bf056cf643580032ef45c67b8b1f8100ab68edd6ee0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051790, "uuid": "432b87a9-9eef-44ba-a886-35b348c9c581", "comment": "Malware payload (Mirai)", "value": "6dfb58a270e2995715bbfed11dd3adbd4f459b10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051790, "uuid": "f6cffd62-c492-4f93-9493-00a5df0da2fe", "comment": "Malware payload (Mirai)", "value": "855fb600ca887f158e2ba195ab0f8782d1c40a356b1c0f254faf4ea23616b8b441f639042b9e8f0e2266942a5ddbb9d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051790, "uuid": "bf593b43-3348-443d-aa03-857dc6a60167", "value": "T163C2D0E07726FA31C4206C3DE53B4C8A3A91067C91FF393764259D399EC164B67E84B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051790, "uuid": "3e8d2208-9fe0-4867-a42f-fce0c281d3f2", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwr79q3UELuY:PKy4qfqoeJdXWgaLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685051790, "uuid": "071703b4-3ca3-4d1f-a462-ae098aed3023", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685051790, "uuid": "f04ab160-cc1d-4573-8d8f-f344c7810d17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051790, "uuid": "c699474c-3fb4-42b2-9568-be742a1bb6bf", "value": "47d602531a0890f65490f79df97a132a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a514857d-fb50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685055930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685055930, "uuid": "6bb5ba2b-bf3f-4475-baae-720f2b80f155", "comment": "Malware payload (RedLineStealer)", "value": "78ee36955624cbf075c888a225b03121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685055930, "uuid": "8e709808-91fc-4c61-bb4d-412ccb541145", "comment": "Malware payload (RedLineStealer)", "value": "ce91ee7a2630074da710e9e019f84a882ff3ffb3ea7213c8f6521801460a2c13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685055930, "uuid": "a831a196-a707-4f8c-b5dc-b3d0a03755e0", "comment": "Malware payload (RedLineStealer)", "value": "81735d9d175f527c8bccbf0c62b832ae12d29fea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685055930, "uuid": "56decb6f-1e0a-4d41-a926-3cf69142b489", "comment": "Malware payload (RedLineStealer)", "value": "c65033eccbb8d421429bea08cddfa821b503ba7c29461f6145c69065ebf9e1243e32e057fca148899371b8148b577d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685055930, "uuid": "45ab721c-7ec4-4e5c-97ca-78d6e3f35b5e", "value": "T1C6F41213E7D84172D8B12BB158F703830E39BD919D3882AB2745AD6E1C737CAA13576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685055930, "uuid": "ff3c1e0b-7bf0-48be-b1ad-6c388baafde4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685055930, "uuid": "8adb7ddc-d8dd-4d69-8c3a-a44e7ef32b5b", "value": "12288:EMrDy90F0JfXDnDXjNI+FBYBqbQiNAQ6SFQpzXI/7Yfvn0kBBXnMLtIW+aE2DRcX:Xy/BDnQoxJ67rQYfv0krXML1+SF+r2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685055930, "uuid": "555b4a49-f832-4f9f-8c0b-903c0357abae", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685055930, "uuid": "ca15aa08-971b-49c5-8036-0d97b8af9e95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685055930, "uuid": "1b479810-dbfb-40c8-9ef8-6d59cd501672", "value": "78ee36955624cbf075c888a225b03121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad0b9af-fb0f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685027969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027969, "uuid": "a86997ef-48bb-4fbd-b66a-58fb82167df1", "comment": "Malware payload (SnakeKeylogger)", "value": "46226895e95e1835fc2b1dd621328e1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027969, "uuid": "01be42aa-7f8c-4dae-982f-af3bcb719dbc", "comment": "Malware payload (SnakeKeylogger)", "value": "cf236299167c0c88614c131ecdad1215151c1785aa07baa6426e6459bb3236e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027969, "uuid": "deb5b862-2399-4a8f-8ce9-5ed030c683ad", "comment": "Malware payload (SnakeKeylogger)", "value": "cac618108cfab03e5a6af9289fa3b3e43673cd80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027969, "uuid": "016dcf8a-b2aa-43f9-90da-0b6113d53d32", "comment": "Malware payload (SnakeKeylogger)", "value": "6d998cf893ee67f7db61f28182c2d511f514311aa2e3208ae4d2c0d49d326bd02ca3f8808f0774a603c90082da3eb8c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027969, "uuid": "3a67a847-6737-4f45-96d2-1b38502d59ff", "value": "T125D40188763D7E57D47E1BF8402072B843FA526A3156E7CA2CD370CEA9C5BA50634AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027969, "uuid": "b8b0fc1c-a201-4c43-909c-fee72673bbd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027969, "uuid": "4d22b373-9dbf-4c91-9cdb-9758a758188f", "value": "12288:GKzZBEP85d6Ncnd75sWqyA5lmj2wHQIXRXwBueQvn:r9BEP8ONcndklfHaRXwEeQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685027969, "uuid": "26601460-f84a-4dfd-9716-768dfcae6875", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685027969, "uuid": "488b9abd-92f1-4c70-b6b1-9fa0937cb3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027969, "uuid": "3178bd6e-2427-49f6-b486-e431700a8aa3", "value": "SD00098765789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ef43bf-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996738, "uuid": "f1b8282e-65cf-4198-96e1-9709d89448fe", "comment": "Malware payload", "value": "bff087dbd3c758e3522d1009fbba930e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996738, "uuid": "f2f76c08-c8dd-4a5e-8f78-7c1ccbeee874", "comment": "Malware payload", "value": "cf37631fed4503770fc0834de0f9305b79c87cdf5507badb48a1112c49778a2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996738, "uuid": "978bf0dd-20d7-4c40-a896-18f879a39b38", "comment": "Malware payload", "value": "1adba7d0791432bec4cb3776204ee597b3813180", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996738, "uuid": "ad6d9634-762a-478f-a748-2c9109324ddd", "comment": "Malware payload", "value": "4c4ba3e83956cff260c4a32a971f579af50a285ef0cca473f6db313db68ed2708db6365583b8c712f8fcae3a1995a32d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996738, "uuid": "bac3566b-2ef7-4d73-8b87-d46b8e6fa27f", "value": "T1ED6498804B1518A24B4B3F36B73064A5EBAE1EB9C2D4598BF46F7251FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996738, "uuid": "3eb8f334-1182-4fff-8639-8a7221d453f5", "value": "3072:zuZB3jhBc61zKPcuV0eYMrmrFPhOdDIu8xgCXFpBBQ65egF2Kf8kqyjxLEY3wQia:mph5uV0XFPhqDIjgcbBT5egFFlTxLiBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996738, "uuid": "0763938d-2d7d-4ec3-a9c4-a8020ad09ce4", "value": 314789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996738, "uuid": "c49a01c7-39df-42b8-8a8e-d6d10e33b99f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996738, "uuid": "a78c67c7-2d5a-4fd9-8675-5eb20cd4e3cb", "value": "freudism.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11c3297-face-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685000223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000223, "uuid": "3a4d7ec1-b7f1-45d1-b6eb-42fbfcbd0ece", "comment": "Malware payload (Quakbot)", "value": "bd93fa16abb91631333448f913bda71b", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000223, "uuid": "7aa20a9a-29e8-49c5-991b-b885906427c7", "comment": "Malware payload (Quakbot)", "value": "cf7bb2a194854f087eafcd7e6257b23c9674dde746bde7b42a3de2afbbfacaf7", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000223, "uuid": "15498219-e3ec-4b1d-a17a-f940884be27f", "comment": "Malware payload (Quakbot)", "value": "f4852466f45d9e142835eaab2764993d492291fe", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685000223, "uuid": "8ae1e4c8-e000-44a6-be81-a9dbdadcc6a5", "comment": "Malware payload (Quakbot)", "value": "fd276ab71a77297c16d243e66a33c4c334da484b6ab61050319de71bad6cdf28733ba7d684aad3d79a58196045729d6b", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000223, "uuid": "92036e95-80c5-4231-8a19-b372d9227581", "value": "T12283F86B5345033A056202646B0F6BD6F37884B87B26D674A09EC26D3342C7597BFAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000223, "uuid": "8ac48c13-a1d8-4fe8-a691-ede6473560b7", "value": "1536:sVbk9lDdQej+r+iOzN16gG3NlDN3NlDdQI/CKkjm0BhiP2mH9kCucZ3DbzwpCF9q:2bClDuoO+ioNFG3NlDN3NlDuI6Ky2nbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685000223, "uuid": "6495e415-71d0-4a79-8adb-e6debe68f995", "value": 84528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685000223, "uuid": "81b71851-0779-4fb1-8597-7aea84a6b563", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685000223, "uuid": "615c2cdf-cdca-4125-a845-764183835a43", "value": "M7R45909.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f2a51c8-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685003736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003736, "uuid": "6441eaf6-266c-446e-a6ca-339a545d0c20", "comment": "Malware payload (Formbook)", "value": "a18c297a0e296e70ff0b3f159ec31b2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003736, "uuid": "50f0686e-3f4d-4950-9a2c-43ca9b7ed2f4", "comment": "Malware payload (Formbook)", "value": "cfc12adfab410acd8090691e1b66fb468e033c5c5a5de350016b3cf133be27a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003736, "uuid": "594c0075-ee05-4b44-b79a-ca3392184b08", "comment": "Malware payload (Formbook)", "value": "c435a2f58d54fd26b0bc61a348f4e754f54098db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003736, "uuid": "a2a543aa-c20d-4849-aaed-a6f57419686b", "comment": "Malware payload (Formbook)", "value": "24158068ef06865fe3be693a4e29fbed63c008607afac01a8fb0572dc323c592e0f8dc44c04a9c199fc78639615473c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003736, "uuid": "a0cbbc27-0db9-4286-a8d0-336048ecb3f5", "value": "T172E4F1C066984D01E25A4FB859B2F57403B96C61EB37870E69F43C4BBCA6B823B117D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003736, "uuid": "fc9b59f7-f235-47b6-ab9c-aa4cbb078457", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003736, "uuid": "014f58cc-6f01-4cce-8afe-3b1da7f5f8b6", "value": "12288:cTGx0YPX/NqPszCAcQXrM9YcvZ0i7ebvGbiBy8SiCRexW76r5ouQhEonPeja:cTNHPs5cyaY6Z7nbky8SiCWW7hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003736, "uuid": "81eb92a5-b3c6-458b-b2e2-60e1b0ccc23c", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003736, "uuid": "d9600b43-b7bd-4667-b9c3-ad4e1ddd5856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003736, "uuid": "8832d156-4875-402d-a16f-eec945228399", "value": "P5348574_74676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b5f9ee-fafe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1685020816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020816, "uuid": "fbc177af-629c-40f8-8829-d13d5a00af9b", "comment": "Malware payload (IcedID)", "value": "d49b56ab8dd4226a12e2927bfe7fa1b1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020816, "uuid": "b232034a-e8b7-4a7f-bd3c-ae9dbf1074d3", "comment": "Malware payload (IcedID)", "value": "d033105288280266f0336365245e18984c5fc684577beed5ad7430775ecd7c02", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020816, "uuid": "f9e09cce-88bd-4b7e-a496-7a289ce96b8a", "comment": "Malware payload (IcedID)", "value": "8a1ca86de1cd5755a25812bb58219f9f5f9b006f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020816, "uuid": "8d0b19fb-ecf6-4817-a6d5-0ef60992635c", "comment": "Malware payload (IcedID)", "value": "31c1d0bac89fe2fd3017f41d554b02f44c0f2537032b66ba4c0090f8da2b3742ae8c860be686d29248f8acdbba53b0ba", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020816, "uuid": "a0037ef5-ca0d-4642-b810-8f88ed2043c8", "value": "T1BAD38D4BAF1BDCF7C8024731A9E643080337E6611BC66B0F2D258D790A577B5EF8A685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020816, "uuid": "4ed791fc-3a8f-4274-bca7-362f3652bbd9", "value": "c0db22558d1245a720459dbfc128cdf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020816, "uuid": "fb13c0c0-ba52-4d3d-963b-4d19dd950b00", "value": "1536:l3V4MpcYHJqNuuDzCLNgLU18XNzeNbwnApqzPO3I12TMe4vaMzPzUKUvMWHnTX9o:P4MrqIGzsUYNgG4kj4va2UiPJP/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020816, "uuid": "3c3a64a5-2897-4ab7-abe1-b8c1816c5a8b", "value": 130144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020816, "uuid": "ff001276-a11c-4dae-aa76-8579952ff86d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020816, "uuid": "c0b172bc-d4da-4fb7-b92e-004f193b94d8", "value": "08778399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0014641-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997134, "uuid": "129210b3-304c-4329-9611-9caeadc6ed33", "comment": "Malware payload", "value": "999114e62b54a76c7d047d87da890180", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997134, "uuid": "5ace9ab2-eb79-45ce-b48c-0ff420b14e09", "comment": "Malware payload", "value": "d058a60298f0c2fd2267b37bc474f60dec8440f1aafacdfb223899ef562bfcfa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997134, "uuid": "130426c7-34d7-49d1-b22d-591aa7c18da3", "comment": "Malware payload", "value": "9b812db148e873c7b1c8a302168f7c1bc5f8ae4b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997134, "uuid": "308400a7-184f-4919-9ba4-48e4477d5c73", "comment": "Malware payload", "value": "2ed5f5a411dbb81b67d09477c7afa023492fb69da1fb524a6600200da60b53484ebe8fc701476f12c9c502bffabb5deb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997134, "uuid": "c82477fe-7f12-45b2-a097-1bdb21826a5f", "value": "T1A644A8844B1125B64B5B7E22B730A4A5EBBE1E74C2D8568BF45F7250FBDF98CC8C1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997134, "uuid": "387cd0a8-9cbc-453d-a896-2c4c909b5c76", "value": "3072:6ZtD41RtXj9M6yFZlPyeMXH6FeiHATIVI+k6K0uxRsJ1mGY6lODXv:8sHsFLaeXecATKO6J1Y6lOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997134, "uuid": "0916b126-da40-4cc5-a724-b9892ff8a8cd", "value": 273140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997134, "uuid": "f95c782e-08fa-4bca-bc20-0ec194a55d4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997134, "uuid": "8ec18ae8-ae77-4dc1-9455-8722d51160d3", "value": "misadministrati.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bf2ac0-facc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998989, "uuid": "9fd49005-cbeb-4a56-8186-6fb75eeee19f", "comment": "Malware payload", "value": "3c7f21164220d350ec651252ba972e01", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998989, "uuid": "a15a04c3-7efd-45a8-b353-fad09d3a94c4", "comment": "Malware payload", "value": "d06b039f7a9b6d1cb9ca632938d2cda488f9fb4713d88a8c99dff8d01409825d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998989, "uuid": "73e2ed98-4941-4511-9d86-60b068018148", "comment": "Malware payload", "value": "1e58f7daa344309c069b2789b2f7053777de1a2a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998989, "uuid": "6ef1c17f-792d-456b-a0b7-77732f66335f", "comment": "Malware payload", "value": "4774efc9384b82105fa96f1f96f2fc5e0739fdd0133f97c35214208ec84192d5b21af8b0b6da880b6fe6d826fb646a71", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998989, "uuid": "7bbc30d1-7b61-4a28-96ce-f743b0d348f7", "value": "T1E083F2AB918C0566C3C4F4B5271D1C2FDB27DAD6A6E65E22F61B1BAC0422CB35EC0494", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998989, "uuid": "76c65be6-c5db-4dd7-adee-494552c3f9c7", "value": "1536:pEr6pd5v8o2HIbD4TZV/yFaAzodrAZAkDZo0A3PubZo0A3PuWcf0M5PmTPZo0A32:06prd1E91yrKAZAK6a6tcN+62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998989, "uuid": "84df5a75-e843-4ae7-ae64-16687be02804", "value": 81723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998989, "uuid": "41a2f23a-4406-415f-ac26-ff14cf1147de", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998989, "uuid": "2c06b5df-88ea-457f-a1c7-e0d5eb502763", "value": "P110000367367.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf197e4-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003759, "uuid": "f4d1dda8-e831-457d-998b-86817218896a", "comment": "Malware payload (AgentTesla)", "value": "4f233c11385759c7590b9b2e27162d5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003759, "uuid": "e7a68ede-4859-4b85-89ca-5851a23aabdd", "comment": "Malware payload (AgentTesla)", "value": "d193c8b8860a618afefaa527a7dda935fff2176f5976d506f658bd93c2c04e08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003759, "uuid": "43a4a22c-701e-4295-b983-9599387051ba", "comment": "Malware payload (AgentTesla)", "value": "cdd026b699fcfb7fb1c0521852d70c77b58d254e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003759, "uuid": "53213d91-8e24-4146-9f08-da9a9127fbc3", "comment": "Malware payload (AgentTesla)", "value": "daa3f1740b2285d230f1a7d2f4fa7139b94aa574698546455f72bb8865a7f8833fc197b2301dede8eba7d96bbb6cbbf6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003759, "uuid": "89c63c16-a6e8-4fca-961c-7f74a398adbc", "value": "T14DF4DF40A5EA56C5E5BB67F14F26F774433D2CADA1B2EE063D8BB1E651307010932A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003759, "uuid": "45922ae4-c98c-488f-9e1e-32c81271abf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003759, "uuid": "7e7cdb09-ace1-49d5-8586-9181e6b3a74d", "value": "12288:y2N8jiZ4zypIPsTtPplTY6RhKuLRiqQt+2vqfRx3WGvBFihBV1tX5/xw6a1aph1Y:y2N8jiZ4zypIPsTJTDEiQtZ0xGGLg71m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003759, "uuid": "1b8b190b-0369-4a43-8ab7-712d9733ec43", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003759, "uuid": "4fe43460-c744-4e76-8de0-1e14959a7427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003759, "uuid": "830b708c-8955-41a0-adbe-94b35bc76fbf", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741362e0-fae3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685009033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009033, "uuid": "49685f71-9990-4477-8507-10594bd65df5", "comment": "Malware payload (Formbook)", "value": "34ef45bc290f66c645fdb999b81072d9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009033, "uuid": "28de9a63-9e11-42aa-95db-de60ae8cebaa", "comment": "Malware payload (Formbook)", "value": "d1d20fb0c0467283d7f297d2750e06b4e05ad680394b117190a82ae54b20a517", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009033, "uuid": "739af627-3823-4732-863b-5db240ee002d", "comment": "Malware payload (Formbook)", "value": "ea9b0e379cbd9ad1a8f678bba787b06a8ea75ebb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009033, "uuid": "6e44a0d2-e7db-4918-bf45-a480197557ba", "comment": "Malware payload (Formbook)", "value": "4188c283d70e56ce076859522728f2601577b8cbde05b80753ff7bccd2cc211de279b4ae84aebacb7fc75530d652f58b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009033, "uuid": "a511144a-38e4-4f7d-a5a4-bb7140d7b9d7", "value": "T164F412A4259A9329E8A90774087563F002BFDF96B972E2573C4FF1C8E713B0D4162B5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009033, "uuid": "bbdf3a3d-9b6f-466b-89bf-0432d0771553", "value": "12288:iaWIm6lVvtzZBEP85VXHx14LlGyhsbsCe0FAQAW58aEcqW3obeO6+H3Xy:7TmIt9BEP8bXx8GOsIfGAQ55PL46On", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685009033, "uuid": "5ab08aaf-868f-4b43-8318-5e862df8346e", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685009033, "uuid": "f7b421d4-f75d-4823-be8b-dbe178a3ea2f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009033, "uuid": "e64bf5d5-ceb9-4fbc-9aa0-005c3279c1c1", "value": "PRICE ENQUIRY, ENQ REF-LPRN- 20231096_PDF________________________________.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6235ee01-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997836, "uuid": "25e4b454-bf84-40a6-a33f-3aa3b2e337af", "comment": "Malware payload", "value": "b14d0184f5c31dd639d3918f1df92133", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997836, "uuid": "77475307-6383-4feb-b4fc-eed044fc8c96", "comment": "Malware payload", "value": "d2077a2a35d4d8b403b5bafc9adfd4466b75e6bb565ef8fc09f959d62311122a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997836, "uuid": "1d065e19-2896-4bef-8649-6d1a28fc06fb", "comment": "Malware payload", "value": "a05f83546673dbacbb3a22fca57b582851ffdc92", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997836, "uuid": "36762dbf-92ed-4237-a02e-7377e9305735", "comment": "Malware payload", "value": "383d4fe2459048206b0c6bc0bb71000e06030d3329a86fe3bfc54fd31451ab4282ad1579fc8146cc2a57565ad816f1ed", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997836, "uuid": "10f7f906-6c91-4e29-b76a-28d0e40e80ee", "value": "T1E854A9844B1129A24B5B3E227734A4B9EBBE1E75C2D4568BF45F3260FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997836, "uuid": "30b91f02-6024-47f1-8ef9-44a19467d562", "value": "3072:snRJMHGAiCLTT3P/Ji8CY0QuoPg+eUva3Zc0ErI49ZPsl9w56gAa:KbMHxiCb/k8CY/uoI+eU1I49Q9wgDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997836, "uuid": "3440e13e-5520-4903-96f9-00ad4a0f465a", "value": 306191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997836, "uuid": "47b05faf-96dc-4868-8786-9654566de65b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997836, "uuid": "d2396fb5-6046-4739-bac1-5df63b9d777a", "value": "Reinvigorator.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fc9b37-faf3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685016020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016020, "uuid": "bde50a9e-6aea-49b7-b9e3-88d2b1bd08fc", "comment": "Malware payload (Quakbot)", "value": "b546d9ee7b9b036a569d6b81c6904362", "object_relation": "md5", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016020, "uuid": "d953f5ee-4dd1-4c9b-ab21-74975eaf9f22", "comment": "Malware payload (Quakbot)", "value": "d272c2e8d0644a4d9582235eafccb3853c5fa09cfb71126a4968f19a1479b218", "object_relation": "sha256", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016020, "uuid": "92a4162c-0154-416f-bca3-01edf98f92d1", "comment": "Malware payload (Quakbot)", "value": "6ddc8a492c84fbcea5441272beb0113ced181b71", "object_relation": "sha1", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016020, "uuid": "32105947-db0b-4609-a7b6-34105d3a39c5", "comment": "Malware payload (Quakbot)", "value": "493d8019cdd665390ca659cb438389cec6a675ff65f8c3d2ee0ded4ae08dd968292450921fd172344075fe6283110c3d", "object_relation": "sha3-384", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016020, "uuid": "e464cade-8b7c-471e-b6b3-081a10fa3fe7", "value": "T1B325D413F592AD67D7E812320091F5355622BCBCC3A31AF73EC476FD39A69405F6AA20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016020, "uuid": "37cf381e-81b2-4f7e-b391-6a22fa3593e9", "value": "69b5a2b4c355363112fef443743090f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016020, "uuid": "ff977cb8-0502-457d-b9e7-a37df02447e3", "value": "12288:COysJ5nhFvhxaiz8hC6CSvqdRcVU2cQpbls6csdCVsM3I:fhFhxaizH6CCqdRcRcQpbxFCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685016020, "uuid": "a6e87db7-1dae-443e-9a59-dd15641343f7", "value": 973224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685016020, "uuid": "1ebdcb96-888d-4ab0-9874-84c048578259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016020, "uuid": "88bfb9dd-c367-4840-afae-abcaca4692ed", "value": "TB9mkKe4Qzu.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ecf5a65-fb11-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685028754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028754, "uuid": "366fb39e-0475-448f-820c-567d0a9c4796", "comment": "Malware payload", "value": "cd1a338066dbeb3bd220818d98a0e8d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028754, "uuid": "5f9dad43-edf3-48d0-a214-ea56124cc67d", "comment": "Malware payload", "value": "d28736a0528d88adb5cc8e3967cee9d53b9e33cdef9e0f0d2c7fd13184eeedd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028754, "uuid": "e15fa176-4667-46c2-99f8-af995d33267f", "comment": "Malware payload", "value": "0474d84d5ce9168a48f5bfaa71bfa32305296a24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028754, "uuid": "a5a0efda-53da-47c0-bdce-7922e5c1974f", "comment": "Malware payload", "value": "982590977a552b2d1f55527a5f424a39d8bb448cf6f9f1957044e499db403fcf3e692e4b280ab797d3e3a254fa4f1299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028754, "uuid": "fee2f1ac-572f-45f2-8fe5-704ae78b4bf0", "value": "T1BA2502D49B988CECF15304710C7AF6351EBDBED5A829010BE52732246AB5AD3139FDCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028754, "uuid": "2b36b3b3-f4be-4370-8c6a-8d4fdf63fc6b", "value": "89f3cd0838d6cfcf5015f11ee1a5c7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028754, "uuid": "ec4841d7-ce7d-4a96-91e2-6228a439c0f3", "value": "12288:PaP3LRk5KkFzN1CK3VK+3QT4xqnfTVlACph7Pns5XYozKGCN0mfoNRIF:uL0KkFZQK3Vw4xEUjzKGCXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028754, "uuid": "a4671978-9e16-4d4d-a49c-a103516a8a50", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028754, "uuid": "874bb76a-6264-428f-8ea6-5187ef21cdee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028754, "uuid": "f92ce3a1-1aee-41c0-99be-72bb328d7a7f", "value": "SecuriteInfo.com.Trojan.MulDrop16.17485.20755.6794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c725ac25-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996716, "uuid": "f71db954-d660-413c-803f-d8d8f840eea5", "comment": "Malware payload", "value": "4ac4b3db56351806bace42983538f62f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996716, "uuid": "0fd1c9fd-0e69-49f1-bb21-b2df65e3aee5", "comment": "Malware payload", "value": "d37e67ca4fa94a29fe0b6088000894865f839fa230fd7d1ac82cdbabdfd097af", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996716, "uuid": "04b5ae56-f593-4b5c-9a12-dfb004ef7d15", "comment": "Malware payload", "value": "2f6db5d51ec174f3841f65913ad3567b4023c891", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996716, "uuid": "cb86f52b-f0e5-4702-800c-5f984de98ae2", "comment": "Malware payload", "value": "b1635d72368eec3cca7e71797cb56e36bdcd76a4b2fedc0dee72b47b10eabb36acec4fd0f0ad0848fb65c4e7e20724ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996716, "uuid": "99eac44a-2f76-431d-942d-d42e13aa7587", "value": "T1D654B940471619A24B5B2F36A73054B5EBAE0FB9C2945C8FF86FB251FBDE50CC8D1622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996716, "uuid": "3716c6aa-e76c-4415-b020-20e2e794e34e", "value": "3072:bShaY0Qs3u1d0TyvQKZ/Gxg1YWQ3aJJkAO8MsHBxMkHu3QIlPQXHJbh4G:i0bu1T/Z/GfWaawNshxhOriXHJbhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996716, "uuid": "eac26eac-0b30-4959-98ec-cb0f4bc98bb5", "value": 293252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996716, "uuid": "2770b9c6-877d-4fed-b801-e166ce4432dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996716, "uuid": "af1b2f83-0b64-4eb6-85a7-8102bca30f9e", "value": "ericophyteDemar.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8952bb93-fafd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685020235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020235, "uuid": "d6213036-a1a9-4a38-b571-5f537fac0f10", "comment": "Malware payload (Gozi)", "value": "5228f29cf6d6f1d767a738f3a0920a45", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020235, "uuid": "ad65ae64-ec55-4fb4-b326-19f0745a98ea", "comment": "Malware payload (Gozi)", "value": "d42f53c75818af4aae281a0c3f760e20643852405d69134d03f6ba5c62efe316", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020235, "uuid": "ca564bee-aaa1-4484-a6be-c2398c636ec8", "comment": "Malware payload (Gozi)", "value": "81e41245364ed58b01c7ce09842124dd35724d7f", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020235, "uuid": "0c7024ca-aac9-493d-b823-b6d0e5157aa0", "comment": "Malware payload (Gozi)", "value": "6f92fe105f807f19adb2c3d3bb7aaf4064d75181161daa5f0451f5f7c3fac662e60be234ea6e83fb99ff76246d4ee02b", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020235, "uuid": "01e4c7d7-8efb-458b-9fcd-36e1b2b01722", "value": "T13AC39E4CA6941EF7E4FE303016AE19D64B08A56027B2188DA37CCCF5B52DFE706EE549", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020235, "uuid": "0718bc06-57c8-45e7-8654-28c5fd93748d", "value": "4eeeaaa9e16fff46e8704f0f78ba706c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020235, "uuid": "48d623f8-9dd9-4ea5-8863-83ac2596bb1f", "value": "1536:IzIQxhgI9srp+jbydmCMhEEqA0PZxVwah4LPKLEuvuJpLfF:AjxhgImp+jbamCMh9c3ByLyAJ1fF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020235, "uuid": "8632e607-7702-45e6-99f2-3b83a903877d", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020235, "uuid": "9f9a2ecd-e9e8-45b5-8923-d2106b016fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020235, "uuid": "28e47bdd-c757-40cf-9d50-21a2a90ad973", "value": "646f5dc39a49d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e91b85-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996763, "uuid": "65119b6e-02dd-42e1-88fb-7b01b38351ec", "comment": "Malware payload", "value": "ec4053bafde4ea8756c6cea23374375b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996763, "uuid": "29f20758-9005-4865-82f7-677909e6ff79", "comment": "Malware payload", "value": "d45fe24b9f9f4a5e3f08515b58cdd64ee764dc04d007d38ce0ba797cf42a123b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996763, "uuid": "d3760485-6444-4d62-acba-aa28b21a0f62", "comment": "Malware payload", "value": "d04b276aa12e75d0758792e97d06a15be1fc96fd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996763, "uuid": "5839e32a-8742-487a-b26e-56204afc42a1", "comment": "Malware payload", "value": "bb764960db34473feaa7eb87c19eb30c2d55228b4e1ec403fe7b7518d5381649dd4c6a1f61cdec0f508ea400fb04b77e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996763, "uuid": "5944eefe-3070-4360-961b-af10809f9658", "value": "T1AE449680471528A24B4B3F36A730A4B5EBBE1E79C2D4598BF46F7251FBDE94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996763, "uuid": "29448964-acad-460c-b208-1ed94404807b", "value": "6144:OlvudkyLTJHg7SEDxw3144f0WAONqSg3c2gxyq:q6ra3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996763, "uuid": "c08425b5-9af4-4f4a-bbf1-27ce17c1cd63", "value": 265971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996763, "uuid": "33c5a973-b0a8-4aa8-a32b-0f9235f3143a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996763, "uuid": "372f2370-af84-49c4-8474-ccc70cba7121", "value": "gospelmonger.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce849b71-faea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1685012191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012191, "uuid": "1c3e43b3-7e74-4837-b484-a3ba9a5b1ca4", "comment": "Malware payload (YellowCockatoo)", "value": "2324d77d6b9045ff54b489b2fbda36d9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012191, "uuid": "56c8452d-f2a6-4529-8f07-71c79db08e19", "comment": "Malware payload (YellowCockatoo)", "value": "d5f1e0a329d8d88c4ff1220a938b890296fd8de450a4a34328f5babb89d0ae1e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012191, "uuid": "e593c4b7-7f0d-452d-b698-76eb7f6124d9", "comment": "Malware payload (YellowCockatoo)", "value": "703f435ebc411a029e1f9fd22724061e0e6d9d34", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012191, "uuid": "ffa3dd25-13df-4fb6-ae0e-e361273dd5db", "comment": "Malware payload (YellowCockatoo)", "value": "f0d0a0cf13f7569bcc320b03c23807a3eae1dfcbaf33a3d27ad312925d84a69d72f1c71841af07016bb92b098973a62b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012191, "uuid": "c8684c17-ad4c-42b1-a7b5-15fdaf3efbb8", "value": "T17ED48A143BA7CC9C9B6C16E87B9B53079B2856F3D6F29F0D06A6B170095E9213C4E0F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012191, "uuid": "ed9fed8c-84a8-4878-918f-28e71cc18f07", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012191, "uuid": "91c86917-f4cb-42e1-b73a-16a03b254f02", "value": "6144:TtVpgXHVtNJF/YAGp/ck+uD+AxoydZShoFfD95XDvzHwGBXv/V:01tfJS+uiAxV/NFPz0GF/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685012191, "uuid": "a90e9cac-17c9-4804-af4e-954206a013b9", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685012191, "uuid": "1244f775-2132-4769-81f1-24811093b5c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012191, "uuid": "a985369d-857c-473e-a21f-d02209f226a1", "value": "gABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZANHVF_ZCCNSscCKQN06IpNRdXpDJtSDKHJGgQHGmdIDV1EtUBZDY.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7cc5a6-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997964, "uuid": "0db61341-5b66-440c-ab5b-5b38e9b95f8c", "comment": "Malware payload", "value": "6b4544876f30e3ded06d4f260457f2c7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997964, "uuid": "b9c5a933-89f9-4275-9324-c9416d45fa5c", "comment": "Malware payload", "value": "d68ca46fe1eacc82e1b24c2d16325e455b24e8e3298e14bf25eabf6566ec25d7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997964, "uuid": "2cceb21a-a245-41c0-828e-8fad2f4093f3", "comment": "Malware payload", "value": "bcc7bd19b09cb091ef72cb0c3764b4a70a6da809", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997964, "uuid": "cf51aa91-a814-4aa4-a5ef-45ec78ced55c", "comment": "Malware payload", "value": "0c6a9f5ac313f794ae4674157b44885dc0d7cef234be576e19650948a55c23d71d5dfe7e0b9d65f3cd66f340c5ee42c4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997964, "uuid": "4810ff63-47be-4869-a2cf-231f71744697", "value": "T198548484472128B24B5B6F32673494A9EBBE1E75C2C8568BF45F7250FBDF98CC8C1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997964, "uuid": "7f460dfe-9976-40f2-89cf-3966b59d9cda", "value": "6144:sWsyooVcSMhfIRxCN2xWf5JCQSkiKJI6FoaQy:sqwIRoOaQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997964, "uuid": "8d22ba6b-14ac-45ae-b4c5-3aa6c797f252", "value": 304504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997964, "uuid": "350bc58d-e8de-44c5-9758-d9815c8654ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997964, "uuid": "2dbbda8b-6066-4bf0-8e74-13c495a1d4f7", "value": "Subdrain.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cea4e2a-fafe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685020697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020697, "uuid": "36d81f79-5108-4804-b602-45e58b429554", "comment": "Malware payload (Smoke Loader)", "value": "6bb9e7dbff0a6adb6051a5b6021e3873", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020697, "uuid": "4a21ce3e-348b-4e41-b945-6a11ce83339f", "comment": "Malware payload (Smoke Loader)", "value": "d69253f70b66fda5a14af877f35b011f7ee3270250cd008459616ab9714ce2c7", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020697, "uuid": "3983e60b-b8b6-42a6-8a0c-ac9f3251668d", "comment": "Malware payload (Smoke Loader)", "value": "f07742740134730f9f0fb123f02851490c24ea6f", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020697, "uuid": "71ffe3c5-2a10-4d97-bc55-dbc696e2e71a", "comment": "Malware payload (Smoke Loader)", "value": "e2a90e76038edb2c18be261af2ac75210158cd7e49934e6edefa393fcb7b12fbbafc4c206907e069bca0f4543ca7b83e", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020697, "uuid": "499beafe-706b-4a87-a893-38412ca9006e", "value": "T124547C1273D1A871E5131A318E3AC6E46B2EFDA18F5176EB23947E3F09702E1D672742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020697, "uuid": "1dd0af16-9517-493b-96b9-dd01cf9ed60b", "value": "8522dc5d9d6a2a97002c24ca5ed58b85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020697, "uuid": "895c535f-10ff-4b1f-811d-d66bd38931ce", "value": "6144:EyQQzWnp3hI0LuJMMPOSO8Ug+pZFeLZy:by3hZHMaPZFk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020697, "uuid": "562f926f-3f87-4701-80a5-3e756b28c697", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020697, "uuid": "76999c04-5d93-4474-9f39-07f97300dcb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020697, "uuid": "5c61a640-d970-4a24-9ea6-d5222641170b", "value": "06824599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cba6d56-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997907, "uuid": "09c37fc6-62f9-4f8c-b307-8a29f6d75804", "comment": "Malware payload", "value": "fe59428649d5d91156c23dec3395c9aa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997907, "uuid": "4dc215f7-df7b-480d-965c-a88204cf3084", "comment": "Malware payload", "value": "d7469246b9cf8f58e607c391f9b2b07b4d66db8e9d67509d078f32a544f65866", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997907, "uuid": "31c553d2-e00b-4156-aa79-83035c6edce9", "comment": "Malware payload", "value": "ae541b34f05bfcc33d622ae2c71ed33cf03be899", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997907, "uuid": "4eb5e157-3527-4130-8e7f-0d8aa65f00f9", "comment": "Malware payload", "value": "5db5560cd6596051fde8400eae01c98bc5af006a002c92af3ce822cc48329ff2a779359d8e13eb47b201853b92b89bed", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997907, "uuid": "dc519468-17f4-4e80-8ca1-f6c1f98fc325", "value": "T167645380465528B64B9B6F26A73094A1DBBE1E74C2CC598BF46E7250FBDE6CCC8D1331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997907, "uuid": "135ca322-4b48-4875-a1d1-92d9cd004e63", "value": "3072:ROPTpNV3ZmsjG8CyeTI/jsTC4M8vlGOJ3Qb+ZcgNlbJrmRHyJXcC5K:RqPaq5eTIr4+GGOJ36+ZcghrmRGx5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997907, "uuid": "4d2701d5-7f4b-4ba5-b112-3b07b1a98f96", "value": 324274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997907, "uuid": "70aaf84e-9563-4db8-8047-9612bc5cd6ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997907, "uuid": "80613a10-7f7f-46fa-94e5-e5f994d08d55", "value": "ShysterMacroagg.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04c0b2f-fb20-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685035306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685035306, "uuid": "49d07d67-415c-4b36-8dcd-76ed6994404c", "comment": "Malware payload (RedLineStealer)", "value": "23bba8988e6abc50638fa5604456cb44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685035306, "uuid": "d24d3091-e6c1-4bf7-a3d8-5a659888dbb0", "comment": "Malware payload (RedLineStealer)", "value": "d7f6866827fca029dba1ed40fbfb36327a75fd3bdf51fd2f8e42510386fafe54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685035306, "uuid": "7605d10c-a38f-4db9-ac19-367cb80cd67b", "comment": "Malware payload (RedLineStealer)", "value": "c6ea06cfb967a4a7e85f1e4c43586ca70ba5722a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685035306, "uuid": "6b9b2033-e792-45df-80d3-69df39a59465", "comment": "Malware payload (RedLineStealer)", "value": "aeb4df3e1a26705282910e0c4574fb4efa2f51a93eeb097953571a5571d8f7fffe82a596c58f152b39453dd4f424d4c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685035306, "uuid": "1297d075-69c1-45cc-90e7-488dc976a122", "value": "T178F41203B6D99132C8B13B7459F702E70A37BD618C794A6B2387AD1A4CB3A94D57133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685035306, "uuid": "3e196bf6-4a5e-4eb0-910e-47348289fd39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685035306, "uuid": "ef492d1a-66db-42f2-9f47-ca66ee7fb399", "value": "12288:IMrAy90dXwsUetu+0LQ/qxfDSIXuLG8wdhZ4bUy72tgS+fZavMsjWqEHZl:Iy2KeMLAqxfDVXuy/dz4YyAf+hfsj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685035306, "uuid": "b82c4186-9ff1-47a3-b692-f721d0b6644e", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685035306, "uuid": "bb7d5f07-cb04-48af-ba5c-a549b5f68734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685035306, "uuid": "64e58b5d-655d-4e87-9780-e13bf32184c7", "value": "23bba8988e6abc50638fa5604456cb44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53046ac3-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994804, "uuid": "413190b6-8020-4e74-8fb2-ba2d358f74b1", "comment": "Malware payload (Quakbot)", "value": "771c151a242ebee05ba13a8000c5c997", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994804, "uuid": "ba39643b-9a4f-4762-a71b-ff55edbee24b", "comment": "Malware payload (Quakbot)", "value": "d875c518100f1ee9cd13ce00ba333f3ee8e0bfff0ddbf4d107215f15f4c53034", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994804, "uuid": "624c1a75-9d5d-41df-b946-1f4c116e407f", "comment": "Malware payload (Quakbot)", "value": "ac6e1bc634297bea9727f83a331a15c0b66d27b3", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994804, "uuid": "d4b71152-99b1-44cd-bc9d-343b91d17dc5", "comment": "Malware payload (Quakbot)", "value": "483fb5e6360931f8d13eaaaa8410f9c3a3654634ae7dd0009a0cac25f5bc8405d3a5c263af22edd7b04efc3d6aa25172", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994804, "uuid": "02574b38-b9a2-4d89-adbc-04f9fc6aed83", "value": "T12373191B6344033956220264974F66D2F7B484787B26DA64A48EC3AD3342D78D7BFAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994804, "uuid": "bf927c7b-8a20-418f-9187-79bf3e9defd0", "value": "1536:u/MGWP14QU38GBVqiFGn6tWmeDApN9iyf435oM1ZOVfJwiosC:CWTKROiInsn43B1ZO9JwbsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994804, "uuid": "981bcf15-d6e1-4664-ac81-bf87964c90c1", "value": 73399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994804, "uuid": "589712f1-d6f3-4c9e-9184-f5c26dfc71d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994804, "uuid": "7bc3351f-ca54-457b-aab3-faeba47db9b6", "value": "Claim_A462.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820a5247-fabc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684992306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684992306, "uuid": "36c45136-8729-4a1a-82b1-f84a04771f22", "comment": "Malware payload (Loki)", "value": "22807e3d6d13cd1800fd76ad168076f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684992306, "uuid": "a9edbb31-429c-4f3e-ae58-bee5a51b2e1d", "comment": "Malware payload (Loki)", "value": "d896f395ac42c9894f6e2c86135275035030f8e66dc693a3c8203499db5a8bf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684992306, "uuid": "331f79c8-3771-48ce-bd97-ed8698cc64f9", "comment": "Malware payload (Loki)", "value": "0d936f2a0707b53dd039479c7a63c8b44bf0289d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684992306, "uuid": "7cfbfe9f-e41b-4b6a-bd72-3ebd8ad655ed", "comment": "Malware payload (Loki)", "value": "f658f23ab8b7499ab926ddbd95222f4b7154a8d6ba5b3825df7451ec4d0dc1dd2f3ef6d2e8a563b677f1bee5d2f596a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684992306, "uuid": "fd03f79a-425c-4ac8-84b7-8ace7f0ffb1f", "value": "T1BEE4F1D83550B19FC867CB7289682EB4A62569BB331BD243A44711DDDA0DBDB8F102F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684992306, "uuid": "c499889f-e93e-4c89-85b4-e8a0304d5704", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684992306, "uuid": "74b255fc-3d11-4e0e-aa30-d3121ce49941", "value": "12288:m4aWIm6lVvtzZBEP85IVkstWj9VzW4/4BzlkWUrBr6u2yAFyKbJakMwjf/I:iTmIt9BEP8WVxt8nkhTUrPtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684992306, "uuid": "542fc77c-6a6a-4bd6-ae29-c7e38d1344b0", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684992306, "uuid": "2e432cda-f119-4733-9798-536cc0270fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684992306, "uuid": "f230d705-623a-4667-b333-b1205eacd7c1", "value": "RFQ-MV-BAOSHAN-HOPE-ORDER-xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5953f837-fab0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684987083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684987083, "uuid": "a2423a10-52c6-42ef-8328-4fec1c5f75cf", "comment": "Malware payload (Formbook)", "value": "d64a82487bcdcdf93b216c14979d1306", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684987083, "uuid": "eb6a96cd-5e58-4f7f-ae5a-ff7df55bcdd3", "comment": "Malware payload (Formbook)", "value": "d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684987083, "uuid": "15869696-e012-4722-889f-7432a798e9e0", "comment": "Malware payload (Formbook)", "value": "36cb2403f023c7c56d2766589a0bf0dae90f9148", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684987083, "uuid": "5a5b7072-c4e3-46e9-ac41-71b5366ba896", "comment": "Malware payload (Formbook)", "value": "8f89cdca19d937c838c0911cfabea0d39ffd44338c693eb2c7f22a7fe22eef99d5e49920d476655f41e4b9c329a4a19a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684987083, "uuid": "a50d1f2f-3d4b-43bf-a395-03905e17789c", "value": "T1F4D42249AA3CD706E9B757B9448002B4033F5CABB872E30B5D1BF1DE9678B850619F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684987083, "uuid": "99f06996-c698-41f4-8976-22642704d063", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684987083, "uuid": "e8e8317d-488f-4f42-a05a-05a3211bc21e", "value": "12288:u2N8jiZ4zypIPUtPplTY6RhKuNFUbXuRUbgWaPNArM1V2ryGiLqf0HiVhMf3xDS:u2N8jiZ4zypIPUJTDErbXkUbHaPNAr11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684987083, "uuid": "601bb06b-46dc-4c58-8dea-8b0930aee57a", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684987083, "uuid": "c3df67dd-f87d-4d00-b484-d396484eb57b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684987083, "uuid": "26f33a55-1c96-4b48-b69e-5c86759793ac", "value": "d64a82487bcdcdf93b216c14979d1306", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d9d5ba-fae8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685011235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011235, "uuid": "6835ce7f-3613-44db-85d2-df6e189ead3b", "comment": "Malware payload (AgentTesla)", "value": "a3033d66d36c8790ddcea27e23931e57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011235, "uuid": "f4281aca-b0ee-4351-b003-8d6ffed33a44", "comment": "Malware payload (AgentTesla)", "value": "d9c02f3e9cc894fd55747ee2c449c1c40c2906d9fe1134994593eb0e81589a30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011235, "uuid": "4080b046-529e-4715-8515-fbd9ce388d06", "comment": "Malware payload (AgentTesla)", "value": "5a14a150e5d445995a0d229e16af14c6c81c7f5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011235, "uuid": "e8b30f1b-ddf7-4f76-86cd-2d759108e591", "comment": "Malware payload (AgentTesla)", "value": "de02d6351c7abf8f237ea02414052233dfd55049c2451f202603e9473d72bbe0e8a493f78dbe2206ab08216225ff7335", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011235, "uuid": "a9811778-327a-4880-a99e-cc5bc48b7399", "value": "T1F415947C86B60DB6D2F7C7B487C4B817BA6CBB73B0485A2540D1439D026F962B4DE42E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011235, "uuid": "f35c5330-f628-43f5-ba51-ce13fc1d87d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011235, "uuid": "5a0f0dbf-34f9-4a59-b560-ce6e10a5143d", "value": "12288:5STehoTiTB2QweCXZd6RuxChC3oXBLYUu7uEqrgllOwJ:Th3H+Zd6cyXcqrgllOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685011235, "uuid": "7f54891c-c449-4e6b-88e1-18046c482ec7", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685011235, "uuid": "1acacfc0-eb08-43b0-ae2f-49650c89ebd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011235, "uuid": "5d4860ae-9bd7-476c-962b-db010ffab77a", "value": "rUPDATEDPI.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3999ed-faad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684985984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684985984, "uuid": "1a85a426-1b41-42fe-aa63-68ebf326a637", "comment": "Malware payload (Loki)", "value": "50be3ad3cb50eb61d0d7a76df29972e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684985984, "uuid": "f811bab6-0c43-4dac-ba32-a9a9f4132485", "comment": "Malware payload (Loki)", "value": "da108473566740a4ecd7f86677ee7a22779808be300f3329ca4a6d8877d0fcdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684985984, "uuid": "4242f7f6-8edb-4559-8cc3-233047517fb8", "comment": "Malware payload (Loki)", "value": "7e24ab7d5c0d32fd2e0f60599ae5d20a6a0dbcf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684985984, "uuid": "47f3b4a7-ea4a-451e-9a97-170498e469a5", "comment": "Malware payload (Loki)", "value": "f26ae8bdaa148a92ee1c6d965194cbc20d940876eead356a2e45f63d1706f07cb14d4269078d892178b1d6de23690714", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684985984, "uuid": "a80a8fe4-f198-426f-b208-f0c7b2f9810d", "value": "T14CD422A46A665B3AE6AB1BF0404532F0063FEFAC7173F6572D07E1CDEA06B44844674B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684985984, "uuid": "0df63e1b-c68c-4d06-8671-2eeba0021755", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684985984, "uuid": "81317659-0489-45f0-8c53-e621876abf33", "value": "12288:SBaWIm6lVvtzZBEP858Mfa8oC1WISnfziiw1kNNpucmMxEsqP976m:rTmIt9BEP8mI7Wpn20Zq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684985984, "uuid": "ea932f6c-fc4f-40fb-a446-484294ab021d", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684985984, "uuid": "7aaffdea-7e6e-4d6d-b76f-73d5842c06fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684985984, "uuid": "c89a3380-589c-4583-acc8-6b474a56864a", "value": "50be3ad3cb50eb61d0d7a76df29972e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845a562b-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996604, "uuid": "4cc985c9-9401-4cb2-87bd-28cd3689ce24", "comment": "Malware payload (Quakbot)", "value": "8dda8ce5bec666b7d6002f5824e6106f", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996604, "uuid": "7c0c6da2-fe4c-4243-b7dd-515348820796", "comment": "Malware payload (Quakbot)", "value": "da42ccc1ca8d766f20a04db25460660d25426e7c14dea1adcc3a949912326479", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996604, "uuid": "d2811b42-cd65-4d7c-bb96-8c89d7bff468", "comment": "Malware payload (Quakbot)", "value": "1d7e22e60b559c6cb5dc1d91ae2cb118a300529b", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996604, "uuid": "dc6cccc5-294f-4b14-b3f6-fbd6da66f0fc", "comment": "Malware payload (Quakbot)", "value": "52bf8f92f17662b9b2602ab3dc8f696f94757539f9aa0d5cf10cd25b4861c038a6a1074b6a69191dce7c99004ca3d333", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996604, "uuid": "317838d7-8865-427a-a217-fd977615c743", "value": "T1B463E86B6345033A555201245B0F6BD6A3B884B87B26D774A09EC2693342C78E7FF9FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996604, "uuid": "cadc5a47-b83b-4d34-89b8-e3bc67b53e8b", "value": "1536:mhV8zfRGooKjmcjhfdQA1sclDhslmCjYbg9yZCFay:rzfkoDjRdQvclDylmZbg9yZaay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996604, "uuid": "0cc7af05-0496-444f-bfda-c25f45098405", "value": 69518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996604, "uuid": "2ce4e0d7-b35b-4240-ba2d-bcb6e936ee62", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996604, "uuid": "67228170-ddf7-4b72-b3d2-503af255e2fc", "value": "Claim_A820.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8116994-faf4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685016421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016421, "uuid": "2e2b46ae-02ad-4350-801c-f55f28d24864", "comment": "Malware payload (RedLineStealer)", "value": "04cad27a52d3ff6562723e86727efb3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016421, "uuid": "d50bcfe7-d728-44f2-84e9-ae84bab9d3b7", "comment": "Malware payload (RedLineStealer)", "value": "da6b392cdaacb677ab5b0b660451b70e94c9b880db32aae9922d670ec12e0e6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016421, "uuid": "f242f68d-fda4-4828-bd56-bda421984902", "comment": "Malware payload (RedLineStealer)", "value": "fa2ca28a0ce14b33d3beb0f3e8f189fbf8b72609", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016421, "uuid": "7df712c3-a808-4b18-be2a-4ef7ab9cd0c2", "comment": "Malware payload (RedLineStealer)", "value": "f54b345b6fe5ca1f26a2071daa4adcceeddb0748a05dcc2ac2469c9738322874cc5cddbe2150542bee3c6a1ebaf47ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016421, "uuid": "92914c0e-b523-46da-a157-1a224b1f852f", "value": "T174352307E1E84172D8B9277158FF02D35E7ABCE499B0836F22927E290C724D19973B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016421, "uuid": "1b305369-54bc-4b4a-a484-b84cb3bcd72e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016421, "uuid": "54e6b9e0-4f54-4737-b480-1968ea2f003d", "value": "24576:dyEKEDGtekwesV0E5w8kyriPr7gPJDwYWYro0PfwdjBBvi:4Ooe+sV/w8kyuPoPaYRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685016421, "uuid": "e0807832-739c-4358-a639-db7d5cb0cadd", "value": 1072128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685016421, "uuid": "74f4e5fc-5fba-413b-bf58-96c3b56eaa06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016421, "uuid": "16377563-9960-49d4-aa83-e85bc1968e04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e254b64-fac4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684995574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995574, "uuid": "0ed2a689-3be7-4825-9840-00eb62e94b3e", "comment": "Malware payload (AgentTesla)", "value": "cba274bc663cebe7a24632ea01626605", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995574, "uuid": "c348b060-5f4d-4bbe-ae75-9bef27a5c82f", "comment": "Malware payload (AgentTesla)", "value": "da88ccb78b77682a6eb79e8ca1f8f5e5bf4c89e009158ee29a91bba96a175288", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995574, "uuid": "b0cb800f-e507-45e4-9194-c0dfabdc2d77", "comment": "Malware payload (AgentTesla)", "value": "57942956403513329b5f1b3922866fd34382283a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995574, "uuid": "815de2ac-c227-4470-915c-fc60a2867088", "comment": "Malware payload (AgentTesla)", "value": "167f42925d6f0975b5909537dffc99ed26de5eabccd8f86cf8bd25cf35c7e44a25988c27b20f6ebdcaeacb57355a0964", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995574, "uuid": "3b1b2baf-3ec2-4446-9b37-2afb24470f1b", "value": "T180D4DF972A5A8F26D17103F95226E6B963762FE97173D31A8DE2BCE3F135B430901183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995574, "uuid": "7a5257a5-13c6-4f9e-86c0-fb5abc55af3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995574, "uuid": "65c24791-30ce-4465-aeb7-ec7397328c6e", "value": "12288:h2iN/tUGJ6e/pRLjHCEn1nEchpj+ENWG39CVl73i3ON:h1h6U6OpR627hpi839sZS3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995574, "uuid": "92158f9a-af2c-44e7-bbbd-3a8b934a0b52", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995574, "uuid": "238496f5-e215-482b-97ee-f609751e5c36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995574, "uuid": "0e33ca1d-f2ec-4401-8016-dbf7e7461df3", "value": "cba274bc663cebe7a24632ea01626605.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9f0f96-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994798, "uuid": "313d6ed5-1beb-47f7-8a55-85139e7baeb7", "comment": "Malware payload (Quakbot)", "value": "7d605dcfe9c72415879ddfb8323132a4", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994798, "uuid": "99e94be3-a834-46bf-b235-4df98b28d07b", "comment": "Malware payload (Quakbot)", "value": "da9ac10195ab62b0533d4915ac880ccc56ffd8e12899f979529baa654fb1c229", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994798, "uuid": "7ff2147a-bb4b-47b2-931e-ad12a3a05f64", "comment": "Malware payload (Quakbot)", "value": "ae651021508eb7dab18d5faabae264be31463ba3", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994798, "uuid": "85e151fe-5c74-44bc-8c3a-056d584eabec", "comment": "Malware payload (Quakbot)", "value": "afe894695384ddd41e116d21956deda5633792e7e3a179fa6db258e6db4604df9c2b5be4facdbe3331dc1f00ddae228d", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994798, "uuid": "efb0da06-5ed4-45f6-865c-01056ec0f0dd", "value": "T1A563189BE381137D69210225550E5AE0F7A1883C6B71EB78A44EC3AD3321978D6FE5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994798, "uuid": "2987d98a-be27-452c-b745-4190a53a229e", "value": "768:rxINK0+Y+vjBMkKzdIPDAl+BmU2kJeWW1Xi8+sHFKX1ZOWOf0dX44QRy1ZOWB:2KtRbB0ZQDAymk4Fk1ZOVfgo/Q1ZO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994798, "uuid": "4612d094-b159-416d-86fb-e0cc7909d418", "value": 67670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994798, "uuid": "02f25207-33f4-44d7-bd66-573d112ac414", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994798, "uuid": "9b010f8f-24f7-45da-afb0-70a9a1f47d2e", "value": "Claim_B031.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030bb93e-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996817, "uuid": "a51cf255-d7ee-46d7-9efd-6e963fd88ea9", "comment": "Malware payload", "value": "ee5f6a2f511d04c2bfcce4f56cf7e51d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996817, "uuid": "a49277d8-304b-4bad-b8fc-e02195fe13e4", "comment": "Malware payload", "value": "db05c7e247d0a1a64c74a3e5dea2ed7b2b7e4c59c9344e23d852841fc86ee5c9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996817, "uuid": "550a44dc-a809-47c2-9c0a-8df0e63d5af2", "comment": "Malware payload", "value": "73b9aa52792f9413a329d7587c299d29d799e549", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996817, "uuid": "7ec67cb8-3660-4c70-b59c-aaa759640553", "comment": "Malware payload", "value": "c87e914c13589e26397ba8f796d57d83334eb29c1dd2dd3d917b813cc5d5a084e114ba1764965b62bd49802b83ce6683", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996817, "uuid": "0e80f3c6-cc78-484e-b46f-3e28972e102f", "value": "T1BC4486844B5128B24B5B7E36673094B9EB7E1E75C2C8568BF45F3260FBDE98CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996817, "uuid": "a383afc8-0549-4207-9737-80429bb2ca0d", "value": "3072:yHpEjlMSlxMQ1zyY6freW+Kz5eDn1ZiD6xAwEinxpHZWfpKxUOlY0:kK2Y6TN+EeDnHBxAwEinxpQKxUOlY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996817, "uuid": "1497b578-1f8d-498d-b08e-0f1e98b79dbf", "value": 264861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996817, "uuid": "881b2b2a-9028-4337-a47e-666e5a25b35d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996817, "uuid": "3ee43a60-e70d-4a07-ba6e-eedb8c92ca18", "value": "hysterocrystall.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89268778-fb14-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685030113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030113, "uuid": "8453e3a3-6f57-424e-a7d1-a56e3c3a2eda", "comment": "Malware payload (RedLineStealer)", "value": "2c5a75b7d24847bc5d206adb5c630a18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030113, "uuid": "128c7077-40d1-48f7-adf1-bab976f663f4", "comment": "Malware payload (RedLineStealer)", "value": "dd09828ffbfdd784f83cac83641b8a0c3ca04b76becabb0ab5d170ad1bc169a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030113, "uuid": "2f7c9795-09f0-47d0-b51b-0a3a983673f7", "comment": "Malware payload (RedLineStealer)", "value": "89ca4d98947ab1248c022d66a23279f04cca6bbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030113, "uuid": "fe6f168d-bd71-412f-9d27-752d90c95362", "comment": "Malware payload (RedLineStealer)", "value": "3d7f289d7cef54eb09c9b4101d559a7eb4de95ded8381ca5ffef08ef95552f432c7cbba08f7a4bce2924ed3676268d25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030113, "uuid": "1db32ef0-0f1a-4265-8b8f-fb6bdba59444", "value": "T12BA35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC154E71FA7B866917EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030113, "uuid": "7aacf25f-13af-405c-a56f-cfea5b311ce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030113, "uuid": "f39820b0-3581-426b-91ef-33fc5c8d94b3", "value": "1536:Fqs8haqpalbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2YtmulgS6pQl:DiaKaYP+zi0ZbYe1g0ujyzdsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685030113, "uuid": "bd2e86ab-c40f-4b28-8b53-e926ec1fdd48", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685030113, "uuid": "d320ce24-f4fe-400b-9e18-b668aac132f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030113, "uuid": "ff42152a-60d4-4d6b-b764-8134de77945c", "value": "2c5a75b7d24847bc5d206adb5c630a18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86d4f75-fab4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684988961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988961, "uuid": "5c5f78a3-a01c-448a-989b-dc1b81e4bf0e", "comment": "Malware payload (Quakbot)", "value": "2b4c76317e5f3e6164dcae20350d71c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988961, "uuid": "8485453a-3187-483c-a84c-238d50f3ea94", "comment": "Malware payload (Quakbot)", "value": "dd16533d472ef34a530913604bfcffdd9328ec10f7f646493714e4fdb9b6dcd8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988961, "uuid": "bcca403d-b1a7-4334-9126-e3091208e9db", "comment": "Malware payload (Quakbot)", "value": "7be8fee74ab1d196a6c7aa03848005d9e9b860bf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988961, "uuid": "c29b129e-9ab1-44f5-a4bd-69af4ac40abe", "comment": "Malware payload (Quakbot)", "value": "0db54595d7e1e003e7875dcb084df69dc4304ceac7fe3b1ebe1ca269442f1e94d0fbb7b321209e5604c386428a5771b9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988961, "uuid": "fd8de94a-f35f-4a24-8292-8e5282ed6a6f", "value": "T1B254D0017841CC31E6BF193C14B89B61573E7921AFB09DEB739849390F642D1AEB6B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988961, "uuid": "43e8756e-0a62-4bfc-be5e-80a0413232f8", "value": "f2e9757e5dc55604f9953968faf6ed8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988961, "uuid": "b185eeba-70a0-427e-901f-ef95416e62f9", "value": "6144:wnCa7uW+h+IJE+edVtbIDBJF0Ecns6y9cjo2iwJtsykZHqxO34aG30VmXSmzlkRs:W77uEs6T39JDVGF4sjWph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684988961, "uuid": "03f15b10-f068-4cc0-8b6c-b8bf7593b288", "value": 288088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684988961, "uuid": "ba9ae9f5-1f65-43f3-bbab-f455e23014b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988961, "uuid": "8619a841-db9e-4bff-939a-3eae466e1d32", "value": "adRaiJD6ufSV0Pqp9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198fae52-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685003727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003727, "uuid": "3f90f6d9-4d47-4109-9252-2a59a1bc057d", "comment": "Malware payload (Formbook)", "value": "d25fd2bf6433842ddaa3325c03a635b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003727, "uuid": "2732c2cb-3ee4-4e68-bf43-5399f2a694af", "comment": "Malware payload (Formbook)", "value": "dd598d177dd0ea11a65634553455381f5765efdbf3cca6f9dc813605211fb269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003727, "uuid": "8b0f5a66-2cf3-4d65-8df3-b85797ac32e5", "comment": "Malware payload (Formbook)", "value": "ab77c3d4cdf83fa03b1680d46e1cea3876ecc100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003727, "uuid": "e2c6d683-872c-413b-8e03-0099805ca696", "comment": "Malware payload (Formbook)", "value": "be12268c1c6230165125bbc8a093ea53638f8897584af14a0d0489b7cea161d075bd1b84bc618dc4a3f131fd7eca22ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003727, "uuid": "a15d7b3e-ca09-431a-8138-51561a9d59f3", "value": "T180D423837B99C16BF693463104222757ADD5603209E3669FA3009E98F925F47FF49373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003727, "uuid": "4f1e1499-0545-4cef-8076-a74f38974672", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003727, "uuid": "1e9047ff-0709-4438-b368-e882baf5fc2d", "value": "12288:ZYD6x+fitDJhG/y2GHfQiPQlcw//234LS5cJ72A39dNzS5A+eG3ONANKCO:ZYDxatPUe5QlbTO5MKA3LNe5reeONAgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003727, "uuid": "d3323f4c-7271-4b3a-8c83-2aed551d3691", "value": 640687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003727, "uuid": "aec2d41c-a93a-42a4-9c5c-98d4458f000e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003727, "uuid": "c73a1ed8-39d5-40fa-bb1f-f57fa3cffbb1", "value": "I_Type_DataSheet_Rev.1.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02880708-fac0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1684993810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684993810, "uuid": "dbbb3b64-c7e1-445a-9ea1-8c151bac681f", "comment": "Malware payload (AveMariaRAT)", "value": "21ffcbf147759f82745f07bfdb0662f4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684993810, "uuid": "514afa1b-5f4f-4e27-a430-1abb57dbebd8", "comment": "Malware payload (AveMariaRAT)", "value": "ddcb13f6db4575ad1983794aa82529e5c21ce34823c0270801f8ab9543b1ffba", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684993810, "uuid": "53e42500-5086-46a8-8d3c-d444157a7bb6", "comment": "Malware payload (AveMariaRAT)", "value": "a5cf594634d1984592589c2335d4bf468319f997", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684993810, "uuid": "1cbb6f6f-d8ea-433f-957d-b9ca12df7a78", "comment": "Malware payload (AveMariaRAT)", "value": "da87ee2fd2d605a5ddfdbf059477882e75e99a2812127155c3396a6758eeb847ca02bdd4e54b475c65d939906a5354b0", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684993810, "uuid": "33f08ad1-7c8f-4d97-a428-877d38c15d2f", "value": "T1E7F3F18476E0D06BD5A206708DB9CA7DBBDD6D252CA94F0B2BC06F1F7876A44C50E723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684993810, "uuid": "2b01000f-f03f-45bc-8e09-dceb0e047b0a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684993810, "uuid": "4457c441-90e0-4e4d-a008-c1c6ee42f51f", "value": "3072:cfY/TU9fE9PEtu+b+MXjULoSsr8cikLhzifVKCuzNGPL+xi0iCMy5GqG:KYa6a+M4Mh5iwmOHtLdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684993810, "uuid": "168004c7-a81b-4f74-a58c-5b2d45686cd7", "value": 167502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684993810, "uuid": "cfe14c02-4186-48b4-9508-4db38af86a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684993810, "uuid": "f66e4f68-dfe4-4ca8-9a9d-d46f821f6517", "value": "21ffcbf147759f82745f07bfdb0662f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a7a1a4-faf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685018452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018452, "uuid": "363c5d98-6b25-49a7-baf0-12cd6afc541e", "comment": "Malware payload (RedLineStealer)", "value": "37e1fd5be54246e22cb3ab0788eb88c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018452, "uuid": "335df4fb-1a74-4b7c-981e-e3579a530905", "comment": "Malware payload (RedLineStealer)", "value": "de330e0837d077269ddbe04031d143163a283a1fbf3cc070950ebb62796aa203", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018452, "uuid": "16cdbc89-f98e-4596-9f01-6b4f4d265613", "comment": "Malware payload (RedLineStealer)", "value": "64797b40b6b96847b6acd9965144ea29e8601a7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018452, "uuid": "0d2d4efe-ae2d-497f-8882-d036a24a8c4e", "comment": "Malware payload (RedLineStealer)", "value": "b81bcfe7ac5600aff6227ad77a3512f215e4a66ed3104c44d6187ebb957209c807aa3b198e0fa40be973aa07ac134474", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018452, "uuid": "802dc9e2-f936-47f3-8330-7c8f5f695dba", "value": "T1F8352326F6E44563E97427B09AF602830A3ABCE07D7856AB0B517C5E2C726C1F43573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018452, "uuid": "72bcce55-baa7-4b6b-ba31-1afcea9baf53", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018452, "uuid": "ec864fc0-8b45-4965-adb8-fcbf63f52be1", "value": "24576:Iy0ayAzhvWdSthGBHL1LkGAzdyX8wC3ks5ivPG0jfJJT:P0anudSDGBHL5QyX8w05ivPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018452, "uuid": "1e9b5d21-4c43-4e94-bfa6-250a6946e78e", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018452, "uuid": "f268976f-e574-405a-b1f1-f0333e950856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018452, "uuid": "084a06dd-7295-4197-9f2a-9b8d30c738b2", "value": "37e1fd5be54246e22cb3ab0788eb88c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c88c36-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997095, "uuid": "1bad6146-b266-43e3-869f-9ea75e7dd504", "comment": "Malware payload", "value": "2bb4338e8608a57ffa01aee5da2ea89f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997095, "uuid": "372f9791-2fa4-4dbd-9d12-731e0d7cbd80", "comment": "Malware payload", "value": "de50fd70f9468e33018a0f034cd8455ba5dfaf185524247424ba90db488f6425", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997095, "uuid": "6f2696de-d7a5-4a22-82d4-0c44723037f2", "comment": "Malware payload", "value": "372aee59022234a36a1e4ed46a153a97760e80ec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997095, "uuid": "2b096a0c-84df-4034-b04f-b0e2f227a28f", "comment": "Malware payload", "value": "7639eae598d07a2bdca8704b9e553b110773882411ee5f373c8aab04b6ff626e65cb2ee55523c83cce0491586069f7ae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997095, "uuid": "54bde08e-e26c-400a-9b95-84bca8aafe25", "value": "T14A7455804B5524B64B5B7E266B3094A5DBBE1E75C2C85A8BF46F3250FBDE98CC8C1331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997095, "uuid": "13454192-741c-4a32-af8e-5a7a96f0d09f", "value": "6144:K2u/5Iju9Tei+bDWWrNdpjhmw772K795qZUNrib:nFUi5IJUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997095, "uuid": "f4f89ec4-5200-4422-b2ca-34a7dd5d8d3e", "value": 342768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997095, "uuid": "5971c5d0-19ef-4dfc-b1c1-e4076890de2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997095, "uuid": "a9996aec-8c1d-4d5f-a7f5-234bbcd5693f", "value": "neapolitansUnco.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92b626f-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684999673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999673, "uuid": "06b309f9-a8ef-4271-ac18-49dcf6a5ae22", "comment": "Malware payload (GuLoader)", "value": "b4a80023c3da279cde94b9b3f996c809", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999673, "uuid": "fa83a656-799a-4129-86f2-685d0b411239", "comment": "Malware payload (GuLoader)", "value": "deb76a0c4d668077c231c48123ea205e43efb0eece5ea8638bd44758879025ba", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999673, "uuid": "b8b850f6-0390-460e-8f08-f2b35d98bf02", "comment": "Malware payload (GuLoader)", "value": "7e8a6d2dc9ecdfd7e32bc97530c2835fd83c74e3", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999673, "uuid": "2bdfd7f3-7eb1-4ea4-8163-2f86153ac248", "comment": "Malware payload (GuLoader)", "value": "774e247d72ffe927438d3af34f869edb404c1add34b16d635f1c8223090287ece750d1925e16cdefe3e2875ef24a5eee", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999673, "uuid": "b1b8b289-f60d-4290-ba25-dcd42f15fbc9", "value": "T11294232C13BDAF01CDE7A31754AF9F1784E20D9A646C0F0E98D21B151E8256BEF89F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999673, "uuid": "998c9abd-0046-4bec-a81d-f9b4c76b4075", "value": "12288:a6B8rJ0/5XmerkNQlRpGnfrxFiDSGUDpABq4:F2g4eIWxkTriDRUyBq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999673, "uuid": "ae59f43d-2287-4b20-a418-ad5d98607a39", "value": 430263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999673, "uuid": "de05d683-642f-4a25-aed6-d91ad96bf57e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999673, "uuid": "aa883014-6f03-4576-b856-8377e97e9d47", "value": "DHL 00794886011.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee4c325-fb2c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685040323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040323, "uuid": "448f9ceb-c06b-4a1f-a46f-f14d03fbd709", "comment": "Malware payload (RedLineStealer)", "value": "b1e5a84e6ef60ceb6a69f8adb8fd445a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040323, "uuid": "335ecbe4-7e34-40d5-8113-e7297cb074fc", "comment": "Malware payload (RedLineStealer)", "value": "ded37aa507056d90841c0d326d36803e70dc2fc8d006246088eb0507f10f125a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040323, "uuid": "081a7b98-b5df-4524-8457-b6d92a39c016", "comment": "Malware payload (RedLineStealer)", "value": "3d57040bf0bd343223aea1c31084880f82d68bf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040323, "uuid": "09fc9499-722c-412e-af19-86735eba6d0d", "comment": "Malware payload (RedLineStealer)", "value": "7fdbf79c302fb43ea4bcc0d0b24680eea4d348d242d16d67cfead5fd187306fb0ed54a5b61d7551197ffbc412259a1b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040323, "uuid": "9cc59e5c-7dbf-49c1-9001-e0cc694a37c7", "value": "T190F41313EDE88132C8B513B059FB03D30B3BBDA08EB493676299A95A5C737D0587176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040323, "uuid": "7da5ecc7-ad77-4a7e-bdd4-e29a7c486b6c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040323, "uuid": "33c4de9f-0327-4fcd-9201-e61653c5bedf", "value": "12288:1MrRy90TIrpHnL3CNKfYZrNI9IXgTe03nwsD1RR/CFNyz3evGkBGInM8tIW+4EnM:cyFtH8RZrG+gTeY17RCF23eukoIM81+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685040323, "uuid": "be82e1e5-f7bb-4912-b43c-2fc2d209e211", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685040323, "uuid": "186d3931-ef24-468d-b5e6-2f7f634064bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040323, "uuid": "8a5e2ae6-8cd7-4d76-ad61-71398e89adb8", "value": "b1e5a84e6ef60ceb6a69f8adb8fd445a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236e7289-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003743, "uuid": "69c03e16-2175-44e7-9766-0b9eb6d96b2d", "comment": "Malware payload (AgentTesla)", "value": "929120e8b5b3a50c2f052740cee77ae7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003743, "uuid": "024583bc-0868-4bd2-8a93-a34e958aec06", "comment": "Malware payload (AgentTesla)", "value": "df4f3740e1876d09c3d045fdcc6a6245576994091fcc7cafe4c6b7fc76428b95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003743, "uuid": "5f390cc7-08c7-4faa-bbc8-688b3b2ae6d6", "comment": "Malware payload (AgentTesla)", "value": "51de793e7710b40b42d57c113e9743dfe50d3708", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003743, "uuid": "8153c02f-0839-44e8-a1dd-8ba74af23c42", "comment": "Malware payload (AgentTesla)", "value": "8385142116a451f4e71a0e4a7d557ab756c1cae716dd3944b7b26a5c81535e274ac218dd10baefc6ceca593a1ca40ebc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003743, "uuid": "87670f88-e78c-4ea7-a719-d8366eaa5d36", "value": "T1C95412006EE2C1A7D69706316E305F12AEF95817FA7989072BC09CA77B47361DE1F362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003743, "uuid": "cf279696-5b16-44dc-acbf-7e0033e7ec7f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003743, "uuid": "380655bd-be56-45b4-9121-afe6ee89708c", "value": "6144:vYa6g2VvzQ27rlp6ToostPDugVt/D2AEBNgx185xfP:vYGQ7QAf6ooYVBD2AErgx1k9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003743, "uuid": "f7ede95b-0b23-42f6-bdd9-47f1cef69c91", "value": 304675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003743, "uuid": "56999ed8-ca28-4ce7-ae44-a972f63fa6f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003743, "uuid": "99f4806b-803f-475a-99c2-5a7c249dff80", "value": "Prima copie.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0331ac-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996725, "uuid": "d561b905-225d-4f5c-a210-55fc2df5c1f8", "comment": "Malware payload", "value": "c1e96a01f18ca2a1589b71778bff5ea2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996725, "uuid": "b554a3bc-9b97-410d-8c92-a744887c28a8", "comment": "Malware payload", "value": "df8727bd47aba5788b588f8d0b61b8dd03b8b8190ca40a42170d7e13f6ff9831", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996725, "uuid": "b22ef51c-b1f5-4b29-be70-dd5c5aa18e2d", "comment": "Malware payload", "value": "60dbeb044c936f05daa25bca8f6a21812883dbea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996725, "uuid": "b308cd8f-a6a4-4079-914a-b373464bf2aa", "comment": "Malware payload", "value": "9cee0f7a7fbf67d4d9c68fb5a1e80da759f37a8a72c31e4e4da5dbea3ecf2527fb8c9b8682b6db47f9f818eb37c4fcc8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996725, "uuid": "38cc4648-fce9-42ca-8683-19ce3a462db3", "value": "T11054B9844B5528A24B5B3E36B73054B5EBAE1E78C2D4598FF46F7261FBCE94CC8C1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996725, "uuid": "cf386ddb-a296-4bee-b8a2-93032ba3d706", "value": "3072:KlfBgwJMPnNcAjc+cXDk8v5cIXy2VjgH9UAV4VNqDRHE4vV2vnJ3Fgyam:KwwJyNmDphZXpWKMHE4tCnJ3Frn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996725, "uuid": "987f0dd4-9ef8-45cb-9761-3dc41af766e0", "value": 280806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996725, "uuid": "780d095f-f981-4fe6-9780-7779f8425c81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996725, "uuid": "2ccf7662-9374-45b0-9eec-c243f3574ab3", "value": "formlesslyMumpe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1333026c-faea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685011876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011876, "uuid": "491411d5-0ff6-4acf-a6a4-b7bb0aba880d", "comment": "Malware payload (Quakbot)", "value": "06cfea33119286aeed8b6319d6ea344c", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011876, "uuid": "1346ee27-e7a1-42fa-ba32-120ae1082574", "comment": "Malware payload (Quakbot)", "value": "e0337ebd14f0c75c94819081268d808982078b9b68151b83ba5c1e8a493f3c0b", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011876, "uuid": "a669b8b5-ee5e-44e1-b05d-a5f46704e532", "comment": "Malware payload (Quakbot)", "value": "3f9e95f9cbbe99e8edadabc3a26aaf0ba1fda74d", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685011876, "uuid": "fe8038f2-3fbd-40a8-955f-0496bd82f2ce", "comment": "Malware payload (Quakbot)", "value": "ad41fe90523e053dfdf1372ee68135b3342c920b17aeb39cb064d70acbbc0142d952b56c57314315b4e89a8948808bf0", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011876, "uuid": "ecb8da3c-9079-467e-af3c-356ac808f714", "value": "T11E832B6FA381133926620235660E5AD2F3B484786B76CB74A45DC2293311D39D7BFAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011876, "uuid": "da6c4668-7b0b-4ea4-a7b4-02bce3a168ac", "value": "1536:Hh1k2UjmwLzl0j+3DbdjI6MGWD+vMdMRM9lDC4:Hh1k2izuybyyo+VqlDC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685011876, "uuid": "5d158002-9fe7-4cfe-af18-8400af5879b2", "value": 81013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685011876, "uuid": "3e068f6b-28e3-4cdd-a000-939f087d6a99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685011876, "uuid": "5f4d8899-aa17-45d3-a8ae-c6948136bf33", "value": "002207799.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50bbc31-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997116, "uuid": "60320de8-52de-4953-94d2-3c39adb5407f", "comment": "Malware payload", "value": "913bfc42fecce2737aae64f89e3e3d91", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997116, "uuid": "4883deac-e3f6-4ed5-86bb-8f2177b4b387", "comment": "Malware payload", "value": "e096b733546e56ba37337a28f61679aa7ab2af317801aa6cccd396e43de9ce2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997116, "uuid": "7d58a11d-1044-4eb6-a7b2-be67ad6f080b", "comment": "Malware payload", "value": "b6c1e470ccff005f8e33e75a03828c80b9e7b25f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997116, "uuid": "d999d178-9a74-47aa-b22e-6da8d4d3a5e2", "comment": "Malware payload", "value": "5706f5d28552e4cc92c05101446281f86fc60bd18896d3b44fc5ce491e20ac10bde08909c86b00349853f4ca7fb42c79", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997116, "uuid": "4ff91f24-d7fe-41d4-a067-e2d3759004c2", "value": "T1126477844B1119B64B5B7E227730A4B5EBBE1E74C2C8598BF45F7261FBDE98CC8C1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997116, "uuid": "c3b9722d-68b1-4b8a-b651-684bdbf0a02d", "value": "6144:vaAVmPGx6xhfOUFQTkLgvmM8bLcvKSNjeK9XuEj3ZGDBVWqxC/TyPW3yii/43j6p:vff0Ew5m6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997116, "uuid": "fc355346-0adf-4f7c-aa06-c010d4488f68", "value": 336838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997116, "uuid": "ca22c38f-8a70-4eef-9cdb-c19dbcfdb803", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997116, "uuid": "11737a11-c52b-4c83-b801-7d16b0afc5f1", "value": "muckwormFenagle.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92dbfd65-fb15-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685030559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030559, "uuid": "a71c2bc8-7a52-4295-b7f7-8baa99a66108", "comment": "Malware payload", "value": "78d170235bb001ce8e24d4a3a5b0be6f", "object_relation": "md5", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030559, "uuid": "85aad96e-451d-4a6d-9112-72dd970ea93b", "comment": "Malware payload", "value": "e1a85757d9a5750078f646461f6bd61dede7236bab90451321ea9b043dcd20f0", "object_relation": "sha256", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030559, "uuid": "ef0a29cc-cd3a-48b8-837a-4f8479e67165", "comment": "Malware payload", "value": "e8c9cca3cdcfa0d230a8e1db102ce1cd2ba3c825", "object_relation": "sha1", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685030559, "uuid": "91d986c2-1c89-41b2-94d7-c52dd349acc8", "comment": "Malware payload", "value": "74eabf819818d6b19b2ebd2c809e94add2f5af4ffa95b673bc86b261a20e3d8f298c725af63b9ee5b66934bbf712abcd", "object_relation": "sha3-384", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030559, "uuid": "a20dfd98-e801-4611-9f91-ce43ab08faf8", "value": "T1C33364B1B38A0A53DD1EE17982AAC9793432CCFCA18EF12D14DDA0FABCDC555C605AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030559, "uuid": "93b08a67-2d84-4261-aae7-634189c9f4bd", "value": "1536:rCy1AOMMsZHJ3P63pq555N1bEbyu3POMQImcn9:6OMMP3pEXN1sNZn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685030559, "uuid": "b29795c8-25ee-4fca-9a51-7dd49e4f2d25", "value": 53183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685030559, "uuid": "a2b07326-8b3f-49ff-ab82-9264e790dd28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685030559, "uuid": "bbc082af-b535-4ee4-b6a0-92a464f95b69", "value": "Invoice-DocuSign-May25-2023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ec7e47-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997110, "uuid": "680f3853-0ba4-460e-94be-44e11ff210a8", "comment": "Malware payload", "value": "2b1690fdfe1123aebe64a815d6d8a4be", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997110, "uuid": "7a3281b9-962e-4ab1-aa7d-1a5bae889710", "comment": "Malware payload", "value": "e1e7d81b5b4f1ecafc0400d24177c98069094675a4a5816e4d2d3ff717eabc78", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997110, "uuid": "897e9277-d550-4111-9096-086bb9dd246a", "comment": "Malware payload", "value": "f24dbb9bc2fef66c108a0f827cebb2e03de5596d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997110, "uuid": "e3bbeaa5-afe3-4205-a3f8-2ad69695cbce", "comment": "Malware payload", "value": "379e84aa3538893bc64c0c62db47e87a3566043ef753720a6756055d9d2c6867ec27df9945d83366f45e192ac9b3eca4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997110, "uuid": "d0f19c7b-f6e8-4a66-98aa-2ef6881cf5c6", "value": "T13D549680471528A64B4B7F36A730A4A5EBBE0E78C2D8598BF45F7251FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997110, "uuid": "993c5e85-594c-49e3-9ba6-b39ed00db041", "value": "6144:En9tX33/PsrHwuAIGRTtKhXgOX8sa7ZQeIy4LN15Gt:x+7Z1Ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997110, "uuid": "6c827964-0e4f-49a4-9796-a7f1e66cac63", "value": 302043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997110, "uuid": "497401d2-6cab-4bfb-b85a-0bb9383c7c43", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997110, "uuid": "1bbf7073-c929-4dd2-83a3-039dedfafcb6", "value": "multistory.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88b49a4-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997121, "uuid": "d23f1637-4b59-45f6-a6e9-92addd7dbcf5", "comment": "Malware payload", "value": "173f19d51937b4a5bd0b3c7803131a2b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997121, "uuid": "85e92d3f-69b0-4496-bb50-354e35cf9118", "comment": "Malware payload", "value": "e207f0ee5ec9e25ca47fa049f4b883c2df6e17c0e370af32bfee547179e29c22", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997121, "uuid": "c27889e8-d014-41f0-ae29-c5dbb2881a68", "comment": "Malware payload", "value": "9b88060feba2fecb9a30c15f640878fe6250d92f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997121, "uuid": "52977aa9-8a40-4894-b587-954c6a017929", "comment": "Malware payload", "value": "efa2ace1c71f472790d9e22f06c56e0d44998025f675e44713c5917071a7b71330957dab233efcf19ad71e8fa0f31597", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997121, "uuid": "1a9cee83-23d8-4003-bce1-23175e8bacb8", "value": "T1995497844B1124B24B5B7E26B73094B5EBBE1E75C2C8568BF45F3260FBDE98CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997121, "uuid": "896506a3-622a-47ee-8859-76ebcdf849c8", "value": "3072:YelzxQDgOdFYflgBUT/5xMTaDiVb3rSzYGx7UmxNHElqP:YexQDgZflLxKTaDTcGpUmLHaqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997121, "uuid": "7130b8ab-4b50-458d-8f2e-d653dacbe289", "value": 286520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997121, "uuid": "ce1ab195-2167-48ff-a3eb-f1ce91c28239", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997121, "uuid": "48dfcf2f-ce20-437d-b41b-5262a6fd62a7", "value": "muchnessGateway.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9303e000-fb0f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685027982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027982, "uuid": "45ffc703-5521-4a15-a1cd-e01ba94a7bf1", "comment": "Malware payload (Loki)", "value": "5c881956f71ffce1754ff58daf1e6fe2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027982, "uuid": "3bcd78cd-e9c8-48b5-a842-150ad5cf4b57", "comment": "Malware payload (Loki)", "value": "e28c106fc6a9feec5146a643c603d37b4f35dfb222d72fc663a049b11aaab43b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027982, "uuid": "d3b2e7e4-3c92-4ea1-a359-85463031b8ec", "comment": "Malware payload (Loki)", "value": "65a42d6e271260c74cb95ced4ccc68d0c6f38929", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027982, "uuid": "549a6aba-a964-4ef7-bbe5-7444356ffec3", "comment": "Malware payload (Loki)", "value": "5f7e2a48917e4438b0b7012c4798f91f33208f1dbce5f48da7168ac45f89cd322364229be0cb771ae8d2eb511530f564", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027982, "uuid": "46e5108c-8691-404e-bbe1-db896c2ee40b", "value": "T1D675E00394049F8BD11983F87E633D981F0E7F1AA5C429DB355E3F4B6B32A66598B24C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027982, "uuid": "3db71bda-539e-429f-9b9f-9a59cfffdd3e", "value": "49152:NLKjQmmQ30MQmmQ30kDp+MX5+MXcjTuVsiR1:BUpmQkMpmQkPE0EcjiR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685027982, "uuid": "262345e2-a0d2-446d-a1ae-4007630af086", "value": 1657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685027982, "uuid": "7b48a7b3-0e4b-4af5-a2ac-7563416d29e9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027982, "uuid": "3d56bb44-c0fd-402e-b6b5-0ddc6a67ae7a", "value": "INVOICES pfi 705, pfi 704, pfi 706.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7de20af-faf3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685015991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015991, "uuid": "f3df2f27-78f4-43d7-9305-8c7b899e85b0", "comment": "Malware payload (Quakbot)", "value": "aa48294b1898666b75912aa5fb4183a7", "object_relation": "md5", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015991, "uuid": "4e8c413a-11db-4c45-ba2a-d8e653af3300", "comment": "Malware payload (Quakbot)", "value": "e2d32069b0df4c0dad9c76ce13d7b2fdf79cf4ab05cb5706670d8a923f2dce45", "object_relation": "sha256", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015991, "uuid": "b91bfbfb-cd0e-457d-85f7-db835a710c1d", "comment": "Malware payload (Quakbot)", "value": "8f35cfb5ec89af54b86140f9d7b4f8ed6de6fa7e", "object_relation": "sha1", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685015991, "uuid": "572e931c-4e31-4676-90b9-d2002f1f2f81", "comment": "Malware payload (Quakbot)", "value": "854cb38b60e815114070a489b66d8f6c0efe7cb68bd0c8e9c658cf69be6cef46529f8a5485f57e89b6f5b021400da1b7", "object_relation": "sha3-384", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015991, "uuid": "e96f6f79-1c07-4768-a282-6533882b998e", "value": "T10BA3CF58F667EC9CF8D1B7B290B474F8865E7963CFD51CE30E500E6AE00246AC69A1D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015991, "uuid": "f7d4b2a6-6647-419e-8150-0193d56f7529", "value": "3072:VpRF1uGbXaY8P3QYYYYYYYYYYYYYYYYYYYYYYYYYYYYYkqPcOvL9wpc:VR1uGbXaYs3QYYYYYYYYYYYYYYYYYYYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685015991, "uuid": "9e295d84-e282-42fe-9e39-4f21f8241acd", "value": 106772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685015991, "uuid": "292d435c-1bd3-48ec-b2a6-185ea05d4db3", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685015991, "uuid": "f357f031-c7d5-4187-be5b-d15b7da09a7a", "value": "me.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9979dee1-fa94-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1684975165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975165, "uuid": "3c02f073-ef66-41d2-aa37-059c12c4067c", "comment": "Malware payload (CoinMiner)", "value": "728954416360eb2b93a534187f1c234e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975165, "uuid": "4a67603a-a110-462c-b433-7f2fa0b7f5d5", "comment": "Malware payload (CoinMiner)", "value": "e2d5e72fb2cd42fd867f8a3f20195d09f6d43640bceb2fa2edb35e7c8a605ba4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975165, "uuid": "5a2da33b-aa6f-4188-836e-fe804fb56725", "comment": "Malware payload (CoinMiner)", "value": "5d5ee0d3b1d97649b549f34809bbe89e52a216fe", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684975165, "uuid": "64bd8953-dc51-42aa-99eb-b9d916b4c1a7", "comment": "Malware payload (CoinMiner)", "value": "e729dfb211323909ac63257d7f6a29785d16383d25c503bece0ea05b9eabebf4004e55e3d59ab4966ea71ab2d960a93f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975165, "uuid": "ae58cfb9-8799-45ce-9b0a-7eee0d360333", "value": "T1EEC6D0E715C1BEADC4BAD4FD8652F93F8A8F78368516A4A68251F775CA53C00B324F08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975165, "uuid": "092f9f0b-b39d-4401-bdbc-efe18ca6128b", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975165, "uuid": "8bb75cb0-abdc-49ef-aefd-5cb4b2e0ec37", "value": "196608:fJ5vMvAy5l2hP2l1Ts2zzKAfucvsaH+Rl1pLplKU2LcM+AV:R5035lJ7s9AfDF+j+U2LN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684975165, "uuid": "62e609db-4023-4958-977e-7e18ea249162", "value": 11793976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684975165, "uuid": "0080d838-814b-4027-afd3-b19783c5dd89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684975165, "uuid": "af8e1ff9-7f4f-455b-9493-78469f4fb9f3", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc94d15a-fa9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684979975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684979975, "uuid": "b8998192-8baa-47c1-a5a1-6b95583a5b42", "comment": "Malware payload (Formbook)", "value": "dab7cc983ca9542bd96062d675128a57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684979975, "uuid": "7211f427-2f5c-4caf-b967-7fb3f3267976", "comment": "Malware payload (Formbook)", "value": "e399bdc24cb76e8ebdfef7bba94b18031fe0b4fd3664fcad763e77b1e4b2da86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684979975, "uuid": "3392a070-8ae0-4646-817f-317ee723c70c", "comment": "Malware payload (Formbook)", "value": "13d832f3e6a884dfee1b05c4fe9ab7f754c8607c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684979975, "uuid": "dbea61e0-5c46-41c0-a462-5f0d3f2d465a", "comment": "Malware payload (Formbook)", "value": "16cbde1d56b9a481a401dfdef5b149ca4bb262873537f57bd22f16d2fb09ab825aa8b70f6a7a71d80a12a235a794f3b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684979975, "uuid": "5e5d3e05-08eb-40ae-9f21-124a156907e6", "value": "T18105AE22B2F18437C16F25B99C4BA7D4EC787E512F78A9052FE42D1C9F393A27825187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684979975, "uuid": "67a971b7-7b95-406e-b20e-73425bdb7e62", "value": "3f78a31aa8b8c7d7b7b6e3ee8e949c19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684979975, "uuid": "9bdf9386-83de-4a67-9c0b-7ab9f65bfe12", "value": "12288:29Id6OrPwqTQAwBTTvY0Z3l9+P/bnqvPPOmWnADUcHjNEU:29XyTFwtTpZ1E32POM7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684979975, "uuid": "d72ee4f7-4dbb-4553-bdb6-2d5aa1fc5905", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684979975, "uuid": "14451541-1739-46b7-8b37-9c6e4464ae1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684979975, "uuid": "1064c657-199f-4a26-809b-82e40c93f08f", "value": "Siparis onayi proforma Fatura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9015e314-fb0f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685027977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027977, "uuid": "6786a952-a7f2-4086-8b63-c8240734fa90", "comment": "Malware payload", "value": "ec7a27269006088c499ef0110b857e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027977, "uuid": "6eb55982-a087-4d83-a70e-9b704aab7298", "comment": "Malware payload", "value": "e3c32cdbed86c277fe0c1577e577bd2d2b3fec2f91826e57b387cb96f48293c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027977, "uuid": "a9d7608d-3545-4914-a5e7-8bd358e42edf", "comment": "Malware payload", "value": "b5cd0567b81f63ddded7bf1f3e6bb0c324cdf82f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027977, "uuid": "297a6400-419c-447f-8add-ae8b28742c9d", "comment": "Malware payload", "value": "0f2c26631ca7c6e8966028e8248e606ce8c4e64946376ebfa6751ec9f2a52b2e6e001f45726611a3b4ef4c102f4c5ff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027977, "uuid": "1ed0f3db-0005-4bd7-b443-56eb7aea82e6", "value": "T1B456237321CA22D4E5E18D344637FD59B1FA166E8B80D8789CC2AEC729129F5E713B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027977, "uuid": "014e10ad-4561-4e9d-889b-3f335783f44a", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027977, "uuid": "41aceb82-54de-4828-b7b1-9e4bc60aaa05", "value": "98304:OKeb41herumoa987/Po7YgFVP9ZbIGbAeJ8rF5GvuJLfhPE0aEKWvQO0g6egj1:Okgu/Kp7YgLlZ5tqHGvulhPtKsQO0g3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685027977, "uuid": "a50aa471-3a53-443f-b161-048a994084e9", "value": 6324736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685027977, "uuid": "c826f4a1-25f8-400a-8652-d702bbb7571a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027977, "uuid": "2ba1cf97-5ee1-4d04-a72a-43c40acd62d6", "value": "ec7a27269006088c499ef0110b857e01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654d4a06-fb35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1685044226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685044226, "uuid": "cd634c9b-79da-4a56-8a1d-d91441793600", "comment": "Malware payload (njrat)", "value": "a1d6930b0054f79d8e2bcef0700fc285", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685044226, "uuid": "7d7bae62-1a53-4423-a944-cbdb51ddc593", "comment": "Malware payload (njrat)", "value": "e3c7d19d22f37f8f290c9fca7f49c0e807abbe8a0b91b8da2c2bc5f762973df5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685044226, "uuid": "1efceeb0-36c5-4deb-8799-c1954b3cca32", "comment": "Malware payload (njrat)", "value": "c33e27a85009d1b2ede63e8d7c4fa407b75391ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685044226, "uuid": "f3cc3866-19ba-41e0-bd7f-eaf16f207797", "comment": "Malware payload (njrat)", "value": "46933ac52307ae6c38e074cfe0ef125e93d14936c0a274b970992a0a55dd453c1a9a28277b19167f4cfcbab4f9340342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685044226, "uuid": "c8dc1e44-b83b-40d9-aa20-d1028df108bf", "value": "T15FE22BADFBE64465C2BC0AB60571950113B4E043E622F77D4DCB24E62B2B7D84B58DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685044226, "uuid": "5fc95c8b-8319-4fb6-82d5-17920280f1af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685044226, "uuid": "a7da166d-2946-4637-9c46-e12341ff8041", "value": "768:3hYRtljZ/nizxNO15eLUfEuXTv6rQmIDUu0ti6fQj:+LjOZlurAQVkBQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685044226, "uuid": "a24df0a8-d731-4e6e-b8c1-5fdcb581fe75", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685044226, "uuid": "1cbb7bf5-01df-4062-928c-733549084ff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685044226, "uuid": "6f7cd265-40ff-44dc-a173-0dc10ad03ea2", "value": "a1d6930b0054f79d8e2bcef0700fc285.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe18170-fb04-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685023226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685023226, "uuid": "7386ef86-1f55-4f52-8171-55f7fd665389", "comment": "Malware payload (RedLineStealer)", "value": "3d8a602c06bc541942c1d006728b8c7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685023226, "uuid": "9257c057-7b33-4c8c-a2f2-622be8e47183", "comment": "Malware payload (RedLineStealer)", "value": "e3e8c24fbace8f40a44a3e6c5e533571da74cc7588d592f08c3ca2ed46c27c48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685023226, "uuid": "a3074a17-e47c-4c35-8173-855c3ea8786b", "comment": "Malware payload (RedLineStealer)", "value": "a61cb4bdfbd4fac3d391bc68173c5bf06df22053", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685023226, "uuid": "a0e64e83-c56a-4c5f-8eb4-aee4586a08c2", "comment": "Malware payload (RedLineStealer)", "value": "228a98bd670b4f3198c8a5a553ca524eb92bb9482c8f6062a3392eb323d605aaee70b9aafa0697e480b7ffbfe6b734c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685023226, "uuid": "b11e3e58-7a02-42c1-b090-1f3af6a189ff", "value": "T128352393B9E48572D4B66B30D5FA02D31F397DF28CA486AB2B456A4F0C721C59632337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685023226, "uuid": "09bd9fec-0319-4e30-a9dd-bf370afb65f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685023226, "uuid": "da5557a3-9ea4-4a03-a327-81cc07bdeaaf", "value": "24576:iyigIAvuid4iNm8xjbXYAHKIIBWymy0hfC94K:Ji6t0yX5ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685023226, "uuid": "2e400327-de2b-4add-87f9-6e1b091fa61f", "value": 1071104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685023226, "uuid": "930b7c8f-e604-482d-a5ad-a45d566d7f87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685023226, "uuid": "9956c9db-d832-48dd-ba18-331077fc0038", "value": "3d8a602c06bc541942c1d006728b8c7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb66daa-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685003757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003757, "uuid": "fdbd6b86-44a9-4729-9f17-50e63149e867", "comment": "Malware payload (Formbook)", "value": "ff38c2eabbbf197de06120ef04907178", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003757, "uuid": "aabf404f-acac-467b-b1a3-88b041cb28e7", "comment": "Malware payload (Formbook)", "value": "e42e4b8dc9f8f8c46930a7cee0b557309458c88a22f68ebc43b344b33afb0157", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003757, "uuid": "85c332b7-b534-4365-93ef-ae5b6ead1828", "comment": "Malware payload (Formbook)", "value": "5d95199804d071181114c8d20fc70c3bb6e74714", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003757, "uuid": "a931c4ee-5fd4-4218-9a12-6f45d03ce787", "comment": "Malware payload (Formbook)", "value": "4f74b1b5ef947c4cbab2fe83d43a423931663e401567b895afef39feda7efeebbdf7a9ff777dfb76950e9b44d565dca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003757, "uuid": "054fa049-fdf6-4dbd-b26c-824efbae6c57", "value": "T19134121896A0D96BD46307B35D3735BB67B3EB2121B88F4F5FA04F4CB853241A85D322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003757, "uuid": "17e48173-8702-4010-b5a2-0bf204398c35", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003757, "uuid": "13f53f21-87d9-47eb-a307-ae93dc0ab0e3", "value": "3072:XfY/TU9fE9PEtuPbt/EU9RBgvvq2q2ISkBYGRIwUK8EloOtLimcH+kxm0/O5HbZ6:PYa6ZtzUvq2nIlRIwTlouXcFGAiGy5RM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003757, "uuid": "e91bf950-3957-4876-ba24-c658a2c7e2d2", "value": 242074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003757, "uuid": "ff1c02d0-8512-49ba-8f8e-87597f7339cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003757, "uuid": "9dae46e7-5b8a-4cfe-8a1b-aefb48fed527", "value": "S\u0130PAR\u0130\u015e FORMU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e6c9ed-fb3d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685047529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685047529, "uuid": "99544510-d9d1-496e-ac9c-a8d82cab0b2d", "comment": "Malware payload (Amadey)", "value": "292400d6fb7c1ce001d1998be1adbafa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685047529, "uuid": "9d0a4e8e-00c3-428a-a9d5-2c58b934f5fe", "comment": "Malware payload (Amadey)", "value": "e436d2b42fa45b65f26efedbadc22360fa1b18ab75ed4d7b41c7a0c6abfe11ac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685047529, "uuid": "425cb9fd-a635-47f5-96cf-db00c9c75c89", "comment": "Malware payload (Amadey)", "value": "f6c15338eb51e1052ce40390c216151e5ba4c5a7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685047529, "uuid": "200c8a92-d83d-4c42-8827-e0eb1fc5e763", "comment": "Malware payload (Amadey)", "value": "f9809b82bbf57b7768ec2a2d0b8968ff219cb365a9d478bc8190c1bd7240f174011d1625bfd6631860d65c1fc01020c5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685047529, "uuid": "f5ffca91-4468-40dc-9241-7b5a43ca0020", "value": "T19EF42352F6DC8472D4B91BB05DF707A30B35BC909D7082AF2682AE5D18733D4A875B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685047529, "uuid": "fdf3bdae-8ced-4c56-a27f-21174966ad66", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685047529, "uuid": "8ebd08a5-5311-4df1-bf26-95a54991ac63", "value": "12288:eMrHy90givMl772EHin0DesHTCwu2Y99VWw2QhK9YBtWSkBh+nMMtIW+8EWcO:Ry7i8fY0ayTq4U7dkn+MM1+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685047529, "uuid": "c166fb41-b864-4a65-9be1-c603b1307f8c", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685047529, "uuid": "e71264ab-2ae7-49fc-b41b-8bd60a2184a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685047529, "uuid": "fe436219-3934-413c-9d46-503839bbda5f", "value": "292400d6fb7c1ce001d1998be1adbafa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1159cfd6-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685003713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003713, "uuid": "f5a9635d-b902-4d23-b1dc-8a0d308a1d59", "comment": "Malware payload (Formbook)", "value": "836333136888ae073eabb66cf8252dea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003713, "uuid": "1301d409-d3f8-42aa-aec6-e15fc6f9a405", "comment": "Malware payload (Formbook)", "value": "e4b2392f7f21a26a15a063819842743f1fb6b055910cf9e1fd0e50d6187c04e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003713, "uuid": "41a11235-044b-4ff7-8ce0-d339aba0ec36", "comment": "Malware payload (Formbook)", "value": "c842fc6fa27e0b36594f24527154793ed85fa472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003713, "uuid": "6e1b72e9-a54d-4c71-90e7-fe51f52e4e32", "comment": "Malware payload (Formbook)", "value": "bcf22d4b2535441e7a429f9f058a727ce29d4e13e4393ae38e3f5ed2241e81d32548bbd2b7fa5f321e721ddeb4d238a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003713, "uuid": "90a6e238-1aec-4d3b-acec-fdfdf8eb95dd", "value": "T1AC0422218D8515BFC09A4CF3B63638F08D26EF1E5931E60663FF5192E45C1DA7A38B98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003713, "uuid": "e960a90d-1036-4a91-b968-a1a5b8caddb3", "value": "3072:eEV0+oiarb3MzQHS6JtNv5yJhtC2Q1GghCaSwN4JnYHZ/qfyBuodRuHYRcYHneAc:9Fkrb3bS6JPvoHsPcwbuyvRdWYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003713, "uuid": "88eacd09-c7fc-4fdd-8442-09babc68a691", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003713, "uuid": "2d8c361c-4762-451a-ace1-339efb68cdb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003713, "uuid": "04225327-62b6-412a-af33-c47c2ae992b2", "value": "e4b2392f7f21a26a15a063819842743f1fb6b055910cf9e1fd0e50d6187c04e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a4882a-faca-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998110, "uuid": "7512a34e-ae6a-42f5-a2e2-128abfd447e0", "comment": "Malware payload", "value": "0adb115c43a37a249dfc18f89c2248a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998110, "uuid": "07e4a41a-e6af-4f9e-bdfd-b463f4f893e1", "comment": "Malware payload", "value": "e4e3da17fdd6aa508f5219e49605f6a616c2a183583da2473d35bdf38a3e2d86", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998110, "uuid": "50d428c7-a158-4df5-bda3-50c0fb4652d9", "comment": "Malware payload", "value": "544b2f6d97cc02a8e5a8abd84aee8fb36f2de3a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998110, "uuid": "b2bf6df2-671d-4439-93cb-c70d5f874fbb", "comment": "Malware payload", "value": "0a46e9184c381cb3caecf49cee01d8753736f6a105be9fbd550ccb6871a0c2458fc131cc73bce13dd7652edc479b147c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998110, "uuid": "b5785257-a208-44b6-bb5c-32ac4d8cbfb7", "value": "T104649784475129B64B5B6F227730A4A5EBBE1E74C2C8558BF46F3261FBDF98CC8C1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998110, "uuid": "4ff8b027-e4b8-4933-8ae3-11888b9e4625", "value": "3072:ZXGeDT3Au32ZFVM99AcRo+3lLAmkPk7/2heyXxUXWv6ThLs:ZXGCrj32ZFVe9Aejl0zrxUXWghY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998110, "uuid": "ce104ba5-181f-41bc-a5e9-383a9b60b37a", "value": 315772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998110, "uuid": "215b473c-500b-438a-94b9-bdb07a9887e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998110, "uuid": "18f214e7-9411-4581-b7c5-8ae62f85a81e", "value": "Unschool.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f191d027-fafe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685020839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020839, "uuid": "84b0f53d-75b5-4d0d-8100-f3f186b51018", "comment": "Malware payload (RemcosRAT)", "value": "72eedd184b2467692ddc850ae10edc18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020839, "uuid": "d9d3e690-c5a3-42a5-a4c4-253764f4590c", "comment": "Malware payload (RemcosRAT)", "value": "e5349a064403917e3f1c3aa1cb2f18e4a09477242eb9f7bee5a80c724b1a49ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020839, "uuid": "fd0b4576-bb4c-496a-b9a1-d15b010b1443", "comment": "Malware payload (RemcosRAT)", "value": "82380f52d8318937317fcaacdacf4042f22d4532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020839, "uuid": "06461f90-33a6-4462-9949-aa1ac8c3f541", "comment": "Malware payload (RemcosRAT)", "value": "11f05805cf695273684b7a5ef180666f61ed69370eefedd8afb87b8658de63d0cac0ec6b1b45a010445622bd79cad618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020839, "uuid": "bb7500d0-8915-4896-9018-75423c6c4c05", "value": "T1CF2523D0A9455704E6A717344065EAF007BBDFAE3AB6E77B2C83E5D5F602B46008372B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020839, "uuid": "d1e94125-b301-4b92-80ab-3783a5362b46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020839, "uuid": "4fb9ed70-233e-463d-b47b-41533d1a2f6a", "value": "24576:XETmIt9BEP8Ffzm97uGM6UPymAcAAdMW7qsEUEFkbC2dAT:UTbBe8F787uGqKwdJqsEFkbrdAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020839, "uuid": "b6d08ce4-6f22-4bfb-9b40-f536e1aa86ec", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020839, "uuid": "1a16f17e-f986-439b-85d6-b95767b5ed58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020839, "uuid": "706cfad8-f6fa-4751-809c-ba8d2dd8d7a5", "value": "SADR LOGIS RFQ 8548097 2013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167faf3c-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685003722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003722, "uuid": "89bf686e-63fe-422f-8771-ac72051d09e8", "comment": "Malware payload (Formbook)", "value": "198914f04413915d3d58a5f34b405891", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003722, "uuid": "6616707d-9ae1-4a29-865d-3ca891313cb0", "comment": "Malware payload (Formbook)", "value": "e5a75ed3a164d322279af143c007028a5e94a52c11e4fa674c37a48c79237d27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003722, "uuid": "f7164831-a879-43c2-823e-8e3f3d4535ad", "comment": "Malware payload (Formbook)", "value": "abcdf8eac1b0e93b01d6c5a737f32ef4f584b533", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003722, "uuid": "bf9ab6d1-3205-447b-b74f-0c146d5ba9ee", "comment": "Malware payload (Formbook)", "value": "1fc3340dedacf6d092a16812fc7fadf291391e73f5526834fbade30777ca2f6297a852e1e9b8fd5778c51e4330e2ddad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003722, "uuid": "596f8656-2448-4c07-91cf-d6bdd7e7909a", "value": "T178F423E4288A47A9DAB7073004167AF0177F8B8A7977E7A74D47B6C9FE10F454A4A303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003722, "uuid": "e2d71eb6-2dd6-46d0-bba1-237300025e31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003722, "uuid": "eb813e63-eedb-4c5a-a784-45109f35f6b2", "value": "12288:qaWIm6lVvtzZBEP85HTM49TRAGb+Bw4jVfwuTgMgWd17kJRSg7JTFb4nhMX5:zTmIt9BEP8VM7BTZwuBVg7JTFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003722, "uuid": "d8b7f975-b0c0-435c-bdcc-bfe111ec846f", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003722, "uuid": "7d7182d1-f242-49cf-b7ff-ca075ac864f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003722, "uuid": "c45518e5-61f4-46c8-b71c-4abf2971cf1f", "value": "H.K cupbord.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81ce549-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999671, "uuid": "0a99ac0f-10c2-484b-9f3a-2282d8a3ae2c", "comment": "Malware payload", "value": "43b51274e81e4f50e6f942b07e6a5438", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999671, "uuid": "3207c637-cd27-46df-a6d2-6b267191e34d", "comment": "Malware payload", "value": "e6c47a00c736106d662010c0afdf3626c9669b7fc078f680da4a700c447a8f55", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999671, "uuid": "2ff419b4-ba18-4836-810b-34c0fddb9847", "comment": "Malware payload", "value": "f6aba93cfd907e1b020e4a8f3fd042b8e0df3e20", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999671, "uuid": "d5ad57d3-76d7-4cac-b61d-6742245f0d0e", "comment": "Malware payload", "value": "e46aac0b1ffdcda9f4ac8c2fe695e81eee290567d40f5c31b595d886b556455f6061afb8085c051c08b5b83c9ee8a36a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999671, "uuid": "00e2aa4b-e806-4ded-a678-709cca09444f", "value": "T1A844A7844B1128A64B4B6F36A734A4B5EBBE1EB8C2C4558BF45F7250FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999671, "uuid": "b5bf9a0d-a975-4107-863c-77e74f2bde6a", "value": "3072:CY58FFa89BACX0NxvX3WVGQKmAYEpyIj3tGZU/lXOp+ZsoXZFQc:n6l/ACYX3rQKmHELy+ZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999671, "uuid": "c975213d-fe6a-4c7e-b2e6-4dfff6f3f1df", "value": 262909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999671, "uuid": "45cbd590-30ab-4fed-85f3-3bfc9a82a230", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999671, "uuid": "7a9a7e32-5c76-4253-885b-86016cbe21ab", "value": "countersynodPer.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9e7b07-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996778, "uuid": "e91092e0-cbda-4c25-ad54-3946228721f4", "comment": "Malware payload", "value": "d2d37d7df87c19c7a73fac4e950ca1ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996778, "uuid": "ee62f7da-2c61-4855-b9a0-b680af94d388", "comment": "Malware payload", "value": "e79c9db6cb6f57116667f15f89ef60b1d4ab817eb38b0f7e821d12d5124d368c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996778, "uuid": "861d0921-af98-4b93-ba8a-734a52199495", "comment": "Malware payload", "value": "e765c7e753a62e6fb3f39d07622bd8041d961727", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996778, "uuid": "5430edf9-8ade-4a8f-8f07-88ae5dae15c5", "comment": "Malware payload", "value": "7592dc7c2c866b85689d31a96d7343a8d8cb057c2d280dfb4610e2f0b19ec3ac77324f3076da9a9277cb5712135055bb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996778, "uuid": "61476c22-ba1f-4c49-99a4-6c31a7434d2e", "value": "T1AF54C884471528B24B5B2F26A73094B5EB7E1EB8C2D8598BF45F7250FBDF98CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996778, "uuid": "2b629b4e-3855-4877-8cd8-14afcb0808c6", "value": "6144:l+gI+a5J/uR2DJA6gMH6v/30WCkQDHojey8K:lbAJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996778, "uuid": "29fe88d5-3fa3-4709-b2a0-8baf0cc2ee17", "value": 304254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996778, "uuid": "3529a90b-263b-4efc-ba81-23810e0a6ed3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996778, "uuid": "f5d8e1f8-d032-473c-826a-892d5d69c596", "value": "hattize.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed4c88d-fae5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685009749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009749, "uuid": "ac2cf064-884a-4864-9731-b4106150a43a", "comment": "Malware payload (RedLineStealer)", "value": "746e6cd8277554d00974e8910d95c19f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009749, "uuid": "b32eae3a-64f3-4f89-b401-9c33ad9c76d9", "comment": "Malware payload (RedLineStealer)", "value": "e82e96c5f607c83658aa4962598daae072550f1309847bbe6b87146546ac2069", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009749, "uuid": "55c53b80-d409-4dbd-bf63-54feff073b90", "comment": "Malware payload (RedLineStealer)", "value": "55b0920319c6c31bd4dbca05366b381bdb30b6c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685009749, "uuid": "fbfc53c5-013b-4f24-93b8-1fdc555cafb4", "comment": "Malware payload (RedLineStealer)", "value": "35cfcedde08d9aa48393fa87f4aeb66ab21d6f627d6665c8d6ac43c605521ff7519b13aa3ab2b3d8d82b6838d273a63b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009749, "uuid": "93eac890-d057-4bcf-a945-611dea0d91a6", "value": "T1CA352316ABC81032ECA76BB158F702930E337DA1197443AFAB4565C90DB33C955B673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009749, "uuid": "b785b4a0-1105-4c95-ad4f-b04ccf951c62", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009749, "uuid": "4479d91b-70da-4865-9f3d-81bfc500e8e1", "value": "12288:4Mrwy90DS8SDovQjT8m8OIlIlTT8aR6xfVAcSBl0d1gUBYMNBLpWygliZtHjdh5k:IyRlmQf3xwxfVtSBQ1nGMP5Hq0mfY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685009749, "uuid": "27ac8ed1-c182-45b4-aab8-3ec323c8603f", "value": 1073664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685009749, "uuid": "c8030a76-6226-4287-a3b2-339b2c2dc8f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685009749, "uuid": "a48e02f8-a00d-43f2-8222-22547f090db4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9bbc28-fb17-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685031218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031218, "uuid": "0a4a3173-5e54-42f3-9495-9bcf12ba026c", "comment": "Malware payload (RemcosRAT)", "value": "9dae5ebee8904addaff745946ade5d9c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031218, "uuid": "4cc7ad7e-5555-4be1-8895-9253b217c899", "comment": "Malware payload (RemcosRAT)", "value": "e849e8325298ed088defa4ce4444202ad386dba396a92bde038a39d05e9ffe8e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031218, "uuid": "366450bf-a7b2-4647-ac24-0fb1e503564b", "comment": "Malware payload (RemcosRAT)", "value": "a5dbaf47696a7e51ace1b608dc180d798cdc6762", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031218, "uuid": "13f4df3d-b1bd-49e3-b6d3-c4f1aec4abb9", "comment": "Malware payload (RemcosRAT)", "value": "49c5487bea2a7477f917321f8d8ad29a9fecc5d484d36b101bd63d0708355eaf14a206167ceeb80287fb34fb308ed242", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031218, "uuid": "14c45f6b-0f41-409d-9de0-72de3eb3ddfa", "value": "T10916C0321BA3FCFFDBAD2878E4C12A510CC97CF3611956A4BEC509AB25F475498B48B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031218, "uuid": "b7b372b5-21b0-40ee-8931-01ef67a18511", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031218, "uuid": "71e0896c-5ab0-48cf-9e4d-f1c303f238a3", "value": "49152:G2H3OdT2gMT1RVdKwLB9rz0EnMjzb5k2vqLCY2bXIhGCjkXwGIppKYab53uiNGAt:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685031218, "uuid": "7c948278-d960-428e-ade4-ca66cd3e07cd", "value": 4040704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685031218, "uuid": "a69a97bc-525c-454e-be9e-510fba0bdbac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031218, "uuid": "ae32f2b2-5571-4c68-82fb-e8c902a85325", "value": "04273299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab48ce42-fb21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685035754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685035754, "uuid": "22d36f0f-64d9-4718-8239-034c23ec15f5", "comment": "Malware payload (RedLineStealer)", "value": "a23fdb5f7f0ec141bc19a1e3005951b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685035754, "uuid": "7fc9ef9d-8d58-4d4d-a5e7-d16800bccf02", "comment": "Malware payload (RedLineStealer)", "value": "e85f312207a23df0738e05ddd8fb2b46f5c5d4d3fd98979aab086077f5b96be7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685035754, "uuid": "896e5ecb-47b5-4057-bf48-d9552d8ccd50", "comment": "Malware payload (RedLineStealer)", "value": "e1db560a7c769426a1c756c519ab2a008f24eb0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685035754, "uuid": "7dfff7f5-ae1d-4594-9a01-a05c60d3a4de", "comment": "Malware payload (RedLineStealer)", "value": "25ce01a4a4915b224da90549b709ae28884bf17a8d87a96fe87f97066e5a721549025e9154355f8e035bb884b10c2fea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685035754, "uuid": "6a2f77af-02c3-4576-b1d2-15c5ca1c1293", "value": "T1BE953848649187F0FD67103A05BD8A346628783707E25DDB23D0397BAE34AB1EB7DE91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685035754, "uuid": "0fed0435-73c0-4eae-b10a-3b923db5e4d8", "value": "ac4e45ef98fe94fd272b083fed3c156d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685035754, "uuid": "ba554870-fd75-4e7d-b1b1-245b372cd9e0", "value": "12288:E9t1l5SWp2uctySdelGR1d9UvxalYCc/fGvXhzO:0tLdUxQlGR1jUvxalhc/fGvXhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685035754, "uuid": "7eb0586f-a1f8-438c-b366-db00c9cd3703", "value": 1963008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685035754, "uuid": "008233a1-3ecd-41e2-8b87-3b2f58b450e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685035754, "uuid": "6881d986-ba21-4f8b-b59d-61d1b6506447", "value": "SecuriteInfo.com.Variant.Lazy.346242.9201.25057", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa68756-facc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684999299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999299, "uuid": "247b9d19-2748-47de-ba38-c55637e9b566", "comment": "Malware payload (GuLoader)", "value": "9ff8529e7afe7b737b29a73a0f1e0e8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999299, "uuid": "0895aa2d-39c6-455a-b212-e23ec537d168", "comment": "Malware payload (GuLoader)", "value": "e8d60980b64d84062055d1f13c2b018d3b786061baac52fcf5b025a33ecd4fb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999299, "uuid": "f48927fa-dd98-4cfc-9d20-358577db1fcf", "comment": "Malware payload (GuLoader)", "value": "5a8711ae79b63c535e189c39924fe8bc6a84e78e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999299, "uuid": "90e09725-3a14-4a0f-a289-5b4295cafdd3", "comment": "Malware payload (GuLoader)", "value": "cb86866f28bec7b14ccf7575157f314d7492962d70ba9daa3cca442e3b026b279f9e40d89c155cf1af079be0e6c47060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999299, "uuid": "2ec560be-381a-4b64-8fec-953c844fd02f", "value": "T11DA4BD2039A6ED22C90644BACB6F85F9ABA1BF02FC51CB5333197F2E76721F411925D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999299, "uuid": "eded6ce8-5f02-4ce2-b760-9de3f06a0d80", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999299, "uuid": "b3e4971e-e68a-467d-955f-b0ce8a1a62a6", "value": "6144:U1on2qz+QA2bfTAdXvvlJgVTaFQF8xbsGelfCSgs4CI5kib2yH6GvypzR11B:8oz+QA2/AVliWnxbsG11sW5kiyyz6pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999299, "uuid": "fa707cde-f44b-480b-b5a8-449e6560d2a4", "value": 493664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999299, "uuid": "93f13396-366f-4853-92f7-4d9a3cc4099c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999299, "uuid": "7670999c-70a6-4fcd-a734-35c89d04a6c4", "value": "Hjernerystelsers.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3acdc033-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994763, "uuid": "61112cc2-dfba-4ec9-9ed3-1a4767e4c746", "comment": "Malware payload (Quakbot)", "value": "c73335065f28b26b502ae212fb7ca827", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994763, "uuid": "a3ffe674-aece-46e2-888f-7e0c3e70ec02", "comment": "Malware payload (Quakbot)", "value": "e8e39296e6a78836384f6d3a40deeee617a8b7b691390ee9cc23d8b74c5d4dc1", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994763, "uuid": "1d84533d-3185-4767-a833-8a75713ce4c4", "comment": "Malware payload (Quakbot)", "value": "f5d949ab8765fde20086cad52da48fb2854b4976", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994763, "uuid": "73d6ff34-41b8-40ec-bae8-2cb7f629a2ad", "comment": "Malware payload (Quakbot)", "value": "8f1dc836d316a7b93254c1df19c7debb0f981c09f92c55593bb26b43638d99fd7decf0cef8482453a44ae690dd4d52ad", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994763, "uuid": "bd7ec16b-439f-4138-8d5e-b4e67c98479a", "value": "T11F53199EA381137D6A210224514F66D0EBE149787E61DB78A88EC39E3311D78C6FE5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994763, "uuid": "2193ea8c-2ba2-4b42-afdb-e26e983876da", "value": "1536:EmtxvcfDa0mNd1NHRNReQs41ZOVqq7wiQkDfNwi5:EOm7a/dpN8/41ZOjw0Dlw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994763, "uuid": "ae93eb3c-d994-447f-a515-4543428629ea", "value": 65502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994763, "uuid": "eccc3fe3-3eb0-4f8b-aae9-26414d2fa9fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994763, "uuid": "454dc5d5-62e8-47ca-ac1a-3d2e571ffd17", "value": "Claim_F597.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e743ffd9-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998059, "uuid": "df27da0c-4f86-4505-a4be-f374dbc99c78", "comment": "Malware payload", "value": "002c59d141be8198d5affcefb327d332", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998059, "uuid": "0adbc435-cbf5-4081-bd08-9c87dd1bc101", "comment": "Malware payload", "value": "e95acefc5401ad1664aee71edacbde9a51e9ea2b30b022d9fe5d42ade649e5cd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998059, "uuid": "4389ebc3-356f-4abf-b2fa-708d87df7c19", "comment": "Malware payload", "value": "5ed3843a969a9e8097408de29d6c2f7add6403a5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998059, "uuid": "a7fadd91-4b6f-4b39-8553-415f9c03b2ef", "comment": "Malware payload", "value": "2bc67213876564b40d58399648d1eb8a77c8797caaee6eec8f3cc223d03bfa41c3370814e2481ab4602f1d6033119efd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998059, "uuid": "ac681dd7-ba19-4af1-a83d-435bf1623b36", "value": "T1EA64BA80471528A24B4B6F36A73094B5EBBE0EB9C2D4588BF46F7251FBDF94CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998059, "uuid": "a24cfb4e-9648-40a3-adf2-1ea2272accc4", "value": "6144:F1+i//4s1TiquApJ/Eb2RDrMyHxjAefAesLnlYA:r+iAqVJSL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998059, "uuid": "48e9e163-cda0-4d07-b3ce-063c534a107d", "value": 332392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998059, "uuid": "28379d84-1ebb-4d29-9225-35cf72271536", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998059, "uuid": "08a7b91b-62f6-4d39-a5a4-21aae8df022a", "value": "Unapprehensible.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffe9562-faff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685021105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021105, "uuid": "82025f28-7b7f-4f94-8a85-147cdbdfdf45", "comment": "Malware payload (RedLineStealer)", "value": "6daaa89a328497e789dc6eb9d8c2b501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021105, "uuid": "2bfef53e-ea3a-49cc-8cba-26d20f9db67d", "comment": "Malware payload (RedLineStealer)", "value": "e964f22961974682a5036961565d0d1bc93b3273be660d8998e4060256af1462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021105, "uuid": "92a4ca28-29f3-45d4-b5bf-3dc7285eaeff", "comment": "Malware payload (RedLineStealer)", "value": "797d7d0b818939a53e056dd9d077159a018dc538", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685021105, "uuid": "8c2a58f9-1c64-4c48-bdeb-41d5c7a7896d", "comment": "Malware payload (RedLineStealer)", "value": "e98dad7bdccf435dadd4b3c095d460152b409b420fc91c41c08e83e4eb2fbfbe2307a8f703fc38240351147271421e63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021105, "uuid": "827ca12e-30b5-4556-bd49-23892e824c35", "value": "T14874BF1273E0A834E5225A314D3AC7F4AA1FFDE18F1566DB33946E2F09702E2D676742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021105, "uuid": "1c435862-fb47-444e-a683-00d3554147dc", "value": "8522dc5d9d6a2a97002c24ca5ed58b85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021105, "uuid": "56a708b3-340f-494c-9a17-ed5b65a94c77", "value": "6144:vSyo4tuFublt/IxgttjnTkyfFk0TILkYQeaJH6L:9NblaGt7Q0TI1QVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685021105, "uuid": "e07e53fd-755e-4772-96dc-ec4a4fac90bb", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685021105, "uuid": "8466faeb-79ef-4e83-841c-a6d37c641b5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685021105, "uuid": "0010a8fd-a5d4-47dc-bf35-bc0313b10c10", "value": "6daaa89a328497e789dc6eb9d8c2b501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c7a1ee-fab5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684989250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684989250, "uuid": "c9402334-ca3b-4bbb-96b8-37d80ea0c51c", "comment": "Malware payload (GCleaner)", "value": "0b79fbf16b76bd0ff14e9d079e40e889", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684989250, "uuid": "72908a63-81ab-4cf3-894f-292d1dd33d36", "comment": "Malware payload (GCleaner)", "value": "e99574f67e511e9b940c788de58592b02542972981f69ebe2806d876e01135fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684989250, "uuid": "f38b5026-8ce6-4f1c-be29-916c059f9d36", "comment": "Malware payload (GCleaner)", "value": "eca7116292f3437102b06c7f2b78e32fa6ae69a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684989250, "uuid": "1eaf40df-ea8e-4168-9684-2af028ce9bc4", "comment": "Malware payload (GCleaner)", "value": "8a4ffc5252887e360cd90ada7e5483822ec4e9393bc659fbcaaa99d1157b03732830cfdca9218ebc86e2cfaa0043c9fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684989250, "uuid": "8cdad4a5-ce74-4157-82f9-ac91f5d4d6b3", "value": "T11E841242F3E14439E073CEB01CA0E962893F79654DBC640836ECAD8F9F3B5829256797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684989250, "uuid": "ff7f2b94-e2fe-4d4e-89de-6b2210801fde", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684989250, "uuid": "12003707-d9a3-4877-bbb1-bee0b4927bd1", "value": "6144:x/QiQXCfkm+ksmpk3U9j0IT2OGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZoglM7LT:pQi3fP6m6UR0IT2lL//plmW9bTXeVhD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684989250, "uuid": "a5d8c4bc-8f26-4164-88ab-6551d82ace18", "value": 390142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684989250, "uuid": "cd47efb8-32ae-4c2c-a3d7-afdd1e284c38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684989250, "uuid": "aead9622-0de2-4e9b-989c-89647179d826", "value": "0b79fbf16b76bd0ff14e9d079e40e889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9404a441-faf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685017247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017247, "uuid": "f412c8a2-1098-4d19-9fe9-0284552f6fe6", "comment": "Malware payload (Gozi)", "value": "bc339c57f60e71778611eb8b17163af6", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017247, "uuid": "9893e034-ff0b-4be7-b8cc-6e38576d4221", "comment": "Malware payload (Gozi)", "value": "ea2d71af9790b0a058d0d166c52c2609a1a106053189c515b6059b5f18e9e48b", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017247, "uuid": "9e8fb67a-5279-4fc8-a94f-2e7965d8c4df", "comment": "Malware payload (Gozi)", "value": "a7128b7d2d33376598ddbca3edc313df7f36ce63", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017247, "uuid": "b19321a4-6842-4988-a8b6-3e73d355a5ee", "comment": "Malware payload (Gozi)", "value": "2638a0c91bc39354e1093f5e1850dd530475c51d1ee7e18a6c54201cfcceb47afa67d9a25573e2faa22c05700aac6142", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017247, "uuid": "f87f98ba-cbf2-4f28-b0cc-8cb5eea6a9c7", "value": "T1BFD46C18DDD61F2BC935D8FE09471D6ABB76C10B3702D66B6728E51220113AA8FCB93D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017247, "uuid": "ae72a5cd-adbe-43a4-8b69-f62c2aea8def", "value": "a622cc1fa95693078c9a25f4b07e40d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017247, "uuid": "51550ce6-7736-4903-979a-ff827fc66123", "value": "12288:UNCP9L6JD1GK3SBKXbZAPkTG5k0JNu3pANyvkn79:UNUmMKXXeMTuXIWcvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685017247, "uuid": "d094dca6-042a-4120-a52c-54b42f538b8d", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685017247, "uuid": "2f28359f-58b9-4849-bcb3-7d8fecd41b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017247, "uuid": "ab8ae4b7-6c69-4d2f-bb29-4c39e878d519", "value": "008621899.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8aa7fa-faf9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685018606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018606, "uuid": "d57cd2ac-eda6-49b7-861e-7ffb54d300c6", "comment": "Malware payload", "value": "0dc114b193d58538ae8e04952507fc17", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018606, "uuid": "2a9281be-71f4-450a-8c22-2ecb32332c6a", "comment": "Malware payload", "value": "eaa52ade4e7f2074f25a11e4b3809a72a809077ae99e8cb0ab568397a60cfdbd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018606, "uuid": "d49ef0cd-9db6-4cb2-8496-87f5bd93bc8d", "comment": "Malware payload", "value": "7eaa3716c4948595fbede1fc2fd1277a36230500", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018606, "uuid": "a3ee2eb9-4c33-41c1-a580-56daf70bc1e9", "comment": "Malware payload", "value": "d8a9816ef8129c68bf81ffe379dbe18103837622d68dd92f5a6832a618559a1004f4816833318cf186fbb4103905e8fa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018606, "uuid": "d8aa07f4-13eb-4473-923a-8b80ace09979", "value": "T18324B8804B6514724B577E2A6B30A4A6DBBE0E7482CD5A8BF45F7260F7DE68CCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018606, "uuid": "f7093892-d27d-4135-92d5-8607bc316e6d", "value": "3072:Ua+r4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:9bDqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018606, "uuid": "5494851d-0ce3-4e73-8e9b-b519e200e4c1", "value": 209670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018606, "uuid": "8f31896b-6a27-49e5-827f-78e8ca7d168e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018606, "uuid": "7446d03d-acaf-4f1c-961d-5dd3ed57405c", "value": "Dsppx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49700c4-faf3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685016013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016013, "uuid": "1d680844-6b3a-472d-ac68-1c605391eada", "comment": "Malware payload (Quakbot)", "value": "26cd698355ed3817b734ba91a0c51330", "object_relation": "md5", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016013, "uuid": "75ea8642-555f-4789-a9cc-9bd1d747dfe3", "comment": "Malware payload (Quakbot)", "value": "eae320b1bf2e9ec8da66435484db1f3afe641db13c973904747e26437633bd28", "object_relation": "sha256", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016013, "uuid": "6f817282-2d24-413e-8412-fbe0e7e06f39", "comment": "Malware payload (Quakbot)", "value": "846842326642ae8351774a484d17037a9c0c85ad", "object_relation": "sha1", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016013, "uuid": "a5ba27df-0233-4157-a1e8-96a209b5b5a8", "comment": "Malware payload (Quakbot)", "value": "1d140784a17e52f88c8bd32da2210377c715304e529a629c267acf4cb089b5ecf1f3433d7444191b4339fcf236da55d7", "object_relation": "sha3-384", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016013, "uuid": "33cc0d87-1de2-4663-a0cd-faae9e42ed06", "value": "T17715D413F592AD67D7E812320091F5355622BCBCC3A31AF73EC476FD39A69405F6AA20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016013, "uuid": "85f5149e-2d5d-4909-9e21-363c56b13d7e", "value": "69b5a2b4c355363112fef443743090f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016013, "uuid": "5718166c-cf0d-4903-a8f8-5071e1a03524", "value": "12288:COysJ5nhFvhxaiz8hC6CSvqdRcVU2cQpbls6csdCVsM3U:fhFhxaizH6CCqdRcRcQpbxFCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685016013, "uuid": "43e2c410-fcb5-4450-9124-3a64fdf16a65", "value": 948956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685016013, "uuid": "bf688dbc-16b3-4fdc-afae-5069359cf299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016013, "uuid": "6a3c6a52-b56c-40c2-9274-55d2963b663d", "value": "PXNuYAPR.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b940e51a-fb10-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685028476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028476, "uuid": "41837dbd-b791-457a-a3cf-0b9e2ac52bbc", "comment": "Malware payload (Loki)", "value": "e466877037de62f5262670bc43e57b83", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028476, "uuid": "6fb55b52-9d01-4043-a7f5-88bb18060550", "comment": "Malware payload (Loki)", "value": "eafd24a879b0e1458630666c4dbcc4f20c14a00b48525d05ef6055312085c10d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028476, "uuid": "ca250e2d-3485-4cd9-b4c5-a5f35f45914a", "comment": "Malware payload (Loki)", "value": "24d82b281fde6305048ae25420978dbe3b92e3f8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028476, "uuid": "4f52fa7c-fe29-4d0d-915c-27e3861ef626", "comment": "Malware payload (Loki)", "value": "aa5b72404fdee425c52118a1aed34c725d6232111e2d40b441d6ab3667cbdf28089c0b6f8ceeeea85735cbe50f878f0d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028476, "uuid": "9001fee7-5e7a-40a8-a578-6648698b64a5", "value": "T149D402A136A92F63D07AC7FC842035B553FB223A7132E36A1ED7B0CB6666F414910B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028476, "uuid": "f96c8aed-a16a-4f13-99b7-08d2ce39f1ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028476, "uuid": "bad90428-c880-49ce-9ac2-74b63ff0e592", "value": "12288:qBxmzZBEP85qMm8pyOxiCSc9wcXpMMlng8EBVYPLskLGGouE:j9BEP81pPxTx9fS20iLGGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028476, "uuid": "fd14a458-6329-41ed-a465-45b8f9640c6f", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028476, "uuid": "9eec1c65-b433-40ee-bd0c-5c0035fc543e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028476, "uuid": "7c680083-6581-4122-a03c-c5992b521f0f", "value": "05238199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbe8777-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996919, "uuid": "31e936a6-9adb-4b10-a02d-fdae7d90333e", "comment": "Malware payload", "value": "70dbf2a6118d117345d4b4229bdc1f8c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996919, "uuid": "c0a75409-2e84-4cc5-ae06-661cbd8b421c", "comment": "Malware payload", "value": "eb75227c55c2b10918cd94c699e2c0d297457566be18196240eea9b5f60ba8c0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996919, "uuid": "fc7ea780-acf1-45b3-810f-9f1bcedb1378", "comment": "Malware payload", "value": "65cf4b1f1438d0b7e935ba9a7c3b84ceab53c331", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996919, "uuid": "f3aef5f8-a17f-4267-a48d-4ac3a57e6752", "comment": "Malware payload", "value": "8c8891b3b56cb5aacc94adb14eafb1d8cf3582e008842f22945b9bcce1b6223fd75f6264a0aaabd09acda5f6dd0b40d3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996919, "uuid": "0d2231c8-a01d-4f2d-8c33-f9c82f5cc68c", "value": "T10864A880471518A24B5B2F36A72054B5EBAE1FB9C2C4598FF46FB250FBDF94CC8D1622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996919, "uuid": "58a552c5-329a-42d4-bbde-e937a4b1b0c8", "value": "6144:4FXejzJKH6I8UcwDqglTI8SiuWf5d3lQO:4JeZ6Rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996919, "uuid": "5a38f4f1-f296-4860-8976-b07b05814f35", "value": 310315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996919, "uuid": "04c6d6d3-02e6-4d3b-af68-0fcfa3d52104", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996919, "uuid": "b417b6bb-3f3b-4954-9cdc-b801660277ef", "value": "orderers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58d9426-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999667, "uuid": "15fc3856-4eec-4690-a33d-cc2c9aff3550", "comment": "Malware payload", "value": "b26d2a4ba4f49b6f38dda8474b6c8040", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999667, "uuid": "bb57e7a6-ab33-47a9-970a-b5ad8cd9dba5", "comment": "Malware payload", "value": "ec4dc2683534609fddd40b32f59d357537c3e698d8aa6c0c0b38146fa09550d8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999667, "uuid": "d6135a84-5e2d-4911-acab-e5166c07acd4", "comment": "Malware payload", "value": "91840156d95deb5b6fa271f3b77cda10cf715171", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999667, "uuid": "f4933ddc-e8ce-4629-8ea5-fa94cf42bb89", "comment": "Malware payload", "value": "8ac4bf7a7798e2c13514e9faca78296ccbeba7eccbc1409a5f8b0d13bc8963bb6ee988c013e4d864f9369237741ffc21", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999667, "uuid": "0d45f8f0-4207-4888-8f8c-97182478991f", "value": "T1B744C584471528A34B5B2F26A73464B9EFAE1EB9C2C4548BF46F7250FBDF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999667, "uuid": "6028ac00-d085-4dff-aa3f-b1718e528cf5", "value": "3072:Ntzmr8l1Y9JrEWse/WI5lqzLWmZFjuSpgHfu54WUIJSj:fmr8l1Y9OWsiW4gESqHW54WUIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999667, "uuid": "9d7b228f-52ce-403d-8141-d498e2507f9f", "value": 255322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999667, "uuid": "344af736-60b3-4409-b9b1-18509c1179f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999667, "uuid": "7a8008e4-973f-41a5-90e4-4f00672a06cf", "value": "coruscateSheeps.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f343169f-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998079, "uuid": "6dc16a19-3ccd-4b87-8fe6-0d6ffcdabd3b", "comment": "Malware payload", "value": "4e90e31e74f099ef451c8f5630b95bab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998079, "uuid": "f1c34a37-9f8d-402e-b242-f894b8ea9cf3", "comment": "Malware payload", "value": "ecd8dc73690ca41878cec85180e024a78aafad54c9b4c01958b0c5a217bec02b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998079, "uuid": "a0c506de-c119-4d49-bc91-90343b7e2fb7", "comment": "Malware payload", "value": "f2986d67d260ac8228f8064ede1538669891c70d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998079, "uuid": "c1a67b11-54ab-45e0-b4e1-f4374ef553aa", "comment": "Malware payload", "value": "fa71ec41f61955aa745166eee1bb7240d509fbb859c423a2e0945f928805f30d212a4f3089a6d713cf0d83c6842162d9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998079, "uuid": "4b5bfc7c-493a-4f44-b08d-ab364198eef9", "value": "T195548480472528B64B5B2F26A73094B5DBBE1E79C2C8558BF46F7250FBDF98CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998079, "uuid": "a0e9506c-c155-44ed-ae40-6469aeaa7f43", "value": "3072:14IfdM4lOPXwxBYnsnplrzU9yxWvLa18nxW08q483Ghff+I:7lBlOPX0insnpLxImqxWx8YZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998079, "uuid": "a31ecf13-c1b8-46c8-86bc-49948d4e8610", "value": 294046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998079, "uuid": "856e76e3-3c44-4b89-b965-7480be6a2029", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998079, "uuid": "6bb58b7a-512a-46fa-af0a-47cb8bf942cc", "value": "UnderfursTancho.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fe70a3-fb1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685033385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033385, "uuid": "b5128d89-f1f0-437c-8cf4-8cdf8a72fcd1", "comment": "Malware payload", "value": "e484021204b7da05f210fbc121bd477f", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033385, "uuid": "a3beaad3-c8eb-4a22-8a88-fe4e55ab9255", "comment": "Malware payload", "value": "ecf6f4331da8bdd785b61a7998a9961d719a394c0f7c58745403648edb5e8481", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033385, "uuid": "de76d6f2-171d-4da4-a6af-22246e3dda09", "comment": "Malware payload", "value": "8015625dfca6f731ed39d9ed7c0d76cbb4a0a2cd", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685033385, "uuid": "61a98f5b-bb9d-4a78-ae08-216e0daa21a0", "comment": "Malware payload", "value": "fdddb9c1a24de8e0464b3b8ee06d49f7657c18daab217156cc1b9cd8ae727f9ea4dae6b7c959c8ee42651059a0a1c0d5", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685033385, "uuid": "2f012530-78ee-49df-a7a7-da52bb0c6bde", "value": "T1A672D06700D12E14DCFB4AF909E4E354548E49B628747AB58D90E8E209C17EF19674FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685033385, "uuid": "af2ab028-555b-4500-9225-d70b6a0756f8", "value": "384:nnU3k9KQJwP23payoGapuhkFJyRZfphjGE1gEjW5ayDhHTp:nTY5e3paRkhkFIlw0y9zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685033385, "uuid": "f0944b12-7c9d-484c-a3ad-a2a26f1356d1", "value": 17071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685033385, "uuid": "4ea1d269-a13b-48e9-83bc-8f43f9ec081f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685033385, "uuid": "f96b805e-f39d-457f-90f3-fb62c06b10a1", "value": "1_IT0_05_25_2023_01.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a392e7-fb46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685051765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051765, "uuid": "b5a1196f-9006-4d4a-8bf4-55cff4fc0e71", "comment": "Malware payload (Mirai)", "value": "61b567adc826b689bc205daea3154e52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051765, "uuid": "fe8530f5-e22e-4301-a80b-372b10a506f4", "comment": "Malware payload (Mirai)", "value": "ed62265613797bd123cc9ea61b916b32dfe0b5aee8da7e7eeb9ef287ce39a490", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051765, "uuid": "4bd0dc95-c5cd-4a50-a3cb-7110b7cdec08", "comment": "Malware payload (Mirai)", "value": "ef988442b533a14838aaf2ea037512bef2f625c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685051765, "uuid": "741bc724-7a5c-49da-96ff-3c411ad3a9c5", "comment": "Malware payload (Mirai)", "value": "43c49c0feaa6fb489de27a5d04a9a8bf9b4a4a74ffc131ff5920243be3c1a23f92694edf6da05f12786bee428aaba0f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051765, "uuid": "c06877dd-feee-43f6-848d-84af157054ea", "value": "T1C1A2D029D345AEF4DFEF9DA492C1C2C276E943C76787C8E240EEAF012516046FB88D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051765, "uuid": "8c92e7d9-b5ba-49b4-8ec7-c68ebb509460", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5ObM4uVcqgw05VxJ1:9RxsSVsMD6xiJJE5zRWN/4uVcqgw09n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685051765, "uuid": "289101e5-7f6e-46e6-92fb-22391b7ecb56", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685051765, "uuid": "e080ac03-2851-45a5-890f-5eeb0bbd4cdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685051765, "uuid": "786ee31f-1eb8-4d35-8984-079b37cb03be", "value": "61b567adc826b689bc205daea3154e52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154b3fd5-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685003720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003720, "uuid": "63b2d8a0-e5fc-4e4a-a8d4-dcc384dfc22c", "comment": "Malware payload (Formbook)", "value": "a591a841da86f98a3bfba7c786fc4731", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003720, "uuid": "45dfa600-6fed-4a34-a527-c1b83af9d13a", "comment": "Malware payload (Formbook)", "value": "ed91da1c1fde7816f135bb59412bcc3a8aaee67d019c5c0896c1986e00b4b07b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003720, "uuid": "e1d21a9c-86aa-4964-ad61-65e4aed65825", "comment": "Malware payload (Formbook)", "value": "8f01ebf280d03a3f04afcc04284605a72b23c67b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003720, "uuid": "dae26eab-3d35-44ba-bf60-2e6bcb77910f", "comment": "Malware payload (Formbook)", "value": "0b068d1fea238107d9fbad0f7559f4f92a28a22a648612f1fa0e8bae73ebf4c3a7b63fef6ecd283e274b8f891d9b4f8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003720, "uuid": "ad3eaafd-f9f9-481a-85d9-d01ccea11cc9", "value": "T1C6D4236C22E084AFF12746331EF913A77FE282223A5C11729714364DF72B5D6B91E35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003720, "uuid": "92bcadf4-3212-4023-8809-a8210e72e649", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003720, "uuid": "6c132227-ad5f-4b0b-a830-b9b230bc4868", "value": "12288:ZYDhreuTstsARUOK33wuHKSjVzM1vBWVY3ps6QyrGqd8KvCGq:ZYDhreuot493xw15WVYKIdnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003720, "uuid": "45cef3ba-cfa6-4936-af17-fc0424bf8910", "value": 640846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003720, "uuid": "61de2b14-7e43-45c0-a245-690a44349f47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003720, "uuid": "6af327e9-b052-449b-87ce-251952c4a4ee", "value": "GUTIAN TRUST V.GT003 CARGO SUMMARY & PACKING LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b964b2-faea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685012153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012153, "uuid": "3f6463ab-1e3b-407a-b1c9-b8b952788015", "comment": "Malware payload (Glupteba)", "value": "dbf6d2e43347fcc273babd83c0f48c1e", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012153, "uuid": "0e1ae238-2e3d-471d-889a-a59875875cec", "comment": "Malware payload (Glupteba)", "value": "edcf1c9a1d553b7528c864ebeafdf11ca9896c471dd89e78a28ea19a485e53e1", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012153, "uuid": "80314a49-96c2-4774-b9a6-7d8239a16aa2", "comment": "Malware payload (Glupteba)", "value": "7c996adc3e86e67a61c271f74d7b1d6804d36de6", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012153, "uuid": "9605a77d-fab6-4c26-8bae-244fc3f0764c", "comment": "Malware payload (Glupteba)", "value": "8d49e56d2ae320b6ac467465c97aff3e35cbee079553675d12e2f28c2310e54372c12ea28a34b9a0de97e9da8e87a70e", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012153, "uuid": "81afcc6b-4410-42c7-a04e-476626598770", "value": "T19416331372E0DC61D1136A759D0BC6A8376CBC744F9657EB37A07E2F1AB02A2C432697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012153, "uuid": "b1f5e868-6200-4666-b4f0-24436285871c", "value": "4dc3e52c058b03af2b7dec3a031b4e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012153, "uuid": "d2a293c8-1178-4a36-b973-a8260cae268f", "value": "98304:PfXOy5bfsT5+QzUDMt1u2z4qpprjW0wNQU8624lR:Pmy5b0T5+iUDQ1u2zJHh54lR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685012153, "uuid": "6531a2e2-84eb-41f3-9423-0e44be357fe1", "value": 4369808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685012153, "uuid": "09e138f7-45b2-4143-b1f7-2af39da7587c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012153, "uuid": "3935610a-9b04-42fe-b372-c73ce6aa5b28", "value": "03374999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a60d571-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997849, "uuid": "3db0af34-fc90-4ea0-98a0-122f6c8c1fd0", "comment": "Malware payload", "value": "c60505b12c94a4659f35c659a68a454b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997849, "uuid": "e9caaa48-5340-4af2-a48f-beb284a306dc", "comment": "Malware payload", "value": "ee446c99961bd34877b7bcff6d3e0270a737ab8da37cef736cbec6a68caead4d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997849, "uuid": "ede91ec8-1310-4c9f-a144-50c00f48a30a", "comment": "Malware payload", "value": "3f5b024a0fd01a4bfd995d28f955c8e6696e8404", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997849, "uuid": "91d68b7f-228e-499a-8745-55f9574fc786", "comment": "Malware payload", "value": "88ab187658a8c3cb901f11500e452c837b1169e88638842a0a5efe0f48f3840a2ee164bbd07d6c84de4083b73575ffa3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997849, "uuid": "af478f3e-8f70-485a-9dbf-2fd8a4185a3a", "value": "T1EB44C984471129A24B5B2F32B72464B9EBAE1EB9C2D0458FF46F7251FBDF90CC8D1621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997849, "uuid": "9b10e78f-014a-4435-8b59-9ed5e8b31109", "value": "3072:iwubK9CNc7CbQwb1auY5/tolG8AvRelMDliMFLNEoSvnd8BZIeKibc:iwuv6Vwb1auYzo08yMlM57mGB9Bc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997849, "uuid": "937bb4e3-33ba-4555-9ddf-c5ac6fccd4cc", "value": 267197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997849, "uuid": "ea536187-c7ff-478b-9914-22cfed7e1665", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997849, "uuid": "9fc97dff-267e-40c9-9d0d-006d50947255", "value": "Retrieval.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a29daa5-fb2d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685040826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040826, "uuid": "4fb6880e-0aee-4c0b-b389-f0efb5828565", "comment": "Malware payload (Amadey)", "value": "111f0b3c5f6af70c4ec9c56fda83d7b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040826, "uuid": "eb799720-7eb0-44c2-8aa3-154723842ddb", "comment": "Malware payload (Amadey)", "value": "ee65d017c265ab9a8e06dcd97f158edad93fc27f5650917d8c5eee735633acd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040826, "uuid": "33071110-09db-4f98-a5e8-4681bea4ed82", "comment": "Malware payload (Amadey)", "value": "2972ab1e9152143697e36922a5a191993b0fabc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685040826, "uuid": "5de4ba4f-bdb4-4493-9a8a-a39c00fda6c0", "comment": "Malware payload (Amadey)", "value": "887c755dad83cd7bcd0fcf576752793fb5de780be895cce355ac5b60ddd8b8b7c9b40d846cb0067d115256b25c83ae4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040826, "uuid": "59301a2d-26e1-4519-9d97-b9f069b4bb81", "value": "T141F41223A7D88032E8B127B15CF303834D35BDD55E7486AA1A99BF5D5CB22D4A1B073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040826, "uuid": "93601059-b8a6-405b-90e3-e7b331653a69", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040826, "uuid": "d224eab3-372a-4259-a420-627cab1b1705", "value": "12288:XMr3y90nFUWywLylG1Jfzr+6Itsr3vQRm3fc1RmWIArWbUI6FLvGkBkunM8tIW+G:wyqUjlG7P24e00RmWIAad6RukiuM81+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685040826, "uuid": "fcd4dd92-6b2a-416c-bb19-d8678821b874", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685040826, "uuid": "0b588686-4adb-429c-a3bd-65b8dfc67029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685040826, "uuid": "1cbb2874-7be9-4100-8172-8c7cc3cb9df1", "value": "111f0b3c5f6af70c4ec9c56fda83d7b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa17bb0-fac7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997018, "uuid": "7e173a66-1733-4c57-a69f-9c5371c08aa0", "comment": "Malware payload", "value": "67a9462d20841edc1b82af8b30e84270", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997018, "uuid": "caeeacd6-793c-4198-8075-1a1b55c9e673", "comment": "Malware payload", "value": "eebe255d8ac07c5e34d8de48350139be6a65e37abd40e0c5f2201d97a1558295", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997018, "uuid": "9e5bef51-0e7c-4f3c-a00e-4d053b1cbe58", "comment": "Malware payload", "value": "db9f75fbaf2340ba09ba649249da2250822b029d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997018, "uuid": "fc96108f-53bf-45fe-96be-19a13b75a9f8", "comment": "Malware payload", "value": "3b1e94cd4cfe2e7ac56963e8b2e87b95930d220c61327b3587e79eee9f87d74b868b62f7045602cbd969361b2aefb0c3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997018, "uuid": "0e2cc7be-0492-4c05-91b8-3506e2359904", "value": "T11254BA844B2518A24B4B7F35B72064B9EBAE1E79C2D0558BF46F7261FBDF90CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997018, "uuid": "6df5da75-b2d3-4375-9ded-ec1c33a2b4ff", "value": "3072:WC3GLcQ4yPWsmwRu1Si0BKS2VicoVK8yaztrpB2nBFYf:VWf/+sa0B32ViboEtrpBg3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997018, "uuid": "c38b487e-7a4b-450c-a547-7b6e5555622c", "value": 291565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997018, "uuid": "3a7aae8d-3249-4a8d-bcb9-6563198caf34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997018, "uuid": "c4ce2d46-a145-4b85-93f3-c5a05e3830bc", "value": "officiaryNainse.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba352a52-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997983, "uuid": "941223b3-e44e-4c1d-8c72-3ce4f2a85b40", "comment": "Malware payload", "value": "70a926107603f5527b861a9fe61c4090", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997983, "uuid": "5049cefe-2bc7-4766-9cca-aa60cbb6e598", "comment": "Malware payload", "value": "ef5947fff5ebd0ec582c51c5b170142c91d2c64d038e3a4cb1749f10873b9c26", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997983, "uuid": "1fa89332-368d-493c-b023-e74b3fba0334", "comment": "Malware payload", "value": "ed72519661d18d18878cd608f18506f95571066a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997983, "uuid": "1185a7a3-e977-4f28-897b-b4c87685c52e", "comment": "Malware payload", "value": "cf454623fe10940c793901e457e4660abba0870a1ba5f6cd33da1b6d658e2958300b551a7b6f53a0c814be02e845751b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997983, "uuid": "8277402d-38e5-4fe6-be71-aa941d8f134b", "value": "T10A54B9844B1128A24B5B7E36B720A4B9EBAA1F75C2D0558FF46F7261FBDF90CC8C1521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997983, "uuid": "a7bde9e3-fd1e-4f1e-a2ad-325e8b52795d", "value": "6144:DfJ6AdgAGgAblFS089X0qU2D75veNGDQfdojb:DFa5IJlLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997983, "uuid": "c0d1500b-f87a-43c8-a083-3928b67d3006", "value": 301800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997983, "uuid": "908017d5-5112-4271-9b44-f3e15497901b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997983, "uuid": "a8f350b9-4615-4596-8f11-2cbf195d2989", "value": "TactiteModifica.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0334c79-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996759, "uuid": "dbe76263-9702-42d1-ad04-42dcd16084fa", "comment": "Malware payload", "value": "ba6309886fc3007334626785d540519c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996759, "uuid": "7b5c9bf2-084f-471e-b9ac-fcde62a09c8b", "comment": "Malware payload", "value": "ef6491787da563a7a680a29c4db62c38bf2ce7b2978d956d8e6363105099b7da", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996759, "uuid": "da152c2b-ca0a-4a90-ae46-c085df349504", "comment": "Malware payload", "value": "acfd122393b97848a27839cbc4aa9376b33b0114", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996759, "uuid": "31389ec9-b0dc-4795-8c8b-dab3a3b36c27", "comment": "Malware payload", "value": "4f3cb7ecd048589d4f30dd3ab6c84ce0f84c01549ee239f24aa5fd1d2c342e167112d94f774662fc7f5616734c103689", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996759, "uuid": "6e82ae5c-c77c-44ff-889c-ca16488ed21d", "value": "T1E084A780471129B24B5B7F26A73094B5EBBE1E78C2D8598BF46F3251FBDE94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996759, "uuid": "1e710a8a-165b-4dd2-8ee6-ec586496db40", "value": "6144:rKHxtPL9CmWVc/5WLHeWYmJInrCiBNC9n3AOGThFSzJNLh17yZuY2:re/O/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996759, "uuid": "6aff0a88-0a82-4092-89af-4247d8988cd4", "value": 375138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996759, "uuid": "17314afa-3040-4103-908e-bb3032fd67c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996759, "uuid": "78950cc7-f297-43db-ba52-48ff6bd9cffc", "value": "gilberteseImped.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1779a473-fb0f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685027775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027775, "uuid": "de5fbcd1-453a-4255-9138-21af5d9fd5b3", "comment": "Malware payload", "value": "4c213248be08249f75b68d85dcdf3365", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027775, "uuid": "16edf075-d9a2-4741-90d8-5a9d45e9fabd", "comment": "Malware payload", "value": "f0c730ae57d07440a0de0889db93705c1724f8c3c628ee16a250240cc4f91858", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027775, "uuid": "88073bfd-1b62-4760-a4a0-438753a682f1", "comment": "Malware payload", "value": "72aa5f5aed5adc1599b2bd03abe4a999efba690c", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685027775, "uuid": "944e42d9-c972-47cb-b028-16235e94b6a1", "comment": "Malware payload", "value": "95bc61bbe6b129deb7a85a82c917706f0cd0c29153dab4665933a2e934272de145e7a68a4090e41893e1d7003de66cdb", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027775, "uuid": "ff88c200-a516-4bb4-bdc9-705e78e5e31c", "value": "T175E41831E69C32ADD16B9079FD0B4C13E627789A1331BFAB12D45A521F66EA01F3D360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027775, "uuid": "170607c5-8eef-4a85-88b3-8f3eb00c07d1", "value": "e3801b8f348abd7ecd0dc57530776b10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027775, "uuid": "fc2efcda-d36f-4c16-8a65-220a16948311", "value": "12288:qNKLjILWnymhwEu5GmudCkDrvnZdbwAx8oYZL38:XISnjhDmuQk/vbwA25ZLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685027775, "uuid": "71bd3f85-c834-4582-9ba5-22c543d31fd1", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685027775, "uuid": "95c79a55-d28e-4d06-a471-82244a44c0d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685027775, "uuid": "77db9236-325c-4161-af45-fbc75898892a", "value": "4c213248be08249f75b68d85dcdf3365.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb3065a-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997939, "uuid": "d84e87d3-34dc-4559-8a14-dde81acebaed", "comment": "Malware payload", "value": "22904664b6105408b5dacc6be111da01", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997939, "uuid": "c9c59512-a8e6-4072-a855-5c90f1c46046", "comment": "Malware payload", "value": "f166dda66a40ff4f155bee2e397e0374ff4a798bd8cb800790be0a5f27818f8b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997939, "uuid": "8374fc7b-3be0-445c-8de4-4d4e013d2aa3", "comment": "Malware payload", "value": "bcc7709c83acf9d698bd68d8e34233a3f89203a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997939, "uuid": "e23144e7-61cd-4e02-848a-e435bc8f5d8d", "comment": "Malware payload", "value": "f2534bb10857eca28acf154485c93c47efcb6e8b5ad164651d1af1d5cd6410a5ee30e078658255662b07f77b124dc96d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997939, "uuid": "ff6c2e68-f2a8-4583-8191-d500ce116065", "value": "T16D648780471528B24B5B7E26A730A4A5EBBE1E75C2D8598FF49F7250FBDF58CC8C1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997939, "uuid": "865d336c-fdb6-4389-bd9f-4d8f06004727", "value": "3072:sRYnXKYwRn41M4syxqFO88eg6JX1dHSVqX/472zj2JnMpxwBWoxL:senJY4ZsHFO8iCVdX/uUpxSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997939, "uuid": "b8725cc7-5e30-4f3c-9470-727ba0ebdbec", "value": 307396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997939, "uuid": "72d4e970-a6c4-49e5-a2a4-b4bc3cf7ced8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997939, "uuid": "b2b038c6-cc25-4424-8ce0-8b8a1aff5f6c", "value": "SlatinessChlamy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cb5f10-faf7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685017488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017488, "uuid": "42cfd42e-aaee-4d2c-9011-0ea3cd8f414b", "comment": "Malware payload (RedLineStealer)", "value": "0117d776a51e4c3fe8207ac21d51f242", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017488, "uuid": "808ab6fb-4bce-4b93-a602-57f7c924b88c", "comment": "Malware payload (RedLineStealer)", "value": "f2641326faec3c7624c6b96d521c67e1934116df2688b475f4ffafb52ed91e2c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017488, "uuid": "64d82908-7214-4570-8a69-e97d8f136aad", "comment": "Malware payload (RedLineStealer)", "value": "c257c484d795a136ce72c2d8699235abdecfe395", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017488, "uuid": "e0843e99-398e-4555-97dd-67908c04287f", "comment": "Malware payload (RedLineStealer)", "value": "ee5cf6cf8777bf984e56fe5f87a43066e90ee485077e63c1ac59a699cc8679d1ed517f06ef6f9080b7b388b31a2ef788", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017488, "uuid": "3520016e-fa87-43b0-acc1-c0d091bd409a", "value": "T18C352302B6D88472ECB42B3164F546E71B357AF08DAC435B775AAC9A1C729E58873323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017488, "uuid": "d955d332-1355-4f1f-9f8b-1948fc6d2e04", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017488, "uuid": "399ea2e5-7b5c-4e60-b2d9-88a2fb0626f4", "value": "24576:yyab6m+OtmvgmHjB1yzo6zAWza8F21Ao0mfj8A:Zab6m+8gToo6zA6BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685017488, "uuid": "582cb3ce-3490-4977-982e-cb3ffdc3220e", "value": 1071104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685017488, "uuid": "0ed6c472-3b06-44bc-a1d3-3970ddfb52f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017488, "uuid": "c5fafaba-0afc-4e3c-b67d-6c2eb105570a", "value": "07484899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac35a7f9-faeb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685012563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012563, "uuid": "891917a7-2f45-446d-a878-ea43dca7a52c", "comment": "Malware payload (Mirai)", "value": "25a042160d8834158ef6600962495846", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012563, "uuid": "fb2c50c0-fbd7-4175-8549-01d180958e3a", "comment": "Malware payload (Mirai)", "value": "f28ee4bf4152fb50721645b587b273af96f211383b215f6cdfba5c788b253bdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012563, "uuid": "ca62a3e9-c8f7-4907-a87c-1830507aa82b", "comment": "Malware payload (Mirai)", "value": "c24e3178b7cef0f842294e80f6aaac277ce3b2c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685012563, "uuid": "893018eb-dcc2-4db2-a7ab-894d3fc67aff", "comment": "Malware payload (Mirai)", "value": "23e4c1497de5264ac0f93f04c8448ee1bf42270274b5d5e82c33f8eac9f1e0a55bc116a960f5c5e931e6b87ddd96ad8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012563, "uuid": "339019a3-4446-4900-8cff-32d95eafae93", "value": "T1EE331785B8819A12C5D023BBFB6E40CC332563B8E2DE7207DD216F50778A81F0EB7A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012563, "uuid": "dfc8204c-a281-4da9-a6b5-36a79d0d73e9", "value": "1536:b4VMCAIPgGibIqp85bezeE5r6juGlEHO:b4VMfbz8wzeE5r6fKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685012563, "uuid": "96a37a17-08e0-4aa4-8af7-d86964c8821a", "value": 54204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685012563, "uuid": "7be39035-2036-4140-aa24-ffe97487c258", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685012563, "uuid": "414c4ae0-6185-4433-9442-c10c79e3205d", "value": "25a042160d8834158ef6600962495846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3711534e-fb23-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1685036418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685036418, "uuid": "0c0a3b55-eb9c-4334-b697-c22fd5964c0f", "comment": "Malware payload (njrat)", "value": "2f840affad8d1087162c3c13fbd46957", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685036418, "uuid": "8504d859-2b44-40f6-a7fd-a9addd00afa5", "comment": "Malware payload (njrat)", "value": "f2a18bb076a39cbfbee79ba8e31c12051bd21af0149ccd31927a9899ff1f2950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685036418, "uuid": "6f446106-32cc-4959-9b18-f71a06cb0a1f", "comment": "Malware payload (njrat)", "value": "d81a1ed9eda358362feaf0b424e7e013e5a766e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685036418, "uuid": "1cec02a6-15c0-4b7e-909a-bebd045f4d9c", "comment": "Malware payload (njrat)", "value": "7f2927e0194021643e3ddaa5ef607c3cdb57283bf019fbf0cabb8d0353ec20dc0b464783cbe9f93b507bbb42e9590ca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685036418, "uuid": "a610da64-5f90-4c17-820d-aa066ef36d92", "value": "T1C593E95977E56524E0BF5AF79471F2004F34B44B1602E39D99F218AA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685036418, "uuid": "57db799d-ca78-47a9-becc-1e7b5d56b551", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685036418, "uuid": "b9cd18fc-e706-4251-96b4-126287181f47", "value": "1536:mCYQIBlfGQFk2ZonmzaMxjEwzGi1dDLDxgS:mC+tFk2ZonmuMOi1d7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685036418, "uuid": "aaa5d066-d86e-4546-a335-583c6dfa7d01", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685036418, "uuid": "2e847b5c-7420-4e18-b71d-eea95b530ab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685036418, "uuid": "f776a70a-725c-4774-bc78-81a00fd00e98", "value": "2f840affad8d1087162c3c13fbd46957.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61492006-fafa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685018879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018879, "uuid": "452fcf89-74a6-41cb-a9e7-0d9d8a05a453", "comment": "Malware payload", "value": "c23b901326590fd57659ba6f6389f664", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018879, "uuid": "757ab0ab-97b1-46a5-8533-ee41e463a3af", "comment": "Malware payload", "value": "f339d9a16fbb68ccab8321478f71fa2a105968a1612549b9c1fcc62b30091103", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018879, "uuid": "bd75b7a4-42dd-4cf7-aed4-d49aab932f61", "comment": "Malware payload", "value": "92f29003a734a73e88d2211e82c2c224bb7cb1c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685018879, "uuid": "56e5af53-ff07-4282-85f7-8276ffd454c5", "comment": "Malware payload", "value": "634dc215abe90f9d024bcebf414f5e3b44641530513eaadf3469ae1b27d982254f70a3cd171a8160d09d1fff9d487408", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018879, "uuid": "bc4f8eae-fa2e-48c4-b1c1-3fa2612ab967", "value": "T1C524C8804B6514724B577E2A6B30A4A6DBBE0E7482CD5A8BF45F7260F7DE68CCCD1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018879, "uuid": "d73a5d8d-5451-46c5-a8d1-296414c7d61a", "value": "3072:KsYDY8xNr4l1qDvatIVFcWwblWrj6/ns5JoDXn0Pns:KzzMDqDvatIVifQJorKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685018879, "uuid": "95cfdff2-ae1a-4bd6-88fd-03d588d11493", "value": 211262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685018879, "uuid": "8c11eae2-dd48-4b51-8111-ce46839b06c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685018879, "uuid": "99681b8e-811e-418c-8ce8-199d7aeb6fa2", "value": "Rzldisp.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e733918-fa8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CinoshiStealer)", "timestamp": 1684972892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684972892, "uuid": "b9f618a3-057d-4ee8-9288-12ee100d8d75", "comment": "Malware payload (CinoshiStealer)", "value": "e05905512add6d505d3c65422155ce1a", "object_relation": "md5", "Tag": [ { "name": "CinoshiStealer", "colour": "#FAFB9D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684972892, "uuid": "bc9df18d-84ae-41d6-9513-e43a3d45f232", "comment": "Malware payload (CinoshiStealer)", "value": "f3ee4457a4f196598d5749dd09787880f1a22cea69232a69bfcc710225c9a391", "object_relation": "sha256", "Tag": [ { "name": "CinoshiStealer", "colour": "#FAFB9D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684972892, "uuid": "d47b039d-5f1d-4b84-a4b5-e409e28bdc59", "comment": "Malware payload (CinoshiStealer)", "value": "b3657e881664bb20c59a5303d58186d10d39952e", "object_relation": "sha1", "Tag": [ { "name": "CinoshiStealer", "colour": "#FAFB9D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684972892, "uuid": "f4c9e09c-0f22-45f3-98a4-1d1fa2ee42bf", "comment": "Malware payload (CinoshiStealer)", "value": "d704083641c1f9c1d5302b9a4e5909b3fa76c24d87ae36aaad06b77f96bc421583e6f3c560e48350c2feef6b1e8fd901", "object_relation": "sha3-384", "Tag": [ { "name": "CinoshiStealer", "colour": "#FAFB9D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684972892, "uuid": "15944375-7076-489c-bf6c-9db6be322a77", "value": "T1469404AC721076DFC86BC476DAA81CA8EA6074BB931F4203946715EDAE4D997CF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684972892, "uuid": "23cdbbd9-b4db-485c-a9eb-9fe2981df8df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684972892, "uuid": "3bc24dc4-3dc1-40f5-95c8-d998f10323a4", "value": "12288:Zf8G5m6lwcoe011m+xrN2uFqZ2SOXdXHcJtTSotUZ/34jWe3/zeUh7nePdlfwO7F:ZUkQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684972892, "uuid": "8c5ea632-3f23-4339-b3ce-171c44f1c8ec", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684972892, "uuid": "7fbf7d25-a837-4911-a9b2-6a42d06787c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684972892, "uuid": "b4383e00-b58c-4b04-a8a1-063c610a9027", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00caebf-fb19-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685032380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032380, "uuid": "78dcda67-239c-4928-8370-00712433d4a9", "comment": "Malware payload (RedLineStealer)", "value": "0e2c36eb5acab1e23934e9464363c3f3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032380, "uuid": "ba570e1b-4b7b-4e1e-9eee-7493ee89a1dd", "comment": "Malware payload (RedLineStealer)", "value": "f50da55eaa745a7d2017eded3d9edcc93c51f6df1cdbcbb12899ff42e27203b8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032380, "uuid": "1cdf83bc-8768-4611-8c61-d40a7fcb75e6", "comment": "Malware payload (RedLineStealer)", "value": "907ead5ad178deca215ad29a7d7bcdc9256162f2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685032380, "uuid": "d0e0c24d-92a7-40b2-91f2-a091b7f02dee", "comment": "Malware payload (RedLineStealer)", "value": "0a30b3ec3e05ee441a0bccbeb96ef0f0c5035812904ef320217981815d0f4e50a2e3ad5eabf70000a9b2fcaa5be8b0a1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032380, "uuid": "f06c8547-162a-4a6f-bd89-a52f23e26339", "value": "T159F41223B6C09035D8A527B004F213970A3A7DB09EBD82672796DD5B0CB3ED4A575B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032380, "uuid": "7099d457-f167-407e-b5d1-45359adf3992", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032380, "uuid": "60afaf36-4b82-4de3-adc9-4bc7f027c475", "value": "12288:nMrty90ws9i1pQ3K75Etli5Z/RPWrCwiqa4EMnDsaIngS+faavJsjWeEO:Gy8AQ3K5EtM51pzRaInf+Cksj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685032380, "uuid": "34df1c71-2a20-4096-ba32-c2311022a32e", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685032380, "uuid": "2d0f7dc5-8769-4435-830d-8fc214253147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685032380, "uuid": "32079355-c943-47e2-8d70-2c85875dd29a", "value": "03359499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35d327b-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684996791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996791, "uuid": "20f754ac-6995-4739-932f-d4415353567f", "comment": "Malware payload", "value": "3d02dc8bab92b6ecf7b9bdbd8acaea12", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996791, "uuid": "58384a44-9cb1-4296-9bd1-e7b78972ed86", "comment": "Malware payload", "value": "f528a6bdf341e2d9ad1939e72cc58d68e001f0f59c8714d4a63c1e2bc98ed40c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996791, "uuid": "214d1e40-672e-467c-b705-c5963d729a3b", "comment": "Malware payload", "value": "37d49b9629ced8bf373f979bcaca465908ddb155", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996791, "uuid": "0d9b62f7-237f-48f5-97e4-3116a63160ba", "comment": "Malware payload", "value": "6338480562fedbab05f6c6c364a07e1f1dea005a51f6fe3ed2bbf2581aeae8a97e8b643ae9d971240ef527ebf88193fd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996791, "uuid": "d7f71773-1c59-44b8-8e36-2fdf9c786efb", "value": "T1C76487844B2529A64B5B3E32B730A4A5EBAE1E74C2D4468FF45F3261F7DF94CC8D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996791, "uuid": "9d8a2717-d4bc-4f60-ae1b-82fba7cef8ba", "value": "3072:jdGAL0FG3xzQWSWUe2xlQFXhFvIrOEV9N0yOi9ZVYnM66mf6u:jD0FGBzQWvU7xlQxvIkyOi9Zmzf6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996791, "uuid": "eff0087b-5ec8-4ce9-a143-1d6b3ba105ac", "value": 321106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996791, "uuid": "276702f8-5eff-4213-aa1e-ec0a777bea9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996791, "uuid": "fc801452-c7f3-412c-bdcd-9b69b23c513c", "value": "horrificationLo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47887804-fb27-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685038164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038164, "uuid": "a7d2201b-d7c4-443b-817a-8d02a191757e", "comment": "Malware payload (RedLineStealer)", "value": "09aabe0a848ebe12be2bcbe5e28211e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038164, "uuid": "c6460347-5fca-4be4-ae19-3fc6743ab372", "comment": "Malware payload (RedLineStealer)", "value": "f56615e18eba1421a7f0592931c57234abf5c031ada2efa7794c35ee4678a50d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038164, "uuid": "fda9f4a3-3526-48a2-a6f0-bbee4770d65c", "comment": "Malware payload (RedLineStealer)", "value": "4a73807f2d37540a77dcefc5f2c4af852e64cdba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685038164, "uuid": "07ae38a0-5920-48a2-94cd-aa3843f43bef", "comment": "Malware payload (RedLineStealer)", "value": "2e7891ad3d6b0a1c213178e817a1727010150c15c1722a7425bf67f88ef14d8c5a465a04655dbf4554356cab5918da13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038164, "uuid": "be37ed1a-ad07-45ca-a054-4cecc842f0be", "value": "T1E9F412436AD88173D8B50BB088F307971B35BC905DB8876B0356AF6E1CB26D8A971737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038164, "uuid": "f2ff3470-53c1-4244-99cb-ddd27039ecc6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038164, "uuid": "b92d3e9f-869f-4395-b505-d4c94675126e", "value": "12288:gMrby90pV3Yeny4gMOjjaJddNwdOukaV1tDj29jvaH5UrgS+fyavmusjWAEWOvsC:LyKnrs609j29jv0Grf+6VusjXIsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685038164, "uuid": "b3044103-8759-414e-8d4c-9c0a7ccdc726", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685038164, "uuid": "76f28474-f252-4873-b2b1-e37224bc8d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685038164, "uuid": "33ae5b93-6602-42e4-8300-5959c9e0a4fa", "value": "09aabe0a848ebe12be2bcbe5e28211e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbae7ac-fac4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684995550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995550, "uuid": "c511d4d1-5576-47b7-8531-3410e392399a", "comment": "Malware payload (AgentTesla)", "value": "665306cd3cd54114d2660d34e4af9e5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995550, "uuid": "d772fd3c-a569-41ee-be13-301bedbeb386", "comment": "Malware payload (AgentTesla)", "value": "f5c8db78887b77ac7d3293e8606ed0cdcfb045e1bdaefa2a19adc202a192ba08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995550, "uuid": "ed0a6168-0aa5-488a-bf8e-cd109fb80c2a", "comment": "Malware payload (AgentTesla)", "value": "8ed608d088992af7e489a7a35218f07727a7b4de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684995550, "uuid": "5a66f47f-bcdb-4bb5-a8dd-33e6c5043881", "comment": "Malware payload (AgentTesla)", "value": "7470734a70311ce944f7609a473784479c3aab58568d967d96decff1b579ed5df419db3693968478f10bc8cdd1d9512f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995550, "uuid": "6ab6f016-2f1d-43f9-b9c2-a6e3425485b2", "value": "T1D9D42361272D5582C4AF6B7808241179237D5FDBB412C34B1DA2B2FE5F6DB0F46A0E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995550, "uuid": "13b61af1-e3e6-4aac-8e89-a42557e48222", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995550, "uuid": "85579bc2-9bb6-48c8-96bb-e61d9ad67bee", "value": "12288:TxtPplTY6RhKuQlHhEYxht2rIvbCEy+EvUeOPkXthRku8D7c+F0+Gb0U5MxFkQvb:TxJTDEvHhEGOAuEy+KthRkdDH0LbYLbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684995550, "uuid": "36b0a767-94bb-4a4d-8de5-badb90a0ed9e", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684995550, "uuid": "06555f54-b08f-43df-8810-e59670256bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684995550, "uuid": "90c42fa9-5a45-4f32-9a50-42022f1943c7", "value": "665306cd3cd54114d2660d34e4af9e5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455b4fd7-faf8-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685017974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017974, "uuid": "38641f09-2ce6-41e3-ac7b-38b920d79845", "comment": "Malware payload", "value": "4dd6250eb2d368f500949952eb013964", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017974, "uuid": "30d328c5-41a4-4612-943d-4c4b84e4557e", "comment": "Malware payload", "value": "f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017974, "uuid": "ab78650a-8b84-49b2-9d91-d5a10bccd294", "comment": "Malware payload", "value": "6802e2d2d4e6ee38aa513dafd6840e864310513b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685017974, "uuid": "35da45eb-c93d-42fa-9f55-4dc5ce5f76eb", "comment": "Malware payload", "value": "0cd8bcb0c7a516d810ba747e4728a5390a9e72230e519db9ff6f3dae7e3cd6040db8d8c875ea4e58d20a9e5539d1a553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017974, "uuid": "0ef33769-88f3-409a-9efc-9058fcaf6a5f", "value": "T1D3B40287E9D720F8E4BAD47DC196713BF9B3B9945236BB4B9A6108038B11B24B73C705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017974, "uuid": "cc3951d7-13aa-4d1f-a690-95baca5cad00", "value": "8d070a93a45ed8ba6dba6bfbe0d084e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017974, "uuid": "64def54d-5f09-4882-acf5-364728e7687d", "value": "12288:CU0WtROJHxhcARkdiBeVKa+aA5KF6kgLMXx3:ChIARgdGeVv+f5KF6kgYh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685017974, "uuid": "2951acfe-9218-4a66-9b05-d49fac32ccd5", "value": 530016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685017974, "uuid": "7a433865-e694-473d-b459-9d9b84f2c99e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685017974, "uuid": "269978ba-d273-4270-a124-1d06c7deab5f", "value": "f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2008a73-fb16-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685031014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031014, "uuid": "1049acf8-297c-4c81-b440-c677bbc7dc5c", "comment": "Malware payload (RedLineStealer)", "value": "c5880f6c962511501e57fa808cff4034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031014, "uuid": "00f2538e-fa3c-47ac-917a-43cc9e93371f", "comment": "Malware payload (RedLineStealer)", "value": "f6c6ee8896fa53e7727e2239a5c10873c42f12af44dd95d1b4ceb65b99bf50a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031014, "uuid": "b34be1e7-b5ca-4a35-b06a-63640978e9dc", "comment": "Malware payload (RedLineStealer)", "value": "46cdfc3a499c3a5bb3b75b710bbaffe5a0faa3ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685031014, "uuid": "77d2f355-eb38-44ad-93be-007063d0a7d3", "comment": "Malware payload (RedLineStealer)", "value": "706d734c551a871cbdaf9fd6a9ef008c35d527ba1593226fd4aaa22cf098625603a6c479294896ff4496d77642eca29d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031014, "uuid": "aff27f23-7eca-4a8a-b45a-70023834b25a", "value": "T123F41242A7D85173E8B227B04DF613D30F367CE18D7987AB2796AE1A1C726C0A531736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031014, "uuid": "a00ab5e1-60f7-4022-8b4f-544452be99df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031014, "uuid": "cc6dc54f-d3f4-4490-a285-2bf30ffd22d0", "value": "12288:nMrOy90hR0LVfyuRHJS/6ogdbNSQpJ22Um1Y7Uvg/GADC+Q+fIav+2bWTEY:FyCRafyuRk/6og5NRpJ+mK8g/G7j+ApD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685031014, "uuid": "f6f3f5f9-dc8f-49d6-9c2c-8d9a40213ab4", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685031014, "uuid": "a0635abe-63b3-4be3-ad47-629a0ae87e7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685031014, "uuid": "7662c7c8-c7f6-4bfc-b8f2-990cd3e32e4a", "value": "c5880f6c962511501e57fa808cff4034.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a323ce-facd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684999798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999798, "uuid": "315fc1ae-b2a7-4987-b641-781ca6a20d17", "comment": "Malware payload", "value": "a1d744a1236072a2a1159d465964a5cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999798, "uuid": "08470b21-b0e3-4c5c-9ad3-9d24a77cebac", "comment": "Malware payload", "value": "f73f7e3e747ee57a18907b301ab1b1c0987a6c7b7faeba397bc70041475688e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999798, "uuid": "8dc63ffc-858d-40ad-af44-2d8a4a5eb0d8", "comment": "Malware payload", "value": "f4ebaf08eb8b097d102f5c451e5a0a1cfd94c694", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684999798, "uuid": "5ab206fb-3aab-4806-96a9-185a4665fca9", "comment": "Malware payload", "value": "0b812c1b7bf01a3e51a013185486cb28460c0e488e4f5f9de5ec2582adaf0347a39dc067cf4554472a0a99218fa315ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999798, "uuid": "50863834-e542-4ce9-89cf-c3b96256a6be", "value": "T1AE767A493AD508DCF8598F729BA403A833DD33339BAC0DD6B6080518B76DDB94E5DB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999798, "uuid": "53e54537-c633-4c35-9c58-58ec6ea4acde", "value": "d14ac171253cf4e289cd276f47898b08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999798, "uuid": "1976395f-eef0-4951-ac14-5b8cde7ff8bb", "value": "98304:n4Zr2Xtrb/ipmWswLXZdIuBHMiNhajr5TER2n4EAQWcdOIyyTUeuR1zk:QQrb5WswjZRMakjVER24EocUIyaUxzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684999798, "uuid": "64e5a909-5943-4ff9-b08c-5a5c433c1c5d", "value": 7319040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684999798, "uuid": "3cfabad3-422b-4cba-8b34-6734f63876ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684999798, "uuid": "41bad128-bcb9-4098-9c5b-ca5057181bdb", "value": "SecuriteInfo.com.Variant.Lazy.345052.5482.18383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4105bdf0-fab3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684988331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988331, "uuid": "bc5e29b3-29d2-431b-ba86-b6fcf8301d41", "comment": "Malware payload (Quakbot)", "value": "34d7a74d8075a6a5e515e2e79418ee58", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988331, "uuid": "138ee48a-7748-4f08-9174-ab28eb7f86f1", "comment": "Malware payload (Quakbot)", "value": "f75773f4c539a154294104e0a7ad83fc7a96aeaef46c3b2c10b5353c9f833945", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988331, "uuid": "4964e018-deda-444e-90f1-df940ba62a61", "comment": "Malware payload (Quakbot)", "value": "3aa45bc7ebcb33924132bbbb3fb21d7418850dbb", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988331, "uuid": "3d7dd3f1-65c7-4685-9320-aafa14861199", "comment": "Malware payload (Quakbot)", "value": "94379ce048154f9e25aeda7df0a2407882b2ba920e9411b4994f302f15e015aeca9c6ecfe2281b09c74fb43adf7c4c45", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988331, "uuid": "45943958-3503-417d-868c-3bd1e85cf5e2", "value": "T152830A1F6340133956620235664F6AE6F3B484787A22DB74A49EC2693351C38D7BFAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988331, "uuid": "a02738bc-962c-4999-9e9d-91ea417c30d5", "value": "1536:DZ3NlDhslmeSslmF9lDhslmOmdlPl3DkDTm7JDH9YUcbnR43MaaB2MUkGA3:13NlDylmeHlm/lDylmOmdlPBkD+H9YUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684988331, "uuid": "2a56a443-3d81-47ee-a092-3e744d35af00", "value": 82167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684988331, "uuid": "d8435e11-8b6d-43d3-b2d7-644306d78b0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988331, "uuid": "e81ca141-7de3-4e25-86ef-d818ff34fd47", "value": "Claim_A207.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcf5a00-fac2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684994795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994795, "uuid": "ce475672-72de-48be-8ac2-2f31c20b4b50", "comment": "Malware payload (Quakbot)", "value": "b044bba15ecb403f2b5cab928c4c4da3", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994795, "uuid": "095b24d4-947c-49f3-b8e4-d444f43f608a", "comment": "Malware payload (Quakbot)", "value": "f8ddc8c5d270a8330141891d4e425c7f3f87821f9789cc9d92f1bdddaaf7d378", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994795, "uuid": "2d89dffb-2f66-4c99-8619-7b4173854874", "comment": "Malware payload (Quakbot)", "value": "34eb20551ab042b0cb696a67b44eca28516e996e", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684994795, "uuid": "1d5ad7f7-7093-47b4-81cb-2fa08b5833e0", "comment": "Malware payload (Quakbot)", "value": "b9f997a5006ea615a99832d48f7c1be33d0989a70dd1cf21ea28926146499813f7bf57b5251af9b3c78c767a3e607a57", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994795, "uuid": "f9b8b80b-fe2a-4e8f-bd99-fadaf51de1f8", "value": "T1DF532A5A93810378A9210214964F66D1F7A449387B61EAB8F48F83DD37519BCC2FE9FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994795, "uuid": "d4ec8855-0cdf-4b9a-843a-c5a1edb58ae5", "value": "768:ij2kWb9dHHq+1ZOWqOpnwaDFW9LRZBmUfVdF1LEVGRKIy1Zc4kRz1ZOe:ij/6HHf1ZOWnwisVvmUd1lK1Zczl1ZOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684994795, "uuid": "4f56f134-f41d-4d07-aeaa-0d47fdbee9a0", "value": 65587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684994795, "uuid": "00a6c3a5-6d7f-4164-84d8-8fd736c1c0e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684994795, "uuid": "d1e06b36-af99-406f-9968-fb3f8c4f7fe3", "value": "Claim_C397.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85489b14-fadb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1685005625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685005625, "uuid": "fdf0da3d-ceaf-4241-aaac-11428dde1633", "comment": "Malware payload (ModiLoader)", "value": "b2e84f2375a8fa6b6d6634afe0f915d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685005625, "uuid": "b4f2ea90-5dbd-4585-8ac6-d8322ed2fa3e", "comment": "Malware payload (ModiLoader)", "value": "f908905ade4100d20249cbcb62cbe7a03fc57ea9e8bdf4c50c3c901aee3c449e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685005625, "uuid": "424223d4-2ae1-41d9-ae81-f85b34a01818", "comment": "Malware payload (ModiLoader)", "value": "7f6d3b418ce5c520645f5afcf1c40e1786d65f33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685005625, "uuid": "2eb60e09-d3cf-4c5a-8747-7d9a366be59e", "comment": "Malware payload (ModiLoader)", "value": "54c4a7f5557155f4fa9efde193cc114a158ef9954b0d9dcd0c836cd539573db61feb87c238a9dccfef8c4a93c67dc3a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685005625, "uuid": "ed26326a-3724-4f7e-bfff-bad30caa8cb0", "value": "T1D135AE62A3F014B3E12A28355C5BD7A8591D7E102934740DBFE63D98EF3B2827DA41D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685005625, "uuid": "58026d0f-e3c7-405a-98e7-c92d60c9c2ce", "value": "b3b7f3046623191c43621fd310d374b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685005625, "uuid": "02ce3952-f4e3-4486-958c-3c2e33e37751", "value": "24576:SSWrMz8C3kJ+VnkaJ56TxIN84Mm/31fb5GJ:SS0o8YXMFIN84X31fb5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685005625, "uuid": "76658f45-f804-450f-8e16-86b1f1757b69", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685005625, "uuid": "5481bea6-40aa-4f56-9aca-1067b8800834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685005625, "uuid": "2080fb64-df76-477f-9d9c-1baf177e3661", "value": "BL P.O_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c10008b-fab3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684988269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988269, "uuid": "7acbbb7e-8930-46ff-8e29-02946c0afd6a", "comment": "Malware payload (Quakbot)", "value": "7c4a4db9ae788c921fe23d568f701313", "object_relation": "md5", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988269, "uuid": "a8931eac-7f5f-45de-a960-cf7443f5c5da", "comment": "Malware payload (Quakbot)", "value": "f91e7056b7d808b8056280315e3027c4705ae6f3ebfc0c14bb5589fc70db9e54", "object_relation": "sha256", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988269, "uuid": "45a190f9-8ec7-46eb-ad9a-9b055fff1755", "comment": "Malware payload (Quakbot)", "value": "9d02dc942d4b3b11babfe10bb1151816a70ff435", "object_relation": "sha1", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988269, "uuid": "8de6dd7a-99b4-470e-889b-f5bbfeee0749", "comment": "Malware payload (Quakbot)", "value": "3b46b5a17c08e5ac8ebddd5345c52d9ae51cef7d0ef07a3f7b569a03f91c0bcd2e6db8439cd697111d86d65fefcea40f", "object_relation": "sha3-384", "Tag": [ { "name": "Obama264", "colour": "#1A566D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988269, "uuid": "ab78b3b6-fb35-44e3-b461-548b31406b51", "value": "T10A730A5F6380133CA6604236640E66E5E7D148386B72CF38A85DC66A3362D3DD6BE5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988269, "uuid": "d9b62119-fc3d-4e9a-b030-5aad6090940a", "value": "1536:flMUaBiXF8n4qUmOTu74Vn4h7wZy8Q2xQ1T:NM3KFizY4h7KFt+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684988269, "uuid": "ca2244f6-688e-48a0-a85a-69ab6309b59f", "value": 77675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684988269, "uuid": "e5d49768-bada-4395-87ce-c5fed022abbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988269, "uuid": "0be3ca23-1512-4b41-8a58-60c6c6ceac59", "value": "Claim_D735.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f5ea0c-fab4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684988979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988979, "uuid": "fd8d3125-5266-4001-9e64-6e4dcdb2fb32", "comment": "Malware payload", "value": "bf0ff9a11d747209eed04a9f3e9dea1d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988979, "uuid": "5dbde9b1-3a2a-4c35-b3c8-02c3af5289a3", "comment": "Malware payload", "value": "f96fcc679ad35189a567a1d887ae0bfe0ad1026c97036565c3e0406da2bac8e8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988979, "uuid": "4ae03274-8f38-438d-b2d7-3a93389e2062", "comment": "Malware payload", "value": "356f227818de88d853138782052605411906f805", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684988979, "uuid": "ac0a7d80-327b-4071-9497-6032cea68bd9", "comment": "Malware payload", "value": "2a015e75109ecc2dd99b29512e5b2b2ad067e75652c224ded1392b33fe224968e20ae88f5fb628b0fef94974c0c73735", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988979, "uuid": "c5588a5a-662c-4504-ae04-6c1914af2c98", "value": "T167767C493AD508DCF84A8F729B9503A833DD33339BAC0DD6B6080518A76DDB94F5DA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988979, "uuid": "122937b9-0e9c-46d8-b14e-b225d8c5667c", "value": "d14ac171253cf4e289cd276f47898b08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988979, "uuid": "2c8448f0-938b-4862-9f19-61820cc576e1", "value": "98304:VZdCAQ1rf3e1s1NewR6+CSNIKrbsGCD7BNO8KwWViPUp111sU1o8HeeGrjlLNu:VUrfOGtvCJKcGAz6iP12rGrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684988979, "uuid": "67c58763-a41b-4fe3-8815-69a856b8c650", "value": 7340544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684988979, "uuid": "cd98e62f-4a2e-4874-897c-68f688848f5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684988979, "uuid": "ce5d44bc-5423-475a-9799-e69bfe515b60", "value": "bf0ff9a11d747209eed04a9f3e9dea1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5ccd00-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685003735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003735, "uuid": "6cedfc64-d1c5-4c07-8c18-87da15ba92b6", "comment": "Malware payload (SnakeKeylogger)", "value": "b633a7517b6cde0d653ec950c4530309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003735, "uuid": "849565a9-087a-4b5f-a8ab-f2099b81c317", "comment": "Malware payload (SnakeKeylogger)", "value": "fc53b0251de8b02561bbee38000c9d207388c7846c3f906919fd4eb299e7c995", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003735, "uuid": "fe62f04c-8cb2-4f93-a7a3-4295b072d6a3", "comment": "Malware payload (SnakeKeylogger)", "value": "d6c8c798997800252e81760a1afec3f03216f7ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003735, "uuid": "90f8e906-fc99-4211-9653-a948ef04b955", "comment": "Malware payload (SnakeKeylogger)", "value": "d707ec88d465999a416e280a90c5327a342119fe07216495abb646142755131a1788c61cdad2942fe23b641bc78f2c93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003735, "uuid": "c4c8d1d4-d690-4c35-bc4a-e324bd0bdda0", "value": "T14CE4DF1422E58B4AD6BA83F15CE0E2F01BB95D8D703AC30B4ED5FCDB72A9B910751A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003735, "uuid": "3934b1ef-5865-4d3b-9429-fff03e141ab2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003735, "uuid": "cd43becc-8a0c-41ef-abde-6d4a6ca4a448", "value": "12288:1qB6we7HRwhE7rWdjqsqK9gpjTeL+21k:1qYTwS7WjDV9wg+ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003735, "uuid": "ed992871-f59b-404a-9661-ffc99b2581de", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003735, "uuid": "cfae1e5a-459b-4364-9bcd-a79d73d293b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003735, "uuid": "649cb896-6764-40e6-bc81-3b0f88863fc9", "value": "order6566546663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b795d7d-fad7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685003703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003703, "uuid": "ccc4331a-25f2-449b-8819-aa2512a2c91d", "comment": "Malware payload (AgentTesla)", "value": "c647882478f1a6444655cb18f24b2114", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003703, "uuid": "801149e3-c147-41ea-9632-b2d7a547a126", "comment": "Malware payload (AgentTesla)", "value": "fcdf163e514b0aa3364e9da405c1d7bc249d7b870482392e590e8d4f37eae529", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003703, "uuid": "f43ec717-8ac2-41fd-820e-f647c3312b6f", "comment": "Malware payload (AgentTesla)", "value": "affdccd1fb1f9e5be972f2495983a25921a3d7a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685003703, "uuid": "4671f0e4-60d0-4a73-a107-4853fe3eb34c", "comment": "Malware payload (AgentTesla)", "value": "9011e7fae727259cf2a8de0a14529b3f6b1c4a35aa0c406825d1f38443bccf13b833725787a01998c44896437cdd7cfc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003703, "uuid": "8b337c4c-313b-4ace-9ea6-f3f27f586089", "value": "T1A715A37C86B60DB6D2F7C7B487C4B817BA6CBB73B0485A2540D1439D026F962B4DE42E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003703, "uuid": "21362b9c-b270-4346-9a5b-1d665c62218d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003703, "uuid": "f4cf6fec-716c-4205-afdd-59c577180ac2", "value": "12288:HiZg9nLiTB2QwqGuuOxr8AXJXu1O3VcuAzSlvN9J6etGdXqP:8jFGuuOJVJEO3CuZlvNnKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685003703, "uuid": "262b3e30-da85-47ae-8ac8-e9f7ec735d01", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685003703, "uuid": "624bf804-0d64-46f7-9619-aa588675988e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685003703, "uuid": "19aa9b5e-64f1-4d29-8f3a-d62fb62553f6", "value": "bank copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3d1034-fafd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685020267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020267, "uuid": "1a476f27-ed2d-43f3-ae8a-adf259d7fc98", "comment": "Malware payload (Gozi)", "value": "7023e0216b091e44fa43ef32a4eac096", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020267, "uuid": "b9088545-f0ad-422f-80d5-2761423b46a9", "comment": "Malware payload (Gozi)", "value": "fcf194e2fa3bacb8ee950e8da5f02f93c82702607bb6b97def05b215c3f47083", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020267, "uuid": "11f4cd5c-4199-4695-8499-facdba6fb314", "comment": "Malware payload (Gozi)", "value": "426649c2297928ed6d6a397cb4db8dabcc25ecee", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685020267, "uuid": "1dc5dac7-ff23-4ecd-b9d5-de036e4b8d37", "comment": "Malware payload (Gozi)", "value": "99812039ad7b48d20570df942c43a7b7e28d014c858f8cfa4bea636c3f1437b49cd7ac221e7de6fc84892bb140dd3b08", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020267, "uuid": "0b51c5bd-c150-4aa1-a690-729613ba7ef4", "value": "T1D953E1AB92F8340DC8C90EF4EE9534468948F2726DE915C531AE09EF2F4DC589E99B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020267, "uuid": "35051e52-756a-4449-ad52-dd80f7973cab", "value": "1536:d6e1tl5HFj1f+2DOo5B0gGUzcPtwTtlScK3ku:Ee1v5Pf5GccVs3yX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685020267, "uuid": "cbaf4410-44fb-4c54-a0a4-9742094346c3", "value": 63948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685020267, "uuid": "18d9daa5-ea0b-4903-b580-c225278fff84", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685020267, "uuid": "ee7154ce-fa21-4467-8c19-299239d4315e", "value": "comunicazione(1)(2).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c78565-faf3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685016006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016006, "uuid": "e0fa8371-8c79-4f2a-b122-377af215d4cb", "comment": "Malware payload (Quakbot)", "value": "f08da2c34824135738b3a70ee4d6fc0b", "object_relation": "md5", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016006, "uuid": "3069d78b-2e36-465a-b9f7-461d47fdf643", "comment": "Malware payload (Quakbot)", "value": "fd3df8d7538642635224a8a2dfecf98667634cfc8c889df027eddc221618c1a9", "object_relation": "sha256", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016006, "uuid": "f8a1aa22-de90-4d86-8f32-06fa289f106b", "comment": "Malware payload (Quakbot)", "value": "38a881c5d7b49919d894ea004e833ab999d830d9", "object_relation": "sha1", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685016006, "uuid": "29557fec-d3a1-4208-9d7d-a9e689784ab2", "comment": "Malware payload (Quakbot)", "value": "9998c7c12d8f9a7a3cdae96cad1ba1c9a2869a8cc64aac3a7c37df02041719ef8c53da35fd077c9d11d39980177ee584", "object_relation": "sha3-384", "Tag": [ { "name": "1685000185", "colour": "#CEC6E5", "exportable": true, "hide_tag": false }, { "name": "BB29", "colour": "#C3C01B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016006, "uuid": "fa24121e-d4b9-459e-98a5-08bb62109f0b", "value": "T1E715D413F592AD67D7E812320091F5355622BCBCC3A31AF73EC476FD39A69405F6AA20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016006, "uuid": "bfd29c14-c91f-4c23-8c28-5fcce4395cf0", "value": "69b5a2b4c355363112fef443743090f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016006, "uuid": "454b4b4e-695f-4482-9b4e-7b4e730be536", "value": "12288:COysJ5nhFvhxaiz8hC6CSvqdRcVU2cQpbls6csdCVsM39:fhFhxaizH6CCqdRcRcQpbxFCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685016006, "uuid": "b24c008a-8a89-4fe9-bc2a-347374ff5286", "value": 951835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685016006, "uuid": "a2668895-1822-4606-954a-749d5af2caa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685016006, "uuid": "363a0af2-bb42-438e-a5b4-f1054bb01269", "value": "kxyj5.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd038c6-fac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684997825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997825, "uuid": "ce9514da-2aa3-44da-9ef6-ef148091b54d", "comment": "Malware payload", "value": "e8c077f0c1ab3188dc4354284f07d16d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997825, "uuid": "48289b99-f350-46e4-a2ce-50e4578ad1e4", "comment": "Malware payload", "value": "fded8518b15e3198239fbe45f5c5b62502a2c1b51589e4601e68423e59560bf6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997825, "uuid": "a1e14092-ac03-4fca-ab04-d24712a78861", "comment": "Malware payload", "value": "e3e74b2491fbed183b065f187dcfdfb734c773e9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684997825, "uuid": "34c926bc-8b64-46e7-80bc-0401e43014aa", "comment": "Malware payload", "value": "c11fce6ce24877dd297c5db65f595efa2552deb919e53415bcbd90cd21ddcaa6594a5cb8e21e75e5b12c29c846469fab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997825, "uuid": "9d0074a6-7e1e-4856-b46d-79fb693f2d3e", "value": "T1F4648680471518B64B4B7E26A73094A5EBBE1E74C2C85A8BF45F7260FBDE98CC8D1731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997825, "uuid": "ced4b9f5-a77c-4119-8889-ea6267083dc4", "value": "3072:+wxJVveUosCBgxGEYmtBWV0529QFTmdf4QkjK0gpzEUYDZl+5:+w1vehcxGEpt529QFTmARbgpzE/DZI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684997825, "uuid": "095531c5-2b7c-46a1-bf3d-307933a3d354", "value": 336082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684997825, "uuid": "729ed3a2-12df-4075-8b40-782906bd217a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684997825, "uuid": "2868f45f-9234-4afd-8aa4-e28a2a5c4d8b", "value": "Reflexible.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a1231d-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996662, "uuid": "5d8855ad-db13-4dd8-b0f9-7805df1a9c5f", "comment": "Malware payload (Quakbot)", "value": "b5cba8350c25d2d5b1d38d5681354814", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996662, "uuid": "fc118211-a5da-41a2-a4b9-56cbc33372d2", "comment": "Malware payload (Quakbot)", "value": "fe1e5685e880b6f9011510612444aa12b20dc281c3e2bc09257a0f35ed7374a1", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996662, "uuid": "949d0326-a31f-4a1a-95d3-aa260fe3e28e", "comment": "Malware payload (Quakbot)", "value": "f91402afd902d32f8a0df02a2b9d151403370ac4", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996662, "uuid": "0ca70733-1877-4516-bdd4-b33a3d436500", "comment": "Malware payload (Quakbot)", "value": "83605298c19dece0fd87ef985ecf9e03fbc2284af272735ba5ab2fef13996fe0558777825e773a7a806b8967e3e416dc", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996662, "uuid": "102b48fd-5890-43b7-966e-ce14196ef67d", "value": "T1AF63195FA385133D65610225650F6AE1E7A048386A32CB78E49EC3693352D39D3BF6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996662, "uuid": "69825d7c-adc8-400f-b772-b4fdf210d00a", "value": "1536:B+lh8nVnCfKSxckqFmmTjLucdlDCs8ApGWP14Zl3DJ3:BRVnCfK1F3umlDCs8AcWyBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996662, "uuid": "f17db4bf-f05b-4f00-a97a-ca46423d5d4c", "value": 70878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996662, "uuid": "48ae758d-0eda-48dd-ae4c-2db77b2d6c88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996662, "uuid": "f040b95c-c647-45ef-9036-c1625663fbf3", "value": "Claim_C897.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a010a410-fac6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684996651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996651, "uuid": "574dc05a-84fe-4a61-a3e0-c02adb56a56a", "comment": "Malware payload (Quakbot)", "value": "46b388234cdcb44f534388b11cc7a476", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996651, "uuid": "f8e793b3-a9f0-448d-bd65-46ac820264b2", "comment": "Malware payload (Quakbot)", "value": "fe76cdafa9bbcaae14373b41b26bdd2bd0d0ee393e151ae20a2d685c1de41afb", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996651, "uuid": "428cf0d5-96fe-4762-ba44-65927e684043", "comment": "Malware payload (Quakbot)", "value": "690c0d704b6cd7654bf6124a9992680dd40b956c", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684996651, "uuid": "bc82d438-7646-4fa2-af12-3b763c481b53", "comment": "Malware payload (Quakbot)", "value": "62e1ee61134f460982fe10b6bd774ac5e2d649e173e993910c38e91f22502ab28d831a5a0443dff91943135c51e2cad5", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996651, "uuid": "d5413f0d-1d30-47d3-8bfc-5353400285b9", "value": "T19363096F938003396A220264254F6BD4B7A544787A37DB74A49EC2693312C39D6FF6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996651, "uuid": "f7d7b966-7a7e-46da-95ce-a3b5068e67f2", "value": "1536:7Bhx3vqUaBfxvimTbrAJXOlDh8lmq2ZyUCZON16gQt:9h83fJmXOlDGlmrZyUCZONFQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684996651, "uuid": "c40bc613-6884-419a-982b-442614a21e96", "value": 71227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684996651, "uuid": "633d4f1e-0f6f-4100-ac41-c13074dda773", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684996651, "uuid": "bfc11cbc-faa1-4671-8cb5-8ebe74521447", "value": "Claim_C082.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527c9f3c-fa93-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1684974616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684974616, "uuid": "6f679a37-a56c-4514-a40e-5b0fb626b234", "comment": "Malware payload (LaplasClipper)", "value": "4482bb2674adc80b247a13e6901d6945", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684974616, "uuid": "77af62c8-f258-493a-ba28-914e57da43a1", "comment": "Malware payload (LaplasClipper)", "value": "fe9ba02801cb37e7d2cf6a61f705eca55d9f442d91e3c880aaaf782724aa0559", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684974616, "uuid": "2ea7db70-1619-4646-af16-ef3d45459354", "comment": "Malware payload (LaplasClipper)", "value": "1695c334b65c21cdf28eb592dba51c87f1a769c4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684974616, "uuid": "550aed88-33d2-4e02-93e5-9fab2f4a1b3f", "comment": "Malware payload (LaplasClipper)", "value": "9649ebdbbff80f8843309698925f6541131c178c66f1db0cc61fb3178f790e5bcb69843ae0f9a37d76ca8ecaffc94080", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684974616, "uuid": "e5941e7b-39a6-4483-8550-2efdf3ad6777", "value": "T12957F183F8C552E4C0AB8130C18242D776A03C9A8BB953D73BC5BD133A71FE95A79766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684974616, "uuid": "be565864-f74b-4c5d-9b03-b5d3a1498eae", "value": "9da18038e0ba9a33fbbaf76636ea1aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684974616, "uuid": "779906d2-7422-40df-ad4e-029cb1377d2e", "value": "393216:7FkkzYdVnfo+nvyzamYwCJwGBvy0/JhkWFI+aui9lrL2d6:7e/lnvaaJwGZyChp2+olrLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684974616, "uuid": "77f57e33-079e-4709-85b3-b7f0e8c02948", "value": 27205848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684974616, "uuid": "5c2d2b9d-de79-4141-84cc-d8e5d501aa75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684974616, "uuid": "7fbab9a7-7704-407b-a5f0-a563d262a7a8", "value": "4482bb2674adc80b247a13e6901d6945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a84bdad-faca-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684998145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998145, "uuid": "ae8761a3-2db4-4b29-8658-3a77abdc434e", "comment": "Malware payload", "value": "bfb9598a7fe3a1de0c5fa0e0a994feab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998145, "uuid": "654c1fd3-1f0d-4c7b-8649-74811b3edab0", "comment": "Malware payload", "value": "ff0a8ffa449d0c0b89ef4784662a12461420afb79cffe77f31804cc0d1364cef", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998145, "uuid": "470ed734-ce11-4ef3-b0b7-9050aa3fd09b", "comment": "Malware payload", "value": "5603b199329c1ae81cf9d3c005347899dc4d81f2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684998145, "uuid": "b4063361-9ce6-4baf-ab46-724def0645df", "comment": "Malware payload", "value": "77a58ab0b629a7c9c7060435f4dd153d9a7dd908493f7d6e388d7787d534bb5f6d0c78cd8588fe4bf39dfc93cd309c4c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998145, "uuid": "65d3d1a8-5e05-40d3-a2b7-110f488bc016", "value": "T11A44A7804B5529B24B4B6F36A73094A5DBBE1E74C2C8598BF46F7250FBDE98CC8D1321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998145, "uuid": "fca1b632-3b9b-42ac-9dac-c4a1810583f2", "value": "6144:ge7/HTu1QmztyM14iGAHnfbGogxVMTF1+:SvfRN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684998145, "uuid": "c442eb42-7af0-42ba-b0f0-8ec9fb978182", "value": 274160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684998145, "uuid": "2ac12099-3974-458c-81a4-2b0def8a8eee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684998145, "uuid": "e8951aaa-e570-4648-96e1-e5780481dbf6", "value": "UnportentousAgo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5992cb84-fb11-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685028745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028745, "uuid": "81a3d144-68f9-4b8a-a27f-f8c40969625d", "comment": "Malware payload", "value": "fc995044329303c44447545dd9cbf31a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028745, "uuid": "91229862-7b96-4ddc-b241-c02d17e4ebb4", "comment": "Malware payload", "value": "ffc21c5cf4edce3f53bfef46e0f5d18991625c401861f88ef45599026e5f20f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028745, "uuid": "793d77eb-fbf5-405f-97cc-17accb23fc85", "comment": "Malware payload", "value": "8eebb05befdae644a3e5bb4048851a93eae85246", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685028745, "uuid": "e9a9d6ee-7d10-4774-a5c8-2e599ce98100", "comment": "Malware payload", "value": "284877361559cad153a072ecc71ba7fe4c57699afedc239e408fabc249701edd6b55da099a826dbeb4078205151460ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028745, "uuid": "a5bd255d-a7b0-449b-aa52-e2aa468f5607", "value": "T14F236D2226588F62C9D54B3A4D47CBC5C6A4E6CD53B3EE8B3B0D2A077F387406DAA104", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028745, "uuid": "707a62b4-96df-4679-9268-420a9e767d67", "value": "768:efOtt2zV1php3wRycElikRPu5TG/3djI:em+z8kP+Glj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685028745, "uuid": "a376947c-6281-4814-a310-9033dd62a359", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685028745, "uuid": "709d5d8f-6990-4dbb-aa72-724aa129d469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685028745, "uuid": "97e8061a-b797-4d7b-82a6-5ec722457a5b", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.12707.20071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }