{ "Event": { "published": true, "date": "2023-06-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-07", "timestamp": 1686182582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "82496d61-9e49-48c7-8f82-422c7b290d05", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422b8d75-0536-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686144109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144109, "uuid": "4d06bafd-328b-4fe1-b03a-f9769426b6ee", "comment": "Malware payload (RedLineStealer)", "value": "e14f2b4bb4e31dfceac1f4623fea0680", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144109, "uuid": "fadda475-264a-4767-a510-9c61a4d96953", "comment": "Malware payload (RedLineStealer)", "value": "0002265c95ece3434a760ae8f947e634eccbe117fcc06fc382d20784b39af2f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144109, "uuid": "84eda873-1f5b-433a-b965-f973efb96b30", "comment": "Malware payload (RedLineStealer)", "value": "68cfe51624db5d89eb8a60bed35d2f033dadc9b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144109, "uuid": "1c2b30f1-72ad-4eaa-80aa-9818f5bdd864", "comment": "Malware payload (RedLineStealer)", "value": "f896e809ed1d983842126aefd193ecadc3223d202d8e15e06a71e615ada705944a065e62dcf7c89a26cf78c79f361963", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144109, "uuid": "8c9fdf69-b279-46ad-8d03-6e031e83854b", "value": "T10224F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144109, "uuid": "36e241ef-8fa5-4104-afc6-bd482ac6c632", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144109, "uuid": "7edd363e-7871-433d-a645-c6fdb34a0b3c", "value": "3072:meTRJ0kHbnpN23kQKp5XzutZXKGrpeN84LuZAIybiy3xEfbi:FTR2AnpN2wDurXBeBuZAIMEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686144109, "uuid": "17c3a857-3a8f-4d75-bcdb-aa091eed8dc6", "value": 212332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686144109, "uuid": "f6101c20-9d4d-4cbb-ae3f-f4fe345e9a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144109, "uuid": "62fd7bfc-a7eb-4d21-90c1-151ee850dc7f", "value": "e14f2b4bb4e31dfceac1f4623fea0680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884cea3c-0563-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686163554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163554, "uuid": "ac435897-f0d7-44ed-97a9-7815032ff38a", "comment": "Malware payload (RedLineStealer)", "value": "955e2328790ff6b010486bfdb37c4fa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163554, "uuid": "9004f319-bd18-4d35-a36d-ca37251cb889", "comment": "Malware payload (RedLineStealer)", "value": "01483fe03fd88d4f6b8636fd8cb510177e2f19187627b7f46c41ff017763dc3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163554, "uuid": "eb2a891f-feb0-45df-8af1-f600ad269d06", "comment": "Malware payload (RedLineStealer)", "value": "f1fcabce12c13b4acaf283e27942b8681363791f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163554, "uuid": "fa44f75f-7f4e-4325-908c-1ab4e4a650ad", "comment": "Malware payload (RedLineStealer)", "value": "76e7dbcd6e27d10069ea303f2e1f70e9ddeec7dea4d9129722477eba78ba2baf654a19c9f46caa73e6fdc52ae6a27356", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163554, "uuid": "89ae9a24-1a43-4911-9b04-2d72f178014d", "value": "T108C41203B7D65032D8B927B028F607930B78FCA65A3853AF1789999E4C726D4E431777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163554, "uuid": "c6eb1722-53fb-49ec-ac69-47bb0b987490", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163554, "uuid": "544a1549-7d61-4551-b7b7-402000397b90", "value": "12288:WMrmy90/KryTuSA79+dnP1UeNUSBblAnX5+mVl:8yavPK9+dnPquBb45Vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163554, "uuid": "f0ce1fb0-faa7-4c0d-aa0c-449c361da513", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163554, "uuid": "b41de1ad-4229-4e4e-bf3b-00d026ecf87e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163554, "uuid": "8c416cee-6006-46ef-8355-511785d70384", "value": "955e2328790ff6b010486bfdb37c4fa9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1839af-053b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686146434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146434, "uuid": "7ce74886-bd9a-4c5b-8e9d-cfb0f603dbc1", "comment": "Malware payload (RedLineStealer)", "value": "6cb35df873c751abb1546c4e0621bfff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146434, "uuid": "de144ce4-4407-4b80-b9d0-bc8c219f11cd", "comment": "Malware payload (RedLineStealer)", "value": "0255a02c133cb1d514378732b2c7c99c107d69e81251a9fe6693b4dbe51a27d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146434, "uuid": "5edb6eb9-0669-4057-8509-b62698c28ab6", "comment": "Malware payload (RedLineStealer)", "value": "456563d99cfdce6408cf134a999b800357fb9107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146434, "uuid": "f42b89ec-5eff-4992-8ad9-4225a734d58c", "comment": "Malware payload (RedLineStealer)", "value": "06e8884996b2fc755c424e2564cde4bf07c4997f94bf608ec8697b8ab22011070efdec5907230d4147d83ee54d9a9b87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146434, "uuid": "f91fdc1c-2578-4b4c-8b45-2df25fee9489", "value": "T154F41256E7E89573C97113709CF60393063ABCA2CDB8936B37456A4D1873A84E67233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146434, "uuid": "23ea4d3f-21ad-436c-9ac6-e85fc87d3934", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146434, "uuid": "f642a504-d767-4041-9ed7-af2331edb483", "value": "12288:kMrRy904vIM7ci1HssJi+KjfOPOMcyMg7Jdio5Mf4bjVXnzgt+EvzO4/tjkol:dyToeMt+Kf6Kyv73ioCfAXn0fHjBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686146434, "uuid": "24b32b8c-8d81-449e-836d-862ab7ab351a", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686146434, "uuid": "a52a7527-cf70-4c1d-a79d-73388c4264b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146434, "uuid": "639ae724-654e-4c17-bfb0-27a8cc5907e1", "value": "6cb35df873c751abb1546c4e0621bfff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac55968d-0567-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686165332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165332, "uuid": "35d81724-2a5f-4e31-98ef-54c952049848", "comment": "Malware payload (GuLoader)", "value": "e9dff4cd2ef1cc2d7ed59ea46736e08b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165332, "uuid": "84856260-3fc5-4567-9f54-ec9e55b6d70d", "comment": "Malware payload (GuLoader)", "value": "0394b5d83b6fa63b6c661265ce44b6036027af24c5c316050b607647a73d3541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165332, "uuid": "b07f058a-d50c-4f47-b89e-83def1c0f9cf", "comment": "Malware payload (GuLoader)", "value": "c77dc06f26f39b94105725efab44c9a9ff616323", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165332, "uuid": "2083ed8f-8fc7-4f7f-8579-4928f287bda4", "comment": "Malware payload (GuLoader)", "value": "3e50c57e07ded82d8a44368659608f900ffb582a8490f65cb55f009e421c02551483b956b80e936040690dc3555dc8d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165332, "uuid": "2bb38d82-958a-4c4b-9f40-692dbad01d28", "value": "T1CAF4BFA2F500805FDE25183FF9B6765C2AA16FED548A76E12350B7C71D32A42C78F60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165332, "uuid": "c19a7962-1014-49ac-9ffb-24bbd8c697ac", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165332, "uuid": "ba5b0c29-0908-4628-9edc-becffa431cb0", "value": "12288:dgQ44tKHd3nw25aVHemM/njQcNnh1qMLPxqho:d0CKVra49njzLPxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686165332, "uuid": "5af5a608-b584-4ca4-924f-fe9d45b73736", "value": 744001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686165332, "uuid": "680f49d4-1554-45f1-8590-193e0a4abe63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165332, "uuid": "3a766f04-b0b9-413d-8d34-ec536b9dde86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfd62e2-0537-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686144449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144449, "uuid": "2075752b-43e3-408c-b316-a9cbf9dfe395", "comment": "Malware payload", "value": "3857c1326bf75bb3a64da1c48368ad1b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144449, "uuid": "d80b051a-09f1-4afc-998c-e7d9cadce40d", "comment": "Malware payload", "value": "04d54f7f3c3d522e74fff661b91f62aca6322a3cd015055a6329d60e258b0abc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144449, "uuid": "911b3cd9-962c-40e3-a6f4-ab6f1d7333cd", "comment": "Malware payload", "value": "150b494db4146580889929932239936c81011cf7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144449, "uuid": "d8d740c7-0fb4-495d-b407-d5a14f740fb4", "comment": "Malware payload", "value": "10cdd2ca3e4d902d55ee804f10b52d90efca4e68fe063ab80cb6e5c7c04b528eba6dfc306e5d580bbf63e2ba514cd41b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144449, "uuid": "2a3ce3c4-6162-450a-b191-de70c483364d", "value": "T17F139612B3D6AE26F22366B489F3C295B325BC058FB7871F2258371F7D724701A52726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144449, "uuid": "a75b41d8-6899-46da-b392-515bcc0ebdcb", "value": "384:JfaazTbtFOTcOZ07NQ7eCoZ1yj9uo6EXXgS+ySSmRqiOe6giSwvxjk+tFQoOxkd:JfaazfjPyj9ukvSSHBeOxw+tFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686144449, "uuid": "38b449a8-1bdb-4545-ae01-e9525ee92663", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686144449, "uuid": "846fdc6d-c0f4-40ac-b8c5-ef62466bb937", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144449, "uuid": "fe909ede-89a7-4b5f-af6a-54c39b3b9653", "value": "VALLEY BLDG IND INC. CA. 2 .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31374cdb-0522-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686135490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686135490, "uuid": "cec095f1-6ce1-47de-8ef2-0e490b89089b", "comment": "Malware payload (AgentTesla)", "value": "6dea0bc9c9c6a4edc1ae2e47d01f0f96", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686135490, "uuid": "7b99e70c-5dcc-4544-be55-ac94d084b0b1", "comment": "Malware payload (AgentTesla)", "value": "051a593a45e198bfb6434ce1b9b98a86f84dc4c7359de797a42f9162cb330ee5", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686135490, "uuid": "2dac5053-1c7d-4054-a3a7-2723a1e186d5", "comment": "Malware payload (AgentTesla)", "value": "6469b9853c018f4675b493a8a8477a35d165e067", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686135490, "uuid": "9f943ab7-2f31-4460-83ca-d6c07b92ae9d", "comment": "Malware payload (AgentTesla)", "value": "076fb8fc4ea9cfaea89da1b75a2d272146cb782ffd200465e660ab84ca0d7caf4016be1b2af895f93d10936105b0ef1d", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686135490, "uuid": "2899c96f-5e56-477d-a205-32cd348c508f", "value": "T13D1533412BAFF410AD08AC4BE94DD8797A46F5518E2B436839B275FADF0B50DC08ED9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686135490, "uuid": "ec441a7e-dd5b-4d08-b8cb-b4d044c9bf90", "value": "24576:QeObWhgJJ7GTYzcjE1N1rHv+LTLlFeEhuUHj+Mfr:QeObeoJ7ZzcOr0FeyuUaMfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686135490, "uuid": "027b083d-fe7a-44d9-b6f0-76036d744c49", "value": 935597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686135490, "uuid": "37a78f5b-5e9a-4a07-8f3b-2e20751841f4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686135490, "uuid": "0b83f344-b5eb-420c-b7f7-e8d3463fdd41", "value": "Request For Quotation.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2046d2e0-0538-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686144911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144911, "uuid": "d42415b6-fb31-4015-9bb3-5a098fb52bc8", "comment": "Malware payload (AgentTesla)", "value": "7fb0377f1bf98dfd7faa47bbf3f03029", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144911, "uuid": "8967864e-856e-49f8-b712-dfe568d36fb9", "comment": "Malware payload (AgentTesla)", "value": "065090138bb642e0757a9bf849951a9824f0e35f8ca2aedeac5148caa19a4405", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144911, "uuid": "4038a90c-77dc-4d62-b852-fc150e44732e", "comment": "Malware payload (AgentTesla)", "value": "caa8a9035fc256ab5ebd12855c274a1d4f915a8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144911, "uuid": "050b3d8c-c043-41c1-8373-e10ca4bc129f", "comment": "Malware payload (AgentTesla)", "value": "d3a488b04dda37d219b6d0ff3eb2c1175d988ff14780e78f3197d5b92c1d0ce966f64f600878d61d0ff6408a80a394f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144911, "uuid": "1d6c005f-ed4e-4344-83cd-ab4c4a366366", "value": "T1CBE4338AE49B58DA66B54E1FFB3476B8A1F2D31E82C7374105CB0E9FB32D0A54049397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144911, "uuid": "7edb9de9-fd03-4b13-ade5-4b6de2796d0c", "value": "12288:umpdyhly3VIYHCNpp4NLUXS529skM2BqXloWv/7OgGSrU19IcFmZZ6Nimn9U:/p8lyNiNpCGXS5E8XlN/6gbCIDZii/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686144911, "uuid": "bd46caef-9281-4649-b324-67c601f2c280", "value": 721201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686144911, "uuid": "626c8350-983b-4185-a6e0-c3e376ac2a27", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144911, "uuid": "afe6ae12-3b89-49a8-8615-ea2da26026c7", "value": "new project product.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b475d6e5-055b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686160192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160192, "uuid": "70833e27-3349-4814-a7d7-ff1b5b867006", "comment": "Malware payload", "value": "3549f9da15d30f3ab71dba5b7a83e4dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160192, "uuid": "669759ac-37cd-452c-835c-44ec1dd3617a", "comment": "Malware payload", "value": "0660ae6b20bd70d9601cb85af287a11ceb8f95b4f97643f44b696fdeedc438a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160192, "uuid": "7e5b0cc6-c30e-49f0-bf52-052eb5dbd2e1", "comment": "Malware payload", "value": "f01eb9fabea914649ba04bd1cb275d838dda5f6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160192, "uuid": "1051de17-1742-4fc9-82e6-f49e768bb9c2", "comment": "Malware payload", "value": "4be3cdded991e11f75c36584471a72063b6662f864ae5cce5773cd4ed8703d1720e5a372eac7f6cad545953328dd0b3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160192, "uuid": "0c04561e-dc98-4e71-b514-e14285bc5c76", "value": "T1B5952303B8C099B3D5220D3257296B62653C7E201F64CFDBE3D0392EEA766C1E6356E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160192, "uuid": "dfbecd8a-9fac-4b99-ab85-4807f221795c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160192, "uuid": "2857e1f2-8c33-4b2b-b836-ac6a8cc7069c", "value": "49152:ABRDDfmNBF/rQBix64oTExtkFKZ4S+AuV6:adeNH8BigrTExt54SCV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686160192, "uuid": "e510e8a7-781b-4de4-9a4e-5a1f3e708142", "value": 1883554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686160192, "uuid": "4798a678-085f-4998-98bc-eec62660d880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160192, "uuid": "fb89367d-7101-4f6c-acb1-18ae68eab6fc", "value": "work.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0d0032-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128422, "uuid": "ca83ab0a-23f6-43b3-bd17-b71a8414fe1d", "comment": "Malware payload (Mirai)", "value": "4891f287d79497726e59fea3974115a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128422, "uuid": "222232f9-71e9-4d32-abab-0827cbcbaf06", "comment": "Malware payload (Mirai)", "value": "07133eab66f3d3e622c655979a72592721d3aa27fd0fc010a5d62b46f282b9be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128422, "uuid": "76bc9e74-9718-416c-aa91-526d7384958e", "comment": "Malware payload (Mirai)", "value": "5c50ecf86a2249a01390dfa1af0b23bffcb8543a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128422, "uuid": "11fc9c04-346d-4d2f-ad7a-156b84cc09c8", "comment": "Malware payload (Mirai)", "value": "d1486abff3597ea25567c31f69594f23fa9b8183839b7748ba50aefab158a86707fb240f7e2c2290233573e3cbda3240", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128422, "uuid": "3198c2ad-dbc5-4d0d-9305-9cebf04d1843", "value": "T1C6130856BC819A2ACAE0237BB92F548E335163DAC1EB3257CC215F1477C992F0D67B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128422, "uuid": "f2b494c2-27a8-4f9b-8c40-47cb36cdae71", "value": "768:zzQfDhTrYs6wrJSXk707L1kSEbv6e7srKwLXEMwYO+nrSx7H/gg6BN:zMJrYQrJSUYeS0vt4rKaXEMhjs7H4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128422, "uuid": "a3f1294c-51e7-429a-9d57-956d024f0a77", "value": 45308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128422, "uuid": "2c4260c2-faaa-4804-bf96-04a43ac87248", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128422, "uuid": "0adba209-1331-4dfb-b410-5bd1c30db049", "value": "4891f287d79497726e59fea3974115a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8f5ea0-0518-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686131515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131515, "uuid": "3506442b-5ba8-4f51-8114-00c1e6d4b7c2", "comment": "Malware payload", "value": "641d803e55a608aae1dec292955ffb0b", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131515, "uuid": "4f86a515-9e80-4178-a4f9-7eace38867ed", "comment": "Malware payload", "value": "073e434fcbe0b305d7e6cae2173cc8b6dcb26ad8273f9393d29a7ecac3654281", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131515, "uuid": "ca940c4c-7f3c-46d8-9b90-d9758c58678c", "comment": "Malware payload", "value": "1fbac91877351565fe528bf5d7f469e88c648599", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131515, "uuid": "8bbc5657-4979-4722-bf3d-7d0fee2920f6", "comment": "Malware payload", "value": "0f1f4df7052359d25cee17e5a622916cdbac6a548aaa9f582ed6fbdc7e89da25d788cd7f98bf97d87ab294128da9f6ba", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131515, "uuid": "04c1a2eb-adc8-490e-a362-d601b119f046", "value": "T13CD023AE0316C1F0D785A5104364FC40540935C748DED85563C0DD9C7C542D68598695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131515, "uuid": "ebf971ed-e6eb-4c04-86a1-db2c4247d6ce", "value": "3:J25YdimVVOxRVfqIpmqRAbABGQZGQsG4vnKLxtdggFtdOLHK0hpBKvQT0rKEgGGW:J254vVUVfNRYFeJ1nd3zkrpshf3Isn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686131515, "uuid": "76c273e7-f2bf-4931-86ab-90d332afb737", "value": 198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686131515, "uuid": "f22e1c27-aaf5-4ef4-ab60-f6ff7a3d7a9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131515, "uuid": "4d89001c-772f-4135-a62d-53d0097da2f3", "value": "FACTURA_PDF_XML_857287.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9850b1-0512-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686128721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128721, "uuid": "eaf53d3f-9a40-4f02-8ff9-4ba2fbf9d3f2", "comment": "Malware payload (RedLineStealer)", "value": "051870fded6f76fbf328d4c4af1c4fd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128721, "uuid": "c57de23f-63cb-4b48-8d1b-102d37e0a489", "comment": "Malware payload (RedLineStealer)", "value": "078d6ea5a779baddcf79a6afc4fcfb8c41eaf43ea0a6c3f5602172dd12ae3273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128721, "uuid": "67792559-cc54-4d68-b050-a2925110caf1", "comment": "Malware payload (RedLineStealer)", "value": "6c875a7d0427963d502c15609e379f5158aacb3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128721, "uuid": "06eb335f-b953-4d53-af7f-e6a4da0eebca", "comment": "Malware payload (RedLineStealer)", "value": "ba4ef623e039fecfcf639259061cfff1f67cd5084b48aa0b8a79beba8dda362c03e2a4355e5eaa31d8f5918de8e72db2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128721, "uuid": "92c17421-63a7-4d77-9239-2734d572da9e", "value": "T18DF41207FAD48532E9B017B018F30B431E35FD615978976B2B88981A2DB3AD4E93176E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128721, "uuid": "f676b255-efbb-43f3-9162-04a0acda14d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128721, "uuid": "6d7bb15a-b31e-498d-bb40-b62a17eacf59", "value": "12288:WMrUy90spSglbvn62wQT7tw2BsdFXc3MTSsjQXM8/dEX2SsDcCmQsIHZwT:eyHpSUL6257tw2GdFXHRQc8lyizRZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128721, "uuid": "5ddde136-cdba-4eda-82ad-a2190b21406f", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128721, "uuid": "21c40670-69f7-44f3-8e5a-1dcb8877efbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128721, "uuid": "4eeb86ce-b4f8-4704-8c82-7defe143b4d9", "value": "051870fded6f76fbf328d4c4af1c4fd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e2aa49-0528-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686138023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138023, "uuid": "3acc2c5f-5b18-4605-bd42-311df170b294", "comment": "Malware payload (RedLineStealer)", "value": "53efeb819a28fa58e74be561ad848a82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138023, "uuid": "80c5a414-def1-4e3b-b971-c43d774d1329", "comment": "Malware payload (RedLineStealer)", "value": "0813be338214550b88184d4c4b51e0c73e96d53d9ffa0340e0eb1b1216659bd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138023, "uuid": "a1f3be97-1bbb-4365-8277-2e0c726c08b0", "comment": "Malware payload (RedLineStealer)", "value": "b03031f1a5cbf813a2b2f36fb2359483d203232b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138023, "uuid": "37939ddc-31c4-4e11-acb3-51894a29ed78", "comment": "Malware payload (RedLineStealer)", "value": "3b3fecaea234e2d07e326b83aff3962993947eb6dd4a76655ae48d8953378ff8a8a1b3808a9d985a10e20c7df6bf0ff7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138023, "uuid": "b48a38cc-1c27-4ccb-af11-93997c9e71f9", "value": "T1D0F41242EADC8033D67023B0A8F647D31E347CD56C7987AB5B49B84E0E716C4A579B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138023, "uuid": "de2d1aeb-5e51-4bb2-a2a0-8ce5b2975c86", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138023, "uuid": "135966d1-817d-431b-b0ba-6ef5e724d0f2", "value": "12288:nMrCy90eZEl6WimXZ6razMweub0QZxKyoOpC/EboYYQziqaL27C2jFg2DKZlVR+V:ZybXWnXHzMXrWAssYTziqpjzKZzTOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686138023, "uuid": "d95f6e9d-bb9d-4ad1-aac4-78b8d24f070f", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686138023, "uuid": "31dacb75-5825-443b-9b9e-523200c0cfef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138023, "uuid": "b0dd0242-cd66-4c7a-b255-3d2b9209a6c9", "value": "53efeb819a28fa58e74be561ad848a82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f8e082-0538-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686145234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145234, "uuid": "043ad20a-9417-4465-8ce8-591920808e4a", "comment": "Malware payload (RedLineStealer)", "value": "b2bb34b8f3518d02215ec513cf1a13c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145234, "uuid": "c5607061-253d-416d-be09-08958e5c6c45", "comment": "Malware payload (RedLineStealer)", "value": "0843fe6601b86671f8b1a1873b05be02b0e95506970955550f20f6c08bd0b56e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145234, "uuid": "08b21c95-a47f-432a-9689-885e4077e031", "comment": "Malware payload (RedLineStealer)", "value": "f4353761b05202b51a72110e211053322e696416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145234, "uuid": "d3968e57-5bf9-4f21-bb2e-70d65a355a94", "comment": "Malware payload (RedLineStealer)", "value": "b64f1330caeada1c88e3866f17e901e65c31ae65be85725a29ef90579bfcdb52952c0af09587dac60d9d1cdc90cc33a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145234, "uuid": "38a2edcd-767c-4974-9a7a-90da206dec76", "value": "T1D4C41223E7F45532E8B45BB098FA43931A347EA0687C829B3745A85A1C737C5A47633F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145234, "uuid": "85f0027e-89d1-4a6e-9ed9-c00c39e4b56c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145234, "uuid": "207ba7b7-bab9-4dd5-8761-bcca121d2900", "value": "12288:qMruy90w39fB+2DnfdJawgeDB3pwMqk7+573nXt/L3IPlS4nhePk2c:wyr39fk2r1JawgeNZe73XVjGSMhgnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686145234, "uuid": "29ceef8e-b5c0-4ded-8f83-946fb5aefc11", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686145234, "uuid": "f881646e-5588-431f-8c5f-3bed95dfa530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145234, "uuid": "91ab0416-f8ec-4eff-a769-283b6cac89db", "value": "0843fe6601b86671f8b1a1873b05be02b0e9550697095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6898dd-051e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686133823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686133823, "uuid": "98740163-fabe-48ed-bf04-f4067dabb4e0", "comment": "Malware payload (RedLineStealer)", "value": "0ee7dd953b120021c7567c2794ea781a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686133823, "uuid": "52e88b96-6c11-454f-aa84-24f87d68ca73", "comment": "Malware payload (RedLineStealer)", "value": "08f7005404b6b21588ef1c765603995b6c2b245d868781bf5ff930b66ed560df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686133823, "uuid": "2f12045e-e8c6-4839-a91d-ff0c39f48770", "comment": "Malware payload (RedLineStealer)", "value": "be91f9a96c4d79e47b356610579b68c5d2bf286c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686133823, "uuid": "3f1e2ba2-b798-44f7-bf53-2cad3429351d", "comment": "Malware payload (RedLineStealer)", "value": "7193881586acf9b6c17901a5b470295ec917496fe1d1e7c5a9b570cb6d658a82898e0ed2b3e19b9edf059cae53db46fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686133823, "uuid": "663e3992-002d-4342-9ef5-cf3e9cb9c042", "value": "T170F41283BBEC1072CC76273028FA27D30A75FD919AB88B262751984F5873794963573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686133823, "uuid": "583f383d-1117-4f60-b4c1-b5a0e7863ca6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686133823, "uuid": "267ad855-70fa-43ba-85a8-f3f4f561923c", "value": "12288:MMrky90bEhq79mT9Mwn2ZJDVcrsTPiKu91NyAgTWVjIrgM:wyEE09z/irsuKuVytWVjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686133823, "uuid": "b73ac526-08d7-4ed1-8e3f-9b987f6da53c", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686133823, "uuid": "357ce3b6-50ea-4370-9a61-8664322bbe0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686133823, "uuid": "c4048847-3442-4a1a-a1c1-bad8e5402fad", "value": "0ee7dd953b120021c7567c2794ea781a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4a6f1e-057b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686173945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686173945, "uuid": "f0b24847-6414-44ac-930d-d6a713064f1e", "comment": "Malware payload (AgentTesla)", "value": "296c5225d200b34d8fdb285962ab4e0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686173945, "uuid": "8ee6d683-928c-4ece-b8cd-e191f6efc63b", "comment": "Malware payload (AgentTesla)", "value": "0957084aa1da579049aecc78dfcc29b5113a491fbdd4980e2d47110bb2a17c39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686173945, "uuid": "cf37c34b-7645-449b-9a6e-2ba02c0abe41", "comment": "Malware payload (AgentTesla)", "value": "80d05976020f797bb416b995eb4dd5b93b8eadaf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686173945, "uuid": "a7e4191c-fcfa-4841-b181-3dbfc9993fd7", "comment": "Malware payload (AgentTesla)", "value": "45a52a156b6af8586fc24da01230884d897b0e4470bc24f464490c02bbd13561c1020d7a66818b6e9f0188b8e50d331c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686173945, "uuid": "f674d3db-83d9-46f4-96b2-fef361b37d72", "value": "T1A505DFAE22D37189C847BE7D1D42D4F48AF5B882A7D1F60B89DA210FBD13B917444B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686173945, "uuid": "40ffe622-7f57-4986-933f-06d989b524cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686173945, "uuid": "be43eaeb-e772-477a-9e68-3a77481eec56", "value": "12288:od6L7PVnftitbhaDnLMzIL2q+RTdOL8c9cYXLTdYvl9FvQ14QHuqH6cIMkQspBJ/:6OyqGUL8c6WLTgl9Fa4YuqH6rQaobL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686173945, "uuid": "dd437c95-c9a0-4dbb-aeff-0b5dee33a716", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686173945, "uuid": "b2449c1d-54d4-4592-9ed7-a30eda660483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686173945, "uuid": "d573c0ef-42d8-4abe-80a6-8199bca74e22", "value": "BLU271690607023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f7d0d9-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128418, "uuid": "f1cd4109-0100-481f-97ac-02d78fba2260", "comment": "Malware payload (Mirai)", "value": "73de8d9e00791cdceffd60f709a963aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128418, "uuid": "85f39e16-7cae-42c4-a2a9-cd475dd9c07f", "comment": "Malware payload (Mirai)", "value": "0a3b02bee7391072e8bda36d295480f244094674538ad2e70dd1e1502f58ece7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128418, "uuid": "9b93988b-5271-424c-a420-645aae97df5a", "comment": "Malware payload (Mirai)", "value": "0c6baead1c87414707273510bb467fefb72dbc32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128418, "uuid": "3b6d0578-3fba-4492-926b-f02809196852", "comment": "Malware payload (Mirai)", "value": "608afc1794fe190370e47784c6c382bc004a532e28b847bc8f6a8f86fae5e3f95244b2118b7afc57c23f3761a28a869c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128418, "uuid": "3d800639-1a09-46a5-aaba-7a4f4a84123a", "value": "T101435CC19583E8F5EC160A752137EB738B76FD3A1028DA53C398A932AD41B42E5573EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128418, "uuid": "193dfb2a-8306-495b-8d43-19a2b610ebee", "value": "1536:o77N1k4XrwOUXI5OUg0WDDrJbivdV3GLmW7jSMfCzW:U7XfXrwOUXI5OF0WLJ2vfS17tfCzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128418, "uuid": "4bdecd2f-fcd5-4c37-a29b-80dcb3d06d15", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128418, "uuid": "8f10ec59-d803-414f-890f-4330936a2cee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128418, "uuid": "f2edea63-b41f-4d5d-8a92-05ffcf79d35b", "value": "73de8d9e00791cdceffd60f709a963aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860eacfa-0563-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686163550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163550, "uuid": "2de6be5d-6b36-40e1-b152-6a13ef881431", "comment": "Malware payload (RedLineStealer)", "value": "15e495fd849a078172b03533d9dc3844", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163550, "uuid": "cbdecd8e-e432-4a2a-ab98-132b86bfacde", "comment": "Malware payload (RedLineStealer)", "value": "0a6d7736af996b43f9e56176d6753227a87c541955949cd65b5039bdaf0bc36a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163550, "uuid": "6da988a4-e365-400d-a513-38f9d6d57d65", "comment": "Malware payload (RedLineStealer)", "value": "401fb14d4c4e2fe316b92d245dc7c24e09d6061d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163550, "uuid": "28fa5443-7e68-449b-9283-efcb389a6c52", "comment": "Malware payload (RedLineStealer)", "value": "b8c553e98f937c729a3fd81e8db5afe001079f4541e5f1974e99524e54612b8ec4b396b6f3f18ec61478c92ff9add866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163550, "uuid": "efcee7fc-9cd2-423e-bd0b-2d9e5d342d92", "value": "T1C4C41216E7D91036D9757BB019F602A30B32BC9658784B2F3710865E1DB3BC9A97233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163550, "uuid": "d656fb08-b74d-45a2-b5a3-d34360b573cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163550, "uuid": "f50d0130-f319-4a8a-be48-c1cc7fcf9bc3", "value": "12288:yMrGy90d/qX5I5DmEZ8aYMMya1h2Z2/o0N9b2FuopPfKW:Qy245IHJYBUZ2/o0N9b2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163550, "uuid": "48f8fb17-3d6f-4689-926d-f063081f0d90", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163550, "uuid": "bf1bad9f-0b35-478c-b4c7-c7ad0a35aa38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163550, "uuid": "607c145b-c894-445c-8f58-48091f1216fe", "value": "15e495fd849a078172b03533d9dc3844.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8045e5a-055a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686159876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159876, "uuid": "b40aa58f-8a3c-4c0f-96e2-cfd81dc3b6d1", "comment": "Malware payload (AgentTesla)", "value": "59f67b6a90af421f3fd11ecd3cc33f71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159876, "uuid": "9795d6a7-f0a9-4833-bb0a-f2ffe9b7018c", "comment": "Malware payload (AgentTesla)", "value": "0a6e9968b41ff6c4c5dc632a22de371cc50b208db9dde57c562a69b47b3f479e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159876, "uuid": "e21f0a7d-ffd6-4ed2-8af5-6ca8e9f2fdff", "comment": "Malware payload (AgentTesla)", "value": "c59e75ada745fbad404757b7e278ec0fd6b1adcc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159876, "uuid": "1fcd3a1b-c4d2-4fde-9cb7-bc0bdf846359", "comment": "Malware payload (AgentTesla)", "value": "e5b86c6511313f5091087672753384a9fbbfee8e8bfecdb7b6eb582eb54ddc1a199c62d5dd281b72e5989d8db6adbcc2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159876, "uuid": "b8e7bbf1-fad9-4d44-868f-4d151c685722", "value": "T179052FE1D358ECF9F46A117A9432D9231957E36D88B9852E146E71216EB338320FBD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159876, "uuid": "71ddb9e3-24bc-4b51-9f81-4b9c152b09e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159876, "uuid": "e84f3bdf-53a0-4b32-9b9c-a03c92a42e54", "value": "12288:K7HIIBGTwWddZ1S3BNuE+ezCoO3oxFYG/ML:17Z1SdTzjxxFYG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686159876, "uuid": "55741ec5-eb04-4723-ac29-c2312be1700b", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686159876, "uuid": "1872454c-1afc-48a6-b243-d96e18242db6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159876, "uuid": "b334c86d-036b-4ae6-ac52-6ea58542a45c", "value": "0a6e9968b41ff6c4c5dc632a22de371cc50b208db9dde57c562a69b47b3f479e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0446e80-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686128429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128429, "uuid": "21a140b8-0f5e-4014-902d-2fb84e750597", "comment": "Malware payload (RedLineStealer)", "value": "8dd9bbcecbe555a9680064a94e58a4fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128429, "uuid": "e9167642-e6de-4026-814f-4cae6a4a9c18", "comment": "Malware payload (RedLineStealer)", "value": "0b137222847555174a849cb1b47cc9008eda1ea947b580664efacdbe0ab6877e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128429, "uuid": "4341d011-5709-4881-bfe6-a8021095fab3", "comment": "Malware payload (RedLineStealer)", "value": "31fd8a74565298db5a5bc5ae3c93fbb7bf67041e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128429, "uuid": "93c9a645-7221-4e87-9b95-22b4695cb911", "comment": "Malware payload (RedLineStealer)", "value": "5534f400e800728bb8ab1e6cba6d248fa6d311ff96656c6d1c90e551bd9e18a043a43b39f0a153f5aa5e04932670ba27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128429, "uuid": "88c0f233-f77e-4988-9d89-10cfaa41ad69", "value": "T1BEF4120297DD5032C9B9177418F703930B377DD46E7897AB274AA90F18B2A89D93273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128429, "uuid": "e7945952-c1a2-46d4-88b6-16fbd2c95ba7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128429, "uuid": "d81a7b96-ae6c-4095-8cf6-ca0ff16079b2", "value": "12288:SMr2y905h+E/baBW7vn7uRuc/SUyuww6gddOlPPOcl8MGLM/bbnqwANozG:IywK07vn7gdbylHZlnxbzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128429, "uuid": "d6af2fa6-c8b9-4772-94f9-fca8e3728ce4", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128429, "uuid": "5d6d77c5-7eeb-4612-a836-0eb0f2a49e0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128429, "uuid": "ea401d97-cc31-46e0-99ef-aa5fd04c5331", "value": "8dd9bbcecbe555a9680064a94e58a4fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc8d5f7-0581-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686176500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176500, "uuid": "9550649e-870e-4a96-9600-acc00f5fe09b", "comment": "Malware payload", "value": "dc69a4250189779c3466943de1c44383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176500, "uuid": "d2795300-4cba-4c53-86bc-5e2ec15ab99e", "comment": "Malware payload", "value": "0d1de2e4ea7cd1d8622f1488594f32f5ba84026b3cd6eb09335c39a1e15b6e59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176500, "uuid": "14b8c5bf-b267-4631-a98d-4851da80a478", "comment": "Malware payload", "value": "220b13992034b756db6e2afab7f419358d306125", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176500, "uuid": "e1d17ab5-bb13-4e1e-acfb-2b2c3a5a6cce", "comment": "Malware payload", "value": "096d54f7746aa327346716d840bd1c9e073777ae60ff0421b3840a64a284b048ace9d4027479dccbd88044d7ad024ba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686176500, "uuid": "bf2be175-c0ea-484b-b684-8e1d0f174a47", "value": "T1CD446C09E4AF52D2FE4671B5616D905BF1BF90F313BFC02EDF5A3AD22C5726096A010A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686176500, "uuid": "da24766b-855d-4784-bed8-272ae3816eb6", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686176500, "uuid": "6050dc1a-dc09-4f9f-9375-6556b9064f0b", "value": "6144:dhC1PFayLntNFN6x2pdbAsWkdLTI1s+xq7x:dhSPQyLntN76x2paDVWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686176500, "uuid": "4bc5a1e2-82ee-4d64-93c5-855768644d23", "value": 264632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686176500, "uuid": "842676dd-1fe3-4504-8b52-97943a4282bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686176500, "uuid": "8f7d2e9e-8cc8-4ffc-95b4-0d2e06fcf024", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05f209c-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686128429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128429, "uuid": "f45780c6-85c3-4fdb-81e0-5c3cea776eb9", "comment": "Malware payload", "value": "af1a989a2a9bd61b087cace076971f6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128429, "uuid": "b0852570-db2d-4668-951a-f91f98d380c9", "comment": "Malware payload", "value": "0def45e69bd0b77b0448d57bbf6213b66a90b0b8855378271b5111d5cbdf16ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128429, "uuid": "54b4a336-544c-400d-80b8-64fef73d6fb6", "comment": "Malware payload", "value": "4e0173b1164573c72950fc10466dcd87d34ba88a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128429, "uuid": "24afe46c-82bd-41db-8356-68086ac7cb4c", "comment": "Malware payload", "value": "5b7b5f98080e4b1f7216bbe570cc87928dd9d8b1a2c529a46ef1af908ebf25023c7fcb1d24ae185873945322f1803332", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128429, "uuid": "80c8da7a-d2ec-449a-87cf-1fe96240052d", "value": "T15F862346EBC71AF5EAC2063C51DBE77BDE2576110735C9C3D7802802B8E16E1AF39299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128429, "uuid": "1a3e4ad5-ca4d-4f4f-8c55-b663b23cfbd3", "value": "ad9d11227a86b863e31ddf6019cc7ab5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128429, "uuid": "561d95a3-a887-485e-baf4-f1d7b2bc2c25", "value": "196608:HVkn9JCZxrIYF4hSeOMYjeYMeJyKpJoiSsD4RFsV4:ynOsYFs4MMbJVVSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128429, "uuid": "378572f5-8704-4432-a2c8-ba580f03decd", "value": 8344359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128429, "uuid": "1dbd292d-9aeb-42a3-bb48-ef4c1809a38b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128429, "uuid": "482c9fd6-51f4-4a47-be0c-850f3dbdd794", "value": "af1a989a2a9bd61b087cace076971f6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cccd764-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686128369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128369, "uuid": "a1c29c30-1354-448d-b714-88faeae346b0", "comment": "Malware payload (AveMariaRAT)", "value": "b682e3dc1f18c1131f75ff8582aa5703", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128369, "uuid": "ed15e942-a18b-4b0d-851a-cd6f7aea565f", "comment": "Malware payload (AveMariaRAT)", "value": "0e56b689196e7f1ddef9fad8cc6db33ba3bcc529b1ddb9cd5940ae206289d667", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128369, "uuid": "0a713fb2-4692-4459-ada1-b1bd7c687b28", "comment": "Malware payload (AveMariaRAT)", "value": "3469dd3c70a3ee99ece17b22b4ffe01ed806404a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128369, "uuid": "ece701b8-cb9b-4548-91b0-05ab64c80709", "comment": "Malware payload (AveMariaRAT)", "value": "2c631f8d1377eeaedf48d841ab54df4abb400df9de8377a3bdfbf13c0faeda6557994f3182207bfd65bfb2ab660d9556", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128369, "uuid": "b759c12d-4912-44ae-9de4-6ed5beb0d235", "value": "T17E045ADC766075DFC817C9769AA82D68FB60647B530BC203A06316AD9A0D9DFCF190F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128369, "uuid": "069a8634-f308-447d-93a3-3e7354f36b21", "value": "3072:68MvVo31JZfOQtO9PD6vl7fIkWEffn9ne2+6TKXeB5AlckP+tL/uZwfkR:68MvqIL6vl7fIkWK9eXC5AakP+tL/uZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128369, "uuid": "31029eea-8a6e-421c-baac-7f0e61f5662c", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128369, "uuid": "ff2a039c-3f65-4064-9285-0768ae9c20c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128369, "uuid": "cc65f357-fe5e-44e3-91f2-046f391800c1", "value": "b682e3dc1f18c1131f75ff8582aa5703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d40561-0531-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686141932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141932, "uuid": "475208a4-73a0-4609-b3cb-3adc70a660c7", "comment": "Malware payload (AgentTesla)", "value": "5999025426438e855f708d52d1f28c42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141932, "uuid": "5f9db522-7487-451f-9165-a4736edd1a53", "comment": "Malware payload (AgentTesla)", "value": "0ebcef166cf7b72171b0d08040381ad00e80635633e54546823b416460ee57c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141932, "uuid": "983e9d24-77d0-4cd3-bf1b-e4208a5539e6", "comment": "Malware payload (AgentTesla)", "value": "5faec204f594d5ca4b77471155130db35d7d5a68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141932, "uuid": "693d5f6c-3db8-46e0-9002-f296b3e801a9", "comment": "Malware payload (AgentTesla)", "value": "aca713e1bb243cdb20155b565192a779a60aa450f1576ebad2fc3ade5dd9dfbaaaecbabb81c0069a3726d38ddb5f770c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141932, "uuid": "2c285e8d-8cc7-4857-a78b-f94f92e60f8e", "value": "T142E43340BDA875C625FA39674EAB013EBFC42DD096BCEFE108F258524A116CEB4E71C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141932, "uuid": "3332ec31-8c79-4907-9ee5-9a4537132c0c", "value": "12288:q2i5xLvI80vqRA2/xk2La6SygJmGDD48doE1dZ0UqdVw:q1LwdiRAQCWgJmGDD48d3hqd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686141932, "uuid": "db013a7b-456a-488f-9ce8-55a733cd94ef", "value": 721659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686141932, "uuid": "7278f2d0-55f5-4e64-bdf7-6ff51e04c531", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141932, "uuid": "613d1a55-a2cb-4ebe-985e-5f3b6820e17f", "value": "PURCHASE ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca8859f-053a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686145737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145737, "uuid": "9bc940c2-30b0-45d3-a1db-6af3dd85ceab", "comment": "Malware payload (AgentTesla)", "value": "f65eb2cc64ea433f1d9d3c2a3fa4c701", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145737, "uuid": "80966db7-ef27-4a6b-97ce-d294b9e104d1", "comment": "Malware payload (AgentTesla)", "value": "0f919e6ede18cce5cd736b1fcae63545119a886f62c6d2ec6c029d05619f97b9", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145737, "uuid": "33810828-42f6-4604-a043-abe6835aefc0", "comment": "Malware payload (AgentTesla)", "value": "a996adefa0d2c316c75fd492fff4df8f1245e1a0", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145737, "uuid": "f92e4e2f-992e-49ff-91ce-020e9009a3f4", "comment": "Malware payload (AgentTesla)", "value": "80ec98dcd82ae9115898af98a5f0c731ab83214ddd710ea388de3a5e9ff924dd9e620b373ff6811b3f6efd0bc94d017b", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145737, "uuid": "f9610027-be59-4d8c-935f-a58e469209be", "value": "T1A305F09862FAAF57C5B96FFE0410217083F5566B313BE29B4CD274DEAE64F050A44E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145737, "uuid": "dcac87d3-cee0-4598-af9c-da51c56425fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145737, "uuid": "52c32a47-9221-42e4-8899-4b7ff6f367eb", "value": "12288:AUlRu3EhaDnLMzIL2q+RTdOL8pMeQPwnBPxediEZ7Rgqy0PDQFSgRGS4TtwPW:AUlRuqOyqGUL8eeQIVxm9RP8haTtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686145737, "uuid": "80e2f222-9475-4625-8a38-03faaffabbf0", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686145737, "uuid": "f8c39663-02c8-420a-833e-98e327f45d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145737, "uuid": "cfcc8236-dfcd-408e-962a-e43649f520aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8644b774-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686130050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130050, "uuid": "1c15b441-3384-45f7-8393-31c7030770da", "comment": "Malware payload (AgentTesla)", "value": "063148d9ae38de37b75e5826f6460729", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130050, "uuid": "651c115b-788b-472c-b574-4487f995d6ad", "comment": "Malware payload (AgentTesla)", "value": "10488db28b2a89b0b4c98640e65f7df2ae248ba2a80dd443b9eddaf6714e01e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130050, "uuid": "efc051b4-c2a9-4aad-9d46-f11f5dac0aa0", "comment": "Malware payload (AgentTesla)", "value": "b59626ec32267ae914e83dfc0184062d9ec4c403", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130050, "uuid": "87169900-2d1f-4e05-85bb-064b4e59e4a5", "comment": "Malware payload (AgentTesla)", "value": "ae083e77dd566f01ca8d36c5a81c0e9d1b865dafe9f25a0350ecdc0efecb3329ba2e69507ba5e286197a1a912f18c437", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130050, "uuid": "e831782b-08ca-4baf-a22a-52003a5af7a9", "value": "T1EA02E920EB654733E9A64F36E8C353E21779630B7C93F71F9E40501A6D6538C4AA2BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130050, "uuid": "ead40f1e-2e30-42e6-aa45-c8af59547573", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130050, "uuid": "7b41a8d2-137f-49d9-a092-207b7a97424d", "value": "192:XdJPun1f6WEa27RpmLpT/evYtDVuzDw7X:XS1fP72NpmLpT/KYtZQE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130050, "uuid": "c1fa7963-313c-4a88-9991-3fbb891968cc", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130050, "uuid": "408a9425-7fb2-4141-9cf0-90b18fd91107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130050, "uuid": "43522ef5-4f48-44e4-bf4c-fea49807de8d", "value": "LPO-230307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820ea933-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686130042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130042, "uuid": "f78af7ab-9ce6-4efa-9048-c9adc69427f2", "comment": "Malware payload", "value": "3caf3d22ed782d5d45cfda6b67065060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130042, "uuid": "04f17bcc-373e-4df1-a10f-e6838690b149", "comment": "Malware payload", "value": "10c238a74212ea08acb6719958adc961d329885c8ad497125865edfebf0fe4f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130042, "uuid": "d167a1ab-5895-4b5b-93d0-f923d663a471", "comment": "Malware payload", "value": "b2eca6b86f9f6a18451b94a7b2451a01a4686d79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130042, "uuid": "9a5bf802-82e0-4236-8979-d5a8d5fdccca", "comment": "Malware payload", "value": "e365391715e68d63239ce13c16a5624a47949fffbedcba26878c47a5c2b5875273a3bc7e7a0ac61a46e5c75e2fc3719a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130042, "uuid": "deb04975-a44f-456e-bcaf-f18aa004c424", "value": "T14105126C52A7021DD9A73FBC4DA11674DFE90698B413D11B0FE7BD9DCE60B0249C89A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130042, "uuid": "a5ee074f-d5c4-4b7c-99bb-005e9eadc04e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130042, "uuid": "7b0a97d0-61c3-4c7a-8007-584f79d1c05e", "value": "24576:i1iewlqB6p6HJP/LNnLsVwGC9sOWIbAG7k:iQe2q8pknnLsVwV9fZbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130042, "uuid": "0b61f87c-5131-4404-9312-3502228fc2be", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130042, "uuid": "6ed104c9-38e2-4045-b49a-3f5fbc7849a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130042, "uuid": "d4d301c1-f260-473e-9d94-e1de443dc430", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7425356c-0527-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686137750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137750, "uuid": "89a44439-0fa5-4ac6-bc73-71ac14157a33", "comment": "Malware payload (AgentTesla)", "value": "e09b03eedac9adcd4e3687129ff08afe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137750, "uuid": "b94b632c-3962-4a1d-b426-9004cb165386", "comment": "Malware payload (AgentTesla)", "value": "10d48d9b1c0b0851fd37aeff2de8e95f94adc842daba045147e091e5eb0680bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137750, "uuid": "96ef3951-27c5-4c92-a1d1-479cc74f0fbd", "comment": "Malware payload (AgentTesla)", "value": "5b3acc1491b48d42dc11765c12b7d8607dacb385", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137750, "uuid": "7cfc1ee6-7543-4f45-b911-8d518765d5fe", "comment": "Malware payload (AgentTesla)", "value": "5a65d3a90aaac4078dec2d05aeb1bb5bb3b0a51fd2567ef3930fbf2fd9d480dc994321ecd5b7aa3150ad411666ea9c69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137750, "uuid": "a5e34402-691c-47fd-bf34-cf3379f07f86", "value": "T1872402267FB34812C206AB35E595411817B2E78B35E7C64FB58D83268F027CF5B260FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137750, "uuid": "17b783a3-b2de-43e6-b42f-383a40a3a3b5", "value": "3072:pEXBYgar2PZTU6K736NLXQJh1ehSQ9J0GXRSDjM62zyEQhaA5IKWfZ7fxvXX4:pgBJarKpU6KWNUu/DnXRSvM9yEQo7n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686137750, "uuid": "7bf951ef-da01-447e-8d32-64a4dde49d40", "value": 209480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686137750, "uuid": "d25652e2-400d-4494-a1a8-2cf8e2340346", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137750, "uuid": "535c9622-f918-4c01-931f-cf8c5e194152", "value": "10d48d9b1c0b0851fd37aeff2de8e95f94adc842daba045147e091e5eb0680bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd6f7e9-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686130032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130032, "uuid": "ec04c73f-791c-4a6c-bdaa-fe75655f76d2", "comment": "Malware payload (AgentTesla)", "value": "cad4f7442b4a7ea631af5c936000bdc8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130032, "uuid": "9803a8ff-0bf9-4d0b-8e28-c03f19db4910", "comment": "Malware payload (AgentTesla)", "value": "1366aad3ed0ab2db47ffc85f6fa6eae1f1742b69ab025ee4045c274e1e5e700e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130032, "uuid": "aaa2364d-8806-496d-9101-676b85d98c50", "comment": "Malware payload (AgentTesla)", "value": "66367e39d0cbf93251f71a3ae3064a58aeb7d731", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130032, "uuid": "811fb951-42e3-4031-aaa4-0aca820fda8e", "comment": "Malware payload (AgentTesla)", "value": "d938c1cca1a4c28d3a0a77dd9cb603d7d5a0447b6ebed87b7077532999a6477ec39cb934813e884749a883b17a960bdc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130032, "uuid": "a6b160ab-75bf-4446-be88-bb5959395214", "value": "T147F32868528B4F11D3FD40B8C8B131481AB2E177965BE76D0DB3ADFA3D067C3362A865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130032, "uuid": "c91c5aed-6674-47f3-a988-7a865124273a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130032, "uuid": "c34947c3-32ae-43e5-9f06-42f8fc101e77", "value": "3072:Xfv+KgKDstTu/XumJDnA6u9jkQgTILtIXraIiI5RSVWbvy2EzreZQ7RppOJ8S3Wo:PA19uEIXraM5wVWby1ec3pO2S3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130032, "uuid": "2ecc52b8-e486-46c5-a923-f7be856e496d", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130032, "uuid": "09973a3b-9d08-4daf-bb10-ba8342e14122", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130032, "uuid": "1ad5b832-9819-4321-8c23-c19c4c181e7e", "value": "1366aad3ed0ab2db47ffc85f6fa6eae1f1742b69ab025ee4045c274e1e5e700e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843f6d98-052c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686139925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139925, "uuid": "8274af8f-c0f0-429a-9c4d-32a58292b533", "comment": "Malware payload (Formbook)", "value": "adf9f1eb207088d94953bba4f1b973b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139925, "uuid": "a4395f73-720e-42f1-9521-02d2d876897e", "comment": "Malware payload (Formbook)", "value": "13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139925, "uuid": "1481ed5f-8ebd-4017-9791-3478e33218d9", "comment": "Malware payload (Formbook)", "value": "cd4bfc0b22618beb13ac9bf9d7c16d6039ff89fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139925, "uuid": "42580a8b-0462-407f-a117-1d77ca327d21", "comment": "Malware payload (Formbook)", "value": "726f2c3dddf2e93263f6e5bbf27a75b02a8b3e1c50a140cfd3f4d6d4a61a60008920e21fcd4e4735ea5c9b514c453c10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139925, "uuid": "53fb827c-489c-4fae-abd6-2140bcdcdaa3", "value": "T1D9D4C088AA1AA777E2AE0FB530535D05136C70667260F23D6EC361DDD2AAF3407DB613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139925, "uuid": "5f61e203-3600-4abe-b541-62dc51ee5dd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139925, "uuid": "55d7fc68-258d-484d-b081-c860e94e95e2", "value": "12288:CBjvvebB+KAbrqwnnngkaG/mBUx5ltEe:Kv+IbrqwngkasmBe5lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139925, "uuid": "50d57996-9b12-4ed2-8fea-e90fed677aff", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139925, "uuid": "76c3d9a5-93ce-48a4-a9ce-aee3a23e66c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139925, "uuid": "c45a1bbb-db89-46de-845c-e3db88288613", "value": "13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c27ca8-0563-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686163543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163543, "uuid": "9c5954db-0699-4694-9087-bab39728c9b9", "comment": "Malware payload (RedLineStealer)", "value": "5b4aa6fa302214a5a37b741305a2673e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163543, "uuid": "6a1914ab-10a4-49ef-bd3b-aece2ee3117b", "comment": "Malware payload (RedLineStealer)", "value": "14e0d4567a8098d2ac3f090f5d8d0507ad60321ef7d74194c2f74f7f65a13c10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163543, "uuid": "b0943127-2cde-4777-9ef0-3c05e280282b", "comment": "Malware payload (RedLineStealer)", "value": "99a0612aaa41715481b9d23d781222165a208d14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163543, "uuid": "e41ec777-46ee-410b-9233-b71bfc4d9180", "comment": "Malware payload (RedLineStealer)", "value": "ee4f81165d11f42c4ffeacae2d6c424d86743e9d47eccb7b193deac00b1151db4a2f6ac47aed925ce09b355ac16eb433", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163543, "uuid": "ac2a188b-c83b-40e0-a18a-e350601b66c7", "value": "T1CEC41212E7E59472DCF5577048F713830A32BCA15E78D32F2B45999B08B2A84E83677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163543, "uuid": "45405cb7-329e-49f6-b578-581d3c6be6b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163543, "uuid": "a1d335c9-7e10-4319-94b6-586b1452d37d", "value": "12288:CMrfy90GMS6iHrnmLVpVzxL8UV51qxeLwBmgGTnotuD:5yLLLmJpBNRLYMRnoQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163543, "uuid": "46200dda-6718-4787-b35b-ab04fd6a82c3", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163543, "uuid": "24950a4c-1961-4b6e-b090-b3b9627fe3a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163543, "uuid": "003bfd6a-b122-4ec3-9fcc-7bdbf9d69118", "value": "5b4aa6fa302214a5a37b741305a2673e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f8390d-051c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686132836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132836, "uuid": "f1d54a16-febd-4710-8dba-1bb72c16c2b0", "comment": "Malware payload (Mirai)", "value": "b771c07a902c5ea5b469bafb66c9adde", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132836, "uuid": "3d668e57-6ac3-478b-8256-298cc46ef0b6", "comment": "Malware payload (Mirai)", "value": "152730300f80e4c7a15a2574f73c7aa8dcd39f1289e24129ce20967d2b285011", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132836, "uuid": "c846d076-884b-4016-bf85-aee567d733d8", "comment": "Malware payload (Mirai)", "value": "261f50a335613887fd169327484349589787bebd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132836, "uuid": "f307a561-7fd1-4c7e-ba82-607ccb467920", "comment": "Malware payload (Mirai)", "value": "6ba714b69688263c8db55dbde409d7e4d2a94ca95d28ed56feb446c669ad22465b5ff2a8b836c77bcd771d09e8ea7272", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132836, "uuid": "aaf03dd2-7ca8-41b2-a5da-308dc4135e30", "value": "T1FAB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132836, "uuid": "3e208284-00ff-4f41-832e-389a89059cec", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1i/LWy:c9sSyzz36YaWWgg1iq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132836, "uuid": "655126a3-b05b-4e32-8b27-5aa348287792", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132836, "uuid": "66486600-65fa-471a-8f2c-a0e483210b9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132836, "uuid": "afd48a3f-f3e8-4fa6-bb51-c54bc3b131e9", "value": "b771c07a902c5ea5b469bafb66c9adde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5b6292-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686130061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130061, "uuid": "aef26205-89d3-4448-94d6-024fe1f0637a", "comment": "Malware payload (Formbook)", "value": "87994447a2e6b8bf9fe8b095660a3162", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130061, "uuid": "572b828b-f9f5-4d17-ad4e-ca2030aeb925", "comment": "Malware payload (Formbook)", "value": "154da40b848da265e6339dc5773113f75d1b7922b1273a9e6ee6782e33b6b6e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130061, "uuid": "6d093a00-3420-4e1b-995d-03a495d6baa6", "comment": "Malware payload (Formbook)", "value": "50fb8135c86604caea89b04de206ccbc8b23d7c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130061, "uuid": "4001c468-4a31-45ca-9975-7091508ab036", "comment": "Malware payload (Formbook)", "value": "adfd4833f41e626b98eef99c3fdd7e4d2989b68e613c4d99a45f9dd0b37d5effd619ba93a44feba96da47fe138c98c41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130061, "uuid": "38320787-6066-499e-aecf-39f5d89b2e13", "value": "T16705D04D97114297F0052B74CA6D3F390264097C78D2EBD5BDAA7B1BEEE2BA6143301B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130061, "uuid": "122f2d0f-1f44-4962-ab4d-be18f39de59b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130061, "uuid": "2683831a-3317-4a23-a7e9-278368fd1c75", "value": "12288:fRP2B0xTGlxNqvNu2hZ+nUEsn91KGemwTFNlwxhV0bqkKzyakL7aIUoZusMD:JPLaVUH99911Clw2GyakL7uowV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130061, "uuid": "ccf2fb23-b162-457d-9db0-5a53b7d8bea8", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130061, "uuid": "63a796f6-5b6e-43d2-80c9-b48c607e9368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130061, "uuid": "fe891c08-b58b-4cd0-8e64-556150c9f0d3", "value": "Release Pending.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6812e25b-057f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686175526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175526, "uuid": "fdcc430f-b494-4043-a9b5-1c32227acfa6", "comment": "Malware payload", "value": "501c1d4e27b01fb8ca9e369df0094b37", "object_relation": "md5", "Tag": [ { "name": "POWERTRASH", "colour": "#AAA91D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175526, "uuid": "50497de2-2ba1-41b5-9ffb-c24455201021", "comment": "Malware payload", "value": "16daecf77f7537b525c3488108cedb1827a30e65867caff330be6fa4a7d3fa38", "object_relation": "sha256", "Tag": [ { "name": "POWERTRASH", "colour": "#AAA91D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175526, "uuid": "92b62616-6328-41c6-90a2-d9e39553536e", "comment": "Malware payload", "value": "8687b6b1508a93556d6e30d14e5c4ee9971f2d80", "object_relation": "sha1", "Tag": [ { "name": "POWERTRASH", "colour": "#AAA91D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175526, "uuid": "c8d9819d-ebda-4fb9-9d16-52e1f0fa5f68", "comment": "Malware payload", "value": "65c154ba3dd89e22edc34ff3b4eb3274b1aa08668c1bba87c804e2fed476d6652008647935c431c2f37e3aae1e7bad53", "object_relation": "sha3-384", "Tag": [ { "name": "POWERTRASH", "colour": "#AAA91D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686175526, "uuid": "bdce0bf3-9524-4aec-b7cb-0c18405c405a", "value": "T164E308AD25C9B860F9F68EF0871F196D823B712114039833612D46D8ADA9AEDCF53D1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686175526, "uuid": "04e4faf9-2ec6-45aa-b490-ec75c8e8a4e9", "value": "3072:clJ/bm6nYJZvDxsmTtiheqGED44352kgXjAIkEwjgzue0NXH+:cPnYJp6fN6k0jANE6gy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686175526, "uuid": "ff1be4c3-cc30-4dc6-b463-2fce407761d8", "value": 152779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686175526, "uuid": "59008e38-6c3c-4968-a470-d3b3fa0a8751", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686175526, "uuid": "b37d3968-feba-4a38-836d-815469ce0dd0", "value": "icsnd16_64refl.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7faad583-04d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686100833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100833, "uuid": "ac01203f-4537-47c7-9ce8-6bd2148087f3", "comment": "Malware payload (RedLineStealer)", "value": "4f5ab96a34afb34d78a1c0ca96cbcea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100833, "uuid": "1c6cdc1a-bc91-4cab-8375-6fb47da15b82", "comment": "Malware payload (RedLineStealer)", "value": "1720bba0f582d13656aff96a8a5d94b32057f0c8d0236f8da85fc26195a395e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100833, "uuid": "4aaa4e0f-1163-4f28-8d68-da7d64d0e344", "comment": "Malware payload (RedLineStealer)", "value": "9ae5440c89f3fd35ad3467de8a9264a47b2bcc1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100833, "uuid": "2d49e13f-75a5-40a9-a5f9-fd938ed185d6", "comment": "Malware payload (RedLineStealer)", "value": "cbe60c6be339420d1d7f319a044fa4da897551484a6f8be4b67d343d0ccf35630fa00678c403960f8494371bcbf3c21d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100833, "uuid": "f2da644b-f321-44bf-ad7a-7bb126228729", "value": "T1F0F412079BE952B3ECF1277059F703931E3A7C32ADB987172788981919F3A9095307B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100833, "uuid": "b59f5a62-5997-48a1-8787-aacf2b12adb0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100833, "uuid": "46029e95-1cf0-40bd-b6fd-664394d6ad10", "value": "12288:TMrZy902KhlzMdCHOCbA8S1FRQHZbEDTbit+w7GxKk8:Ky74WdcjbA31FkRY1ws8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686100833, "uuid": "3b2d8a14-c2a6-4cb7-b49c-82f64494902a", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686100833, "uuid": "1ebe0ef0-3d7a-45df-9006-b1942f2dee43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100833, "uuid": "5e7b8538-c35f-4b9b-a3c0-772e0e0764bd", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60f7336-04d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686100951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100951, "uuid": "75061e69-781d-44c5-8936-a5b5f8db80a9", "comment": "Malware payload (RedLineStealer)", "value": "21d782e32f36ae5e4bf47f86a50d2231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100951, "uuid": "8e280a70-733d-4a09-bf3a-c4ebfa6488d1", "comment": "Malware payload (RedLineStealer)", "value": "17b06b8cdf3b99754409988f579971fa396ad1807570143818ef5c0c532dd86d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100951, "uuid": "ce06bc98-7e8a-4875-9e1b-aa40f176f04b", "comment": "Malware payload (RedLineStealer)", "value": "7e3093193b301151d44a3c8fb81c4b8bf2dd65b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100951, "uuid": "47648cb6-ebfd-4df9-9463-02bbebf9e854", "comment": "Malware payload (RedLineStealer)", "value": "5392f2846a187e1f7f6953a1a2527b00e8be19abf9d5a753fc18fb48ebbed772156447377784af50538b2a4623b4a843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100951, "uuid": "c83ae0d1-20d5-4e4d-a629-8e15bd6dcbfe", "value": "T1CA846D53E2A37D64F6254B72CE1EC6E8775DF9A28E59376F2218AA2F04B0071C163731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100951, "uuid": "80a195ce-2abb-451a-a46d-02c861099448", "value": "4bf83d17e4fe6ebaf744a99be88735bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100951, "uuid": "65e138b9-ce08-4499-bb25-4a18fdea862d", "value": "6144:CSLIJQU0V+DG5gu8Y5u2ujeYDwl1WsZN+DCaga:C6IJZoPkSu1w7yhga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686100951, "uuid": "cdf6dc87-4f0f-49aa-9ada-3805aa715b75", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686100951, "uuid": "b70655cf-7c8b-4bb6-a3bf-90ab65c2b237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100951, "uuid": "726978df-ae2d-4feb-85c8-c3fdc1ef0022", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80206228-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1686130039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130039, "uuid": "235fec19-221f-49cb-a2d1-fbcaec7bd070", "comment": "Malware payload (ModiLoader)", "value": "b6f21fe4cb78170b9014c760f3c699fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130039, "uuid": "db2cbffc-74cb-490f-bf24-d6dcd580f3c3", "comment": "Malware payload (ModiLoader)", "value": "1869006498e4d84feca842aa4cbe77ded86e5c8ef3ef97e2621079be3ad40a57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130039, "uuid": "ad7ae7c5-4e61-4d24-95c6-db37a44c6c10", "comment": "Malware payload (ModiLoader)", "value": "b6baf5a12516fbd1301cab295d40d9952f1b8ab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130039, "uuid": "7035005e-4500-428d-88c2-f03f5e25dd2c", "comment": "Malware payload (ModiLoader)", "value": "ae52b6188fc8322b9473c6b1b363db331dbdca6148fa2f83ecc0da4f27d7d7654bfa2e3ee87bcfb98720a003ccf911c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130039, "uuid": "f8228714-fe43-41bc-af42-d2fac6603471", "value": "T1AB159052E6608C76D4616A7CDC0B57A95C2DBF603D245847BAE43E4C9F3E3803826EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130039, "uuid": "5c78a92a-734d-4507-8af8-aaee15d0a810", "value": "f5b94f87a323eb9c8534a95d7c6241cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130039, "uuid": "5d1b928c-911b-4c71-8d0a-f549e6a9c4ce", "value": "12288:/39wCUzsHZGNTBQ+qqKY6kROWtMgPHY796WWQvXZb0nSojh:/twsHZCQoKY6sLHY796WWQvpb0Sot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130039, "uuid": "d86c3d9b-bf70-46f8-8140-82f82f69de97", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130039, "uuid": "169a9917-2729-4a66-9104-4b44ce174fbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130039, "uuid": "822f52a3-38ac-4c2a-be6f-84d4836651a1", "value": "Bank of China Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39db0e65-04d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686100286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100286, "uuid": "fb3a1eec-e6a7-401a-bd18-eb99015f29ab", "comment": "Malware payload (RedLineStealer)", "value": "d34f77e1ecaa4e4ad2fb3f1518a51044", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100286, "uuid": "2a7abf4a-2735-41e9-8c68-49687a49ff03", "comment": "Malware payload (RedLineStealer)", "value": "19ddd3fafacc7d926e9991afc1cd4be98eb3100e293d1abbeb998b07d7e5e5c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100286, "uuid": "49d7450b-9233-4ad0-b00a-a3f5a993c149", "comment": "Malware payload (RedLineStealer)", "value": "dc3090d20e73b5539c8caa1fe3a0a9b81443416f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100286, "uuid": "c362a228-ad7f-4344-8775-c8336ecf31b6", "comment": "Malware payload (RedLineStealer)", "value": "58a219bd6bdaf20ffc115bfe90219b5c9c3f28a791c968e17bb7e12ef4e4d76d59246770bc370ed83b1941e3f8e77efb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100286, "uuid": "f85a141b-cebf-4317-b208-29a63054151b", "value": "T1A7F422036BEC81B7C8B56F7418F607871B31BC629A74835B27915D9A0D734D9BA3232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100286, "uuid": "9e215831-8c49-4b56-8163-7477c8064877", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100286, "uuid": "67ddef92-499d-4df5-be7d-6163c3cf414f", "value": "12288:KMrxy90cFRWwooehJn91idBmZTLt4mtsHMyEuPkbXxq31GyQYpqFvOM:XyvfjLWd9eCrsHcuCxq8yEVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686100286, "uuid": "589983b0-3252-460d-a6eb-b1138bb9c933", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686100286, "uuid": "f30d060e-ace2-4c28-a475-3dbfaf60152e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100286, "uuid": "d99ed13a-5275-47dd-b7bf-0d9df1618a66", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29606d13-053e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Havoc)", "timestamp": 1686147503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686147503, "uuid": "620df88f-8a8a-4ba1-af8b-6087ad17150d", "comment": "Malware payload (Havoc)", "value": "0a8ef8b03ea08b3ef952d7b7cc7f3082", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686147503, "uuid": "476d184f-fd77-435f-b8b6-8142eb19811c", "comment": "Malware payload (Havoc)", "value": "1b21cb01abc19d486854e8cfd45ef320201730e38730e6c6d1075a1ba6998635", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686147503, "uuid": "45730b92-ba46-4942-8e2f-f73c36824e62", "comment": "Malware payload (Havoc)", "value": "7f35e8b16e08603703282d107c83e649d0422054", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686147503, "uuid": "2517f565-8f2e-470b-988a-f16e6ba5eb19", "comment": "Malware payload (Havoc)", "value": "35d15730bc7ec6d0b995629ded093cd0ddb88f9509c046f17e961631ba3f6f8a96b745b9d9b72e237c3cbf874af05b4f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686147503, "uuid": "b4666f32-62b1-4f9f-9d14-65e876e10741", "value": "T15653C816E29370FAC8B6C1B0879FA137F937F88919751F4D4B34C7192F91E61292EA48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686147503, "uuid": "8ecc825e-e5e4-4bc1-8517-4eab769dc501", "value": "768:cfrXBHj/Rd142ZbrUYFglAKm0/uQNalJZdLNwpMGP9oChC8oWoBXgzHvlXORDuYP:cfrRD/KKnEWvhwMy97I8oWoBQORD0qJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686147503, "uuid": "4eff0c4b-21fb-4cc9-a469-3efc370b8575", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686147503, "uuid": "8d0c0cb8-da2a-44a8-8bec-253acc211479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686147503, "uuid": "0a79433a-303c-4b0c-a0a2-be3f1b8441b4", "value": "0a8ef8b03ea08b3ef952d7b7cc7f3082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad779960-0517-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686130974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130974, "uuid": "e69476f7-0d23-4c27-a884-4c794ae4bd0a", "comment": "Malware payload (AgentTesla)", "value": "5a9ac906a8372028402081f0e4eb640e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130974, "uuid": "86370130-0191-4f91-bd5b-ebcb626972c2", "comment": "Malware payload (AgentTesla)", "value": "1c132ba72408b895776d0e5e21f30de4a546e0bfbe39d7b54fc50a3d5cc0a60a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130974, "uuid": "72eadc3a-978a-441a-8a42-bfbec4a586f3", "comment": "Malware payload (AgentTesla)", "value": "5350c709b115f24b3144e1da467786d6457a36e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130974, "uuid": "c6d5a51f-cb6f-45bf-8d9c-7f556c4d2c99", "comment": "Malware payload (AgentTesla)", "value": "663a8ce2755632355e6cd2355089946817e582e4b6789e93ea3a5f5dd3669291bed75881c1a8321d7f0405a02905b529", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130974, "uuid": "b31bc630-106d-4767-b0e6-02b509bf2312", "value": "T195F4025473A3541ECEAA7FBC18590778C6FAAA863513D3878AC7789CEC58F498B01353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130974, "uuid": "ce43a0f0-d6e3-4a6b-aeef-4a81a942e815", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130974, "uuid": "198daf8b-68ef-488a-a113-3fc2a48d202d", "value": "12288:5d6L7PVgfLiWbhaDnLMzIL2q+RTdOL86c2owHEqae/FF9b+H8vTugGHqesvFFhuO:vOyqGUL8dZwPwcvFuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130974, "uuid": "462eafbe-97af-424f-8deb-5cac078a9e20", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130974, "uuid": "881d67ec-8547-4f34-9f31-ede4c1c8b8eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130974, "uuid": "f8593aef-0668-4429-96af-9f8e28f40a9c", "value": "draft packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a39d903-054e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686154537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686154537, "uuid": "e9723921-cf76-4bb5-ab82-cb3f6198efbd", "comment": "Malware payload (RedLineStealer)", "value": "a1e4dd43ddee952868b093a4450f1c3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686154537, "uuid": "81b6c586-5bfb-42d5-9e03-05345dc34b8a", "comment": "Malware payload (RedLineStealer)", "value": "1d386a627a032b74676c03da200892abc2490b99375112c97ff0eeaa21cb2819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686154537, "uuid": "b23f3cd5-11c6-4f9a-9962-d90dc188a589", "comment": "Malware payload (RedLineStealer)", "value": "9febb5788c40b31b2aaa33460eb2a5ff397be318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686154537, "uuid": "06c0e5bc-bffc-43f7-b956-2ec92fdb38df", "comment": "Malware payload (RedLineStealer)", "value": "c2c5ff38258c6f901ad49ea9cd37d230fc0b6120f190ecd0ca655075ddf445bb7db3044c31797ca19d2eceb5a6b23e41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686154537, "uuid": "d0ae91fd-36e0-47d6-8588-9ab9092c8c1e", "value": "T1F1D32B9833886A9FDD6E897094740C6497F0A0676207E347BD47F4EB6E1DBC29F091E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686154537, "uuid": "fa1a0b9d-fd99-4fc3-ae2f-57a8fb5df721", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686154537, "uuid": "bd8bab7b-5d4b-4577-9513-7239222f2cad", "value": "3072:3Fz3cuGfV2vU3go1GmI4XaDxQQyYgafJlq:gfsmXQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686154537, "uuid": "2f9a4945-4baf-4c54-8c71-e0120abe29be", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686154537, "uuid": "b327fdc4-912a-4483-abb6-664f2157bf62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686154537, "uuid": "97487d5c-426c-48cf-b6c8-8786c5570ed4", "value": "a1e4dd43ddee952868b093a4450f1c3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e028b9-0553-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686156753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156753, "uuid": "40ce291e-267a-402c-816b-f1ac4f769ad0", "comment": "Malware payload", "value": "f616fa2c9aaf0290c5373733687d07fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156753, "uuid": "87b9ce24-e98c-484c-84db-4d7ead0230f7", "comment": "Malware payload", "value": "1d455058f3f0290ee0d11f98448483dceb465156be995c64cf8be9aa6a06fab4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156753, "uuid": "a57a72c5-1cc4-4842-9296-3970c19cb6d1", "comment": "Malware payload", "value": "6676eb8e670be99b7376e0bac5ead7b1f18ec49e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156753, "uuid": "f8abf1e7-7128-4c94-8b5e-e32a49490086", "comment": "Malware payload", "value": "6cd171237e9ddb7d68d754abbcbd03e24c78e60fb6c6961468218971dbf315b2fc4030997eee6ac0071f900b9ce1f9d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156753, "uuid": "61af6f87-fd4a-4f52-a697-931ec13e8529", "value": "T1836401D93BB5D003CAA55431BEA3CA763BA0DD551C98420713E57E9B3E3F3538C1AA29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156753, "uuid": "8dc246f6-6e97-4c6a-92eb-662e275aa13b", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156753, "uuid": "6a886d08-e860-4c20-ab4f-6d1fc1a91230", "value": "6144:Hwq3NpJC6tpo999B8sZUb5QYTEKk1IxlBa5pzpXvXk:Hzk6tK/BByKlHKa5pzpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686156753, "uuid": "74a19ac5-4e72-4644-86ea-bd421f7f009d", "value": 321360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686156753, "uuid": "28b24a7e-05ba-422d-b4b1-2b6cdeef1e00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156753, "uuid": "defe21a0-d370-4bed-8436-11fcf9552279", "value": "1d455058f3f0290ee0d11f98448483dceb465156be995c64cf8be9aa6a06fab4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858ccebb-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686130048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130048, "uuid": "448a438d-4c85-4538-8910-9e013ebd36ae", "comment": "Malware payload (AgentTesla)", "value": "1d051ebccc6208d2690076d871e4202e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130048, "uuid": "e14d617e-62db-4348-9cd4-7778d8f29d28", "comment": "Malware payload (AgentTesla)", "value": "1e5492854f8e9e427a594ac5938e7a798e084f7bc960a62fdfa076e3f929de57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130048, "uuid": "e575ff5f-33d5-43df-af18-3978ef980942", "comment": "Malware payload (AgentTesla)", "value": "f692c66774f35a248f0cdbf9934f1e569e5074e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130048, "uuid": "1d6f0765-f982-4718-8f1f-c04c55ed6638", "comment": "Malware payload (AgentTesla)", "value": "d815c603bb47e91f99a388dad501472a36230cda13ff96e343b144786845be1715162df8e36f3af26f40b3be59bae5ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130048, "uuid": "46bb6afe-e5e1-4cba-b0e6-4b3fffc602ac", "value": "T136F4F14075BF4B1BC1BA53F58A1062351BBE669DB9B2E71B4ECBF4CB5521F010A81B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130048, "uuid": "7cc2fa76-0a81-4583-9016-c5dcb26c09db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130048, "uuid": "40a6d163-4a4f-4216-8bcd-495be4844577", "value": "12288:vB2B0xTGlxNqvNu2hZ+nUEsn9ZT+RIOnXu7wRsQpwxU6usxWvllIdLvshULp2:vBLaVUH999ZT+yXwiQpwODsxylIW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130048, "uuid": "33c9a024-3297-43c0-a235-56026c4cd42f", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130048, "uuid": "b01f9a05-de01-4b15-a54f-3e05302c143e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130048, "uuid": "a1fc7eb0-aaf1-4bba-b12f-ee62bbcd25d9", "value": "Items Request Order654543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996daa1c-052f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686141249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141249, "uuid": "6feea023-974f-483a-97dd-4ae612ec86c7", "comment": "Malware payload (AgentTesla)", "value": "50b8466f02b4d7d9f758d9edcbc1a96e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141249, "uuid": "97783084-7dc3-4093-a6fd-b0899c5bfc0c", "comment": "Malware payload (AgentTesla)", "value": "1e7aa2c63467920e1f1ca449952e411e273dba0923d8513e840354e314cd463f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141249, "uuid": "f02b6e40-fd3d-407e-9971-32732e5251e1", "comment": "Malware payload (AgentTesla)", "value": "c643de3f4c9369a84d2a36ede71bd9ad4893442a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141249, "uuid": "4d0fcb79-1285-4c9e-b3a5-5e5c79fa0133", "comment": "Malware payload (AgentTesla)", "value": "e33a754c3adf7fd9fb5273492066f494e12885eac3a4f4711824d9ccd5ad7c3665562944fb9232846549d20f185545f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141249, "uuid": "f8b7d35d-dd35-494e-a53f-cb40c021b788", "value": "T130F3282C92C95FD1D32D43B9D5B41149CAB3A1429206E75D4DA1ACFA3F4F783322ACA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141249, "uuid": "23e46581-fdec-4fea-b8b8-f2859da367da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141249, "uuid": "59336661-fe98-4945-a07f-670c6f7dc7dc", "value": "3072:Y5XVv642sBaDVSW3nkuDV3cLtZK7gq9bBRkZ4zuuM172i:Y5XVv642tX3nk+xkD2bUMm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686141249, "uuid": "d62d4e92-91fa-413f-8b59-41c1e0558b8c", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686141249, "uuid": "9db5b8d6-d0ce-469c-94ce-38514246bea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141249, "uuid": "1b433f76-1976-4fac-9ec5-9c8e91df041f", "value": "1e7aa2c63467920e1f1ca449952e411e273dba0923d8513e840354e314cd463f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de4151a-051c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686132854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132854, "uuid": "501001ce-3e52-4784-a063-a96f77d05af6", "comment": "Malware payload (Mirai)", "value": "c93286fdfee6c6f0fb47c551574a006a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132854, "uuid": "9ed5729f-1611-44ea-af4f-57b4392d2f9a", "comment": "Malware payload (Mirai)", "value": "1ec5a287b04958e0481d69ce1785435db0acb181ec8b1b22ae65e9f7fad06893", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132854, "uuid": "ffc5ae3c-cb9e-40c1-b83d-46dc75449317", "comment": "Malware payload (Mirai)", "value": "80fbabcdf7a91bfcc269a0d32684c5f4288ccd91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132854, "uuid": "901c7edb-c6b9-4031-95ae-26917950d3e5", "comment": "Malware payload (Mirai)", "value": "87910424991a3dfff8fc0605e938467bb2de2470f8ed6e2c15c07f4c297c5774f8a8f31f6711a0482827a5daa7a39d73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132854, "uuid": "a87dabf2-1516-417c-a5a5-12ad52f10b55", "value": "T139431921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132854, "uuid": "700a12b1-0ef5-48fe-9ac1-ec6e24df75e5", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwj:RqtmZPuutfbltZFBSJsBcfDSTFI+BEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132854, "uuid": "df1b5085-10a7-456c-bcd9-3db54b89e7d8", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132854, "uuid": "d645f888-2ccf-4595-9ef4-a452dda48baa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132854, "uuid": "a8a96339-49c6-4170-ba87-184f9bcde062", "value": "c93286fdfee6c6f0fb47c551574a006a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d9da81-0563-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686163545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163545, "uuid": "2fb34d85-08eb-43e9-8da5-c7904ec9b152", "comment": "Malware payload (Amadey)", "value": "7098d99543dc9bfb9896396adda7b663", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163545, "uuid": "2cc43db2-5352-4e39-b1d6-fe5a4a86ac21", "comment": "Malware payload (Amadey)", "value": "1f6ef2c1bd52012a9e0841e42acb940c2be9892904efebb2178f9d353d52d330", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163545, "uuid": "bca4edf6-f3d4-4802-b18d-2a0ded760efb", "comment": "Malware payload (Amadey)", "value": "9039418e5dc3bca31d48e37c6d0decd34306d502", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163545, "uuid": "8341b3ec-1742-422e-b84b-26f808a6aa70", "comment": "Malware payload (Amadey)", "value": "6dc06d3a2d1cd011d1ca272c72909a055af19b9c887808592922836fa1fa210f11dbcb8aa04d75f13399cd46edf40a5a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163545, "uuid": "8f2e14cf-c5b2-408f-8c86-b5f3f52b17fa", "value": "T1D1C41252E7E89572DDB51BB008F702871A3DBC729C78A26F3365AE074C72680A17177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163545, "uuid": "3283d227-a640-45c4-bc6c-62a45dba3fe9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163545, "uuid": "1ef505cb-c874-4a0c-beb2-dfd258a875cb", "value": "12288:ZMrky90PyErhHKXHE4yuFHEP+oBxRvIb1eDDQIsozW7y4E:Zy+rlAhOwRMcno6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163545, "uuid": "0d99b42e-5e40-45dd-8921-02f752aaecae", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163545, "uuid": "a570fb2e-670e-4ac3-acc4-d45a3df2573d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163545, "uuid": "c2bc94f4-d8a8-4c0a-8eee-e961f998be64", "value": "7098d99543dc9bfb9896396adda7b663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea96e34d-052c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (BluStealer)", "timestamp": 1686140096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140096, "uuid": "5544bd15-9015-4be1-902b-b907d6ddf9b0", "comment": "Malware payload (BluStealer)", "value": "f77a40d5f587afc009cb42e780046460", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140096, "uuid": "1e5e2c53-2911-4a27-a338-466325d80560", "comment": "Malware payload (BluStealer)", "value": "1fd4f4c853506d7c826da1ff97789011981c3d41a4bed8d300cf32b3cb7afde8", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140096, "uuid": "1c736257-5217-4722-8958-e601319eba14", "comment": "Malware payload (BluStealer)", "value": "ad58cf0b1abf1612789d390ce041688274dd7e69", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140096, "uuid": "87cc7f92-e260-4faa-83c7-469aef8d4ea2", "comment": "Malware payload (BluStealer)", "value": "a90ac796515cd9788991fb53016fdf59fe825abf2d6968bd2ca98f76af45f5ee46c13ae9d42fd59a61ab2d50fad028f5", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140096, "uuid": "b3cbe468-d8a9-4ca2-b76f-f83211cf3c7d", "value": "T19194021167B6F31AD2158BB513FB836800A0FB315EA34D0FB70C6B5AA636D92D2B5317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140096, "uuid": "47e20260-eec2-4546-8e1d-2ae55b4d0af3", "value": "df8fbcbe90e1e305a660f0ac2aa4fae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140096, "uuid": "758f7b67-1e3b-4c47-a652-6970f883c660", "value": "12288:PWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:oxgsRftD0C2nKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140096, "uuid": "9573916b-d180-454f-8b15-32153c5d09a7", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140096, "uuid": "dec9d3ed-8b63-4b7c-ad6c-1d723d42c0c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140096, "uuid": "b10a1999-01d6-4d45-9838-5c6cc0689070", "value": "1fd4f4c853506d7c826da1ff97789011981c3d41a4bed8d300cf32b3cb7afde8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7632658d-04ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686112843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686112843, "uuid": "404040de-dbd7-41a7-b594-5ae920451780", "comment": "Malware payload (AveMariaRAT)", "value": "0c32372fdbbabc2195dca14023f49beb", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686112843, "uuid": "3b2b747f-6d48-4a2f-813f-d8f01bb92444", "comment": "Malware payload (AveMariaRAT)", "value": "202a1206fa5cec67fb482b0d89784cdf3ba62d30377bafb7724c4d784f6bd4f2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686112843, "uuid": "e972a66b-4e3f-493d-bdaa-778290f20959", "comment": "Malware payload (AveMariaRAT)", "value": "3972e77dfc1fb5063dfc7bfa8379b591242992a1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686112843, "uuid": "85f224d2-9db5-4702-976e-3ef99e9120b2", "comment": "Malware payload (AveMariaRAT)", "value": "4f5b492f6ad079e98ede866668b035f9aaf36a7351e75b4e16b5b65b20fae6d754fec216bd9c2d7ffba697e78bd2907c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686112843, "uuid": "2b92fb55-0e8f-4f12-8f0b-e6a5365fac44", "value": "T13455E0310659BFEAE66F0D70DA8314990CCB2FA7EE1C53D9AC843C9A71B5510AE49C73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686112843, "uuid": "ca163de0-3848-4c3b-8666-b087b07448ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686112843, "uuid": "a9f5fb28-a3b8-4957-822f-0d010b51bb8a", "value": "24576:BTCTP+mtbqi52xNtfdq4zlTLzRm56r8tMO/htouh66JWxmHUiaP8aDqSF6XB/:1aP+ria1xhu/Hh6hIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686112843, "uuid": "a1802818-de72-4b07-9585-c8698fec1c75", "value": 1391104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686112843, "uuid": "4e554b63-5dbc-4cb5-b39e-f24379a71107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686112843, "uuid": "64588f3c-1a24-4262-b19e-b2ca689bc604", "value": "Quote_JUN75698-LD8972390\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2341bb-0531-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686141928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141928, "uuid": "b13ab9cf-709a-4a21-80f8-914bf459d437", "comment": "Malware payload (Amadey)", "value": "3d1dd383717e9678f3575a8627002537", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141928, "uuid": "ebaca126-79fd-48dd-9f0e-8c439415e74a", "comment": "Malware payload (Amadey)", "value": "203dab69d53b6b19319025273231c069ea278f823175cde14911e46403aab402", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141928, "uuid": "cd9eebb9-fa56-4f2e-97d8-eacca6cdc157", "comment": "Malware payload (Amadey)", "value": "32727e3a41b62900637ef85cd852cdd606db9c69", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141928, "uuid": "4cdfb1f8-7a94-41d0-9b0d-51ce03c4390c", "comment": "Malware payload (Amadey)", "value": "fbae088c0eeeae1eb13da2d7cd08d5d9bcc4e103f7d6461ae112027aa5e52ada7ec3b1787cc39061f4d3d181ad073e50", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141928, "uuid": "6e70cb52-1849-47bb-9caf-4ceb7aab2129", "value": "T1BBC41217B2EC9172E8F93BB158F603870B35BCE15B34835E2386A55A5C726C4B57232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141928, "uuid": "49ded413-1cd1-42f7-8275-d616cf102070", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141928, "uuid": "4c9db5c7-834b-48b4-88da-1ac09b74e401", "value": "12288:0Mrky90tUOef8nQOOJkJYlBICHnuLbXheOr9:QyZx8nQO2kJuBlHno9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686141928, "uuid": "894b83ad-2ee1-4105-8485-ea7ed10b80b4", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686141928, "uuid": "b6cb220d-8217-4ef8-8f24-a906036c5758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141928, "uuid": "b20fd950-2107-48f7-b660-b384e53adc94", "value": "3d1dd383717e9678f3575a8627002537.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac02d3cd-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128395, "uuid": "54ed40a9-7b56-4e7b-ba08-2a1917c88e75", "comment": "Malware payload (Mirai)", "value": "e8bfea64dd0f9b202c3d94c0cd268bd8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128395, "uuid": "e734b7c5-9c09-49ca-bad4-401ca7c284e2", "comment": "Malware payload (Mirai)", "value": "22c74ff4a77c7d3237d97e312a13ebf454a5f01af61d66f0684f28efb495d6dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128395, "uuid": "ac730859-a901-4b99-9fb6-2ad2827dae0e", "comment": "Malware payload (Mirai)", "value": "1001034ab599c940fc1218814540c89109b8c356", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128395, "uuid": "f3f790ac-2cc5-4ce8-bc7f-739bccc96db2", "comment": "Malware payload (Mirai)", "value": "726b60216ab1e58d21ace555c31abd3f81fb7beada91bff9e034a43ce92d6499702c477e84cf93f8ea72367959bb808a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128395, "uuid": "fcd98c88-a86e-47f6-bbea-4cab67148735", "value": "T1C3B31877A4654F73C045A5F125BA9A310F12AD931B1F1A88773CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128395, "uuid": "fccf4fcd-21e3-4304-a565-508921bda36c", "value": "3072:MDVLSItJP+Xsp4JlN3HsjmH1cuEgvniuN/:MDV+ItJH2l3HsjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128395, "uuid": "f4a93177-0220-4826-881c-e9345c99960a", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128395, "uuid": "b29b803f-accd-412a-8a11-be8972a3610a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128395, "uuid": "e04f919f-9054-4677-946a-ef2ce0f3406a", "value": "e8bfea64dd0f9b202c3d94c0cd268bd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d81a75-052d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686140459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140459, "uuid": "986e250f-07b9-48e8-a6c3-a9ceeb6838a8", "comment": "Malware payload (AgentTesla)", "value": "6d7df39ef9e69775293ad9f57dca8408", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140459, "uuid": "762d3695-d07e-4977-854b-a398e137c4a7", "comment": "Malware payload (AgentTesla)", "value": "2350cd7baba805daf4c4216695cad848c3df79edd54e23aea3f953c33572c65d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140459, "uuid": "1db9e998-fba6-4c4d-840e-c700bd6a68c5", "comment": "Malware payload (AgentTesla)", "value": "cfedfc76b697e75731cb87fd993b869fd38d7f73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140459, "uuid": "a31ce826-316e-4444-a40a-9f2fc88934b2", "comment": "Malware payload (AgentTesla)", "value": "33f99a7e777d438219cf444e2019491f59d71a0fe50a5f20b9c4c2a63989a445d18e451b70b3cc4e396bbce56e7cbf6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140459, "uuid": "f5da0d15-25bc-494c-8698-3f2ff19bf141", "value": "T1A505E006AABA1B1AC0657BF80130517157FDED65602AC24A8EF739DBA470F33DD8066F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140459, "uuid": "d38ac6ee-06f6-4947-a1e1-976bff475747", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140459, "uuid": "5c1344f6-e384-476f-b9a0-40a08c0f80bd", "value": "24576:R1U9BqmycgiH75B/qXugDOdUjzXoeYwGDy9Zq06tQ+MMVl:Ru9Bqmycr7/Yj3fYf8Zq06vr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140459, "uuid": "539402ee-2a0d-4997-8409-373c28328d07", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140459, "uuid": "81d3e770-5ee4-49dc-998b-4ffe412dfd80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140459, "uuid": "5d6ed157-32c7-44ac-80a8-1f8e6b040870", "value": "VmuqZaRLWNtHaSD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8511f9d1-055b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PureCrypter)", "timestamp": 1686160112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160112, "uuid": "20c4001e-9d3d-4bbb-9e0b-2f49b0a1924d", "comment": "Malware payload (PureCrypter)", "value": "550d2c020b0ec15cbdc2bd7615e6b967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160112, "uuid": "ea331fab-1879-4932-9f70-b2ae36d29519", "comment": "Malware payload (PureCrypter)", "value": "23bd471ca6a85ccb1a1719d13c3a57326afcf131a070f35f26ac3eb6ee6ea189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160112, "uuid": "901783e3-1a0e-45bc-8f9a-58498681ab03", "comment": "Malware payload (PureCrypter)", "value": "347b9a683405202f581ef0210e3a544a5715a822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160112, "uuid": "9fbf4e99-a447-480a-b134-fb0d732cdfff", "comment": "Malware payload (PureCrypter)", "value": "04af5a2d02d0948d7da3ac40d7cda15bdde425ed5f35960302098b6f01d7f84ad1397427b603a73736f44334a1731bd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160112, "uuid": "5c7a2c14-5703-43c4-a029-6d8488a239ed", "value": "T109B31A2677A6C962C39A57B6C6E6452003B2EFC1A693E70D6D8E33D904537F67D08B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160112, "uuid": "603fea86-d1a2-4cfa-933f-0faee2b3abf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160112, "uuid": "66fa1f5f-addf-4fa9-960a-535248ec4d68", "value": "3072:LQDvyk5f0s6KrgIV7zPl6FmmCFe97MYfhhj0/792zY8//5R:MMKrfv0FT9Jfu92z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686160112, "uuid": "053b6226-7c7e-4966-905b-237556d6dfcf", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686160112, "uuid": "dbaa8980-c21d-4888-9b98-ea9c882e7fe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160112, "uuid": "5d5863d1-5da3-4696-9355-6322462bad86", "value": "23bd471ca6a85ccb1a1719d13c3a57326afcf131a070f35f26ac3eb6ee6ea189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be305948-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128425, "uuid": "7cdb1f6e-d548-4c5d-ad7f-627acd9a14dd", "comment": "Malware payload (Mirai)", "value": "690bfb1ff58b465ea4f2125a63a9366b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128425, "uuid": "069b55df-9ad1-4c14-a6dc-0a6b8eb0b819", "comment": "Malware payload (Mirai)", "value": "23c60a2798a2ea5c48f74140b9afd94e2378933febac1a44757446bfa7fef24e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128425, "uuid": "ca47c8d5-e28b-4a91-ac52-67851a8c9c33", "comment": "Malware payload (Mirai)", "value": "4fb89fa5f821b1b1d38ba95b16172eb653c07890", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128425, "uuid": "40fd1218-4f29-448e-8b17-b62bdb1af8c2", "comment": "Malware payload (Mirai)", "value": "9db2a7913cfb54d9a6263da88998cfc56071ede0825d04dc955f27a7dd4186657abed669283742a9a036e9a1cd4ef1f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128425, "uuid": "a9bf8f75-fbd5-442d-9925-d78d1b7bc7c6", "value": "T18A63960E7E228FADF7AD873447B78A25634C338A36D1D185E19CDA111E7024E641FBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128425, "uuid": "e59c3fa8-ed81-4b70-9985-80a4f00e5887", "value": "1536:crE9xX9yyW/0gJhlr0q7s8h2HTmfSWPRRKrj:7xXEyW/1HYJ8hBRPRYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128425, "uuid": "af017800-3e0e-4689-b1cd-312d2f08ada6", "value": 68296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128425, "uuid": "a3e0d30e-f8d6-40b3-9607-b9f3a446a5f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128425, "uuid": "5b1490b2-1b69-4b1b-9453-2ed2d9088272", "value": "690bfb1ff58b465ea4f2125a63a9366b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc256f0-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686128425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128425, "uuid": "ea7b457a-d7bc-49bf-919f-f0a0b07dc2e2", "comment": "Malware payload (DCRat)", "value": "d35b5bab08ed6803970d14f007dc8ee3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128425, "uuid": "37d41960-5bf1-4439-9f3b-fad81a4aee6c", "comment": "Malware payload (DCRat)", "value": "23e67c1d86130177dd66de26bcf6da711f4d0b7c7be298b891f6ed78aaa92f6d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128425, "uuid": "297831e4-0919-40a3-86d8-25b79553c5b2", "comment": "Malware payload (DCRat)", "value": "b9613baaf96d486ed66de01a20d5f5c033909009", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128425, "uuid": "31230892-13a5-4cd8-b465-3ddc52f8cc66", "comment": "Malware payload (DCRat)", "value": "a7af49e94194481676411a9974547784b9b09ea6ef87b2a319316ef975fdf2955d10ef6c3c65d77f5cdcb33429af570b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128425, "uuid": "687ed008-63b7-4e07-b8ae-8c3ee3596f22", "value": "T14DD5DF017E48CE12F0091633C6EF494887B0B9556AA6E72B7DBA376D59123A37C0DDCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128425, "uuid": "a0b43ed9-9962-4e11-b017-de92d3448d37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128425, "uuid": "20614a2e-4fb7-4ca4-bb2e-060a29d619aa", "value": "49152:vveqMsE56Ff0uutJufj+B5PcX/OtnDTtFjnbHIJZrZBBx5QfU:vv8aFDklB5PcX/mdF7bHIJZr3Bx5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128425, "uuid": "30cc6c6a-e501-4cd7-b1d8-46da4d5a7cff", "value": 2783232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128425, "uuid": "c78cb538-b18b-423a-aec7-8cab8dbfe8a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128425, "uuid": "7c1b157d-c9c9-444d-bbdb-bbc4d439ae03", "value": "23E67C1D86130177DD66DE26BCF6DA711F4D0B7C7BE29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b03eec-0531-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686142227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686142227, "uuid": "6995f7ec-a2f4-4900-8699-103b653e0f44", "comment": "Malware payload (Amadey)", "value": "2e8c4e7676819e44c84e88e304a277a1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686142227, "uuid": "2a6e403a-a8a1-43d3-80bc-a0a9bcab5e25", "comment": "Malware payload (Amadey)", "value": "2497d87863ae5149b44d47397983977003c4de36551a70ba2b66043953859a57", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686142227, "uuid": "b627829a-3430-4c17-a57c-83f2503763a4", "comment": "Malware payload (Amadey)", "value": "8213b57ca5bfbaee63d8db349dad2521bdf04d42", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686142227, "uuid": "4093e78b-f6ae-4ec9-993f-2ff9b98c7947", "comment": "Malware payload (Amadey)", "value": "720d19f12fb324637fb677a7fdb783cde76adb88d3207954e8723469fddd6cea83ba374c60d6dc8cbdae1e47570d30ce", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686142227, "uuid": "385bf3a8-657d-4a15-b2de-f8fae7b7b624", "value": "T17B052213FBDC92A3EDB5077098FA03C70674BEE61E74915B2B46588A58B39C4A432377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686142227, "uuid": "f8bfc69e-97a1-4068-b683-debcd4402045", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686142227, "uuid": "f29b7db7-4f99-45e6-a169-5f25263f4b02", "value": "24576:Ey2EFS0k1DCQ9XW7KYpxA5ezKz4kmmU5fJRQ9:T2EUZbXYxA59mFlJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686142227, "uuid": "0fb9f530-d56e-4726-8547-181b44784e03", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686142227, "uuid": "59a6acb0-557b-4da2-a63d-0891493ec058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686142227, "uuid": "6e294c29-fb6b-4df4-b182-2e24b544d024", "value": "2e8c4e7676819e44c84e88e304a277a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500beeea-0556-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686157876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157876, "uuid": "717e8d14-3880-465f-b352-e7a77b0051fc", "comment": "Malware payload (AgentTesla)", "value": "6bd92835be8c84fd218f640730ac01d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157876, "uuid": "4748eeed-f41e-4d54-b53c-3b6c166c3937", "comment": "Malware payload (AgentTesla)", "value": "24e0a3aedd9e710a748e81aaaf062a95356753f48fb3cfa94ed5cf18c1c6ddfa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157876, "uuid": "277edde8-4bc9-4091-bdf8-16016dfb06ba", "comment": "Malware payload (AgentTesla)", "value": "cc48d75b6731459b7bef5a5357920b6f10fa6eb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157876, "uuid": "17ef02b1-cb4a-4675-a853-417a9b8ed501", "comment": "Malware payload (AgentTesla)", "value": "cc1d8af2fd3ca6b9bab5c712741393e9d406b6097f9dcf5aa6b5dc7a51a3f0ea8ea5f0677d0b14769cf4eced0122782e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157876, "uuid": "422711b9-4f8c-4bbe-ba2f-e3a5b8f548bb", "value": "T1C8E4BEBC3195B9DED81BCA3299B87C70962070F397CBC62351271198CE1EA96DF085B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157876, "uuid": "5cf42339-0c24-4384-8fab-eb55e8f598b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157876, "uuid": "5c815719-94e5-4487-a35a-03e26fa310de", "value": "12288:k8pbOBv53i8y7ZUviZKxXswDN4zQkRNJOPLtu8zj+wrWC1lj4SmwHfFDGWQ:3Ux5ihmi01hDaEkLJCDzj+vCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686157876, "uuid": "72469be8-1adb-4913-a455-131cc9408a23", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686157876, "uuid": "5ff84f56-cc79-4a89-8cda-14e930c78bd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157876, "uuid": "71d3d453-f4f2-4982-bfde-d8e19bdff65f", "value": "24e0a3aedd9e710a748e81aaaf062a95356753f48fb3cfa94ed5cf18c1c6ddfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8e8cba-0549-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686152552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686152552, "uuid": "47c2be5f-91e9-4411-b540-3603d473ff4f", "comment": "Malware payload (RedLineStealer)", "value": "c0381bb4aaf380e9c4f14db3a445745b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686152552, "uuid": "657208a6-2c7b-443a-ba38-7d565693416f", "comment": "Malware payload (RedLineStealer)", "value": "25135e4a4a2701f6dc8be4db4822aa877b486a39dbb7110c485b93cfe97c9fa0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686152552, "uuid": "cb519393-7b51-4be0-b724-e2f13b4ad0a7", "comment": "Malware payload (RedLineStealer)", "value": "91833cc5bedc4276e0b274ad3f0f23d3618ac29e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686152552, "uuid": "436e4ab5-832c-458c-bd1a-f5bb5a10b612", "comment": "Malware payload (RedLineStealer)", "value": "7460be6a4617615065390c83c667a7227db60a583948c6c76778bef5f455f6978eb3adaddb5c595567e3f8727741f04a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686152552, "uuid": "5800833b-7876-4549-a321-83eeaf7f619b", "value": "T1DCF412039BE54473ECB117B018F727C30A367C729D78964A33A9AD594D332A4E97272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686152552, "uuid": "1c98f536-2274-427f-8601-dfdff4592eba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686152552, "uuid": "13aedb9f-f340-4748-8792-200818b0b89f", "value": "12288:xMrny907k6FPP6cy+Cv8JHAejteOKHGPDfSFzxA//l3YYs:iyqxPt1JgeQO0GOFzxA//l3YYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686152552, "uuid": "a1382d52-d442-426e-9b90-f8f3564594a6", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686152552, "uuid": "2dc6b1b9-7335-4fcb-a5c5-90f5c4b1c852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686152552, "uuid": "bf35fe9f-cce1-49cb-ae0d-cb68cb2afcf0", "value": "c0381bb4aaf380e9c4f14db3a445745b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8732098e-0563-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686163552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163552, "uuid": "397e3029-9a29-46ba-b752-9595e4c8bba2", "comment": "Malware payload (RedLineStealer)", "value": "a14b4638a03b1aed3940efe11f1e378d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163552, "uuid": "7fec0970-a37b-425a-84ab-4042fd646c3b", "comment": "Malware payload (RedLineStealer)", "value": "25e0680b5662e36ea3319eff62390153427d097238004d4b3326e793f078e3c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163552, "uuid": "e3f1194f-03ff-419e-af1a-8e1bc482d719", "comment": "Malware payload (RedLineStealer)", "value": "a571155a2f23d0f585031eddf2bcaa9e64e265dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163552, "uuid": "c970c038-9373-4cd1-900e-520f46710699", "comment": "Malware payload (RedLineStealer)", "value": "68d7552bcdd36caaac7ec68f95221352fbfd9af8b9c7e8422efc307ead80539cdb106f7d08bd70703125fd03c3ff1e65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163552, "uuid": "766d3da4-8fc4-41d5-af1b-f8d087a9d0b6", "value": "T113446B09E4AF52D2FE467176217D905AF5BF80F313BFC02ECF5A3AD21C572A096A111A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163552, "uuid": "45b07ca8-31cb-4b79-930b-5e6f12630737", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163552, "uuid": "e18fffeb-81e4-4db2-93a4-b7926f9690b0", "value": "3072:Dhg73zv1GOdRyHFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2yQHcj/:1g/v1yFaQ7W05AEezbMPZFzAy2yA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163552, "uuid": "9d29f0f8-8f51-44a2-aa8d-6a2535593482", "value": 268217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163552, "uuid": "2b8dbda8-654c-4fc4-83f8-e1a59b7d271f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163552, "uuid": "feb44b07-6e5b-4631-a4af-5dc881b7ed67", "value": "a14b4638a03b1aed3940efe11f1e378d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b2c7f9-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128389, "uuid": "f5fffe8a-b765-44e8-89c9-5340089fcc33", "comment": "Malware payload (Mirai)", "value": "6ac12a6304a38e832bc7dc6b56e9ee6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128389, "uuid": "102d2116-5ead-4e1b-b3c5-bd4e7d4a11a4", "comment": "Malware payload (Mirai)", "value": "27f7e80c7a4e4eb40bcd9ecc52890751b8bc9825a95ebc8ea7aff2d26918ccbd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128389, "uuid": "436ed139-62be-4734-b026-fa55575ea547", "comment": "Malware payload (Mirai)", "value": "148ec72b8a583e695d417b23dc0055f11636dcfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128389, "uuid": "6cb8a514-329b-490e-853c-fb7bd44610ae", "comment": "Malware payload (Mirai)", "value": "0124fb6ae03d9a6739e41e708a61389fc2ab2318ebf1fab3bca466948eacb2c1323d51c3ebacb93669062c89b507c735", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128389, "uuid": "1cbb33bc-fd86-496b-89b8-208a0a1d8b9a", "value": "T180C3F831E8044B1BC2C223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128389, "uuid": "d7354f9c-d4fc-4eef-85f5-b830314f3148", "value": "3072:6jVlyaL5JCrIpv04s8bttiEiTmP46aQyfPlfKsNb:yoCJCN4s8bHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128389, "uuid": "3be5e9d0-a068-41eb-9605-12e8ac8c728b", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128389, "uuid": "9897f3cc-4e71-4723-93e2-2c02526e34fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128389, "uuid": "e1ce2d12-e744-4df4-8760-8a34d1dc137f", "value": "6ac12a6304a38e832bc7dc6b56e9ee6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a82ff95-0563-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686163557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163557, "uuid": "29786216-ccda-4930-9099-18b353eb5f4c", "comment": "Malware payload (Amadey)", "value": "f0caeecb5cf4ed51837f0f37ad54235b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163557, "uuid": "48206159-b3a4-4e0c-91dd-a0eac015b76b", "comment": "Malware payload (Amadey)", "value": "28586ca44b9c0170e28ddfb1351e8b431a6f97df598c2326125881a677af8b7d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163557, "uuid": "70e77eda-6742-4e07-bd64-c593b2d4ddec", "comment": "Malware payload (Amadey)", "value": "bcd7147ff00e32e6d8bf5681e21483e86dba8f2a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163557, "uuid": "a460cae5-784a-495d-bde7-d68c2d1a4370", "comment": "Malware payload (Amadey)", "value": "2ef1118d3e575436fc566ab7d706be1b35dfd18bf14dfff01bfe1009ccddb64a90fd8d57a267302d79d4f845e09bb493", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163557, "uuid": "ba3fb341-1f51-423a-938f-f08fa06fc778", "value": "T1ADF42206ABD04433DCB9537058F30B971B35BCA3AC7996BF278558AD1CB3640A836B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163557, "uuid": "e131b5bc-abf9-45b1-bf67-b87dfbbb07e0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163557, "uuid": "89dde094-d3b1-4d17-b3f2-136068068521", "value": "12288:yMr9y90HH8563iQh52QTHwOkxJnt0e5BFPKQQmzXuC9EUv6/+iN/K:/y6H46yM2QIBcXuXH9ES6/xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163557, "uuid": "56d86c2a-c28b-4ff2-be2f-1a12f4f097fc", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163557, "uuid": "508b57b7-7343-4557-b016-128566ff8cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163557, "uuid": "f1e8d531-71a2-42ab-9223-9e51c77489c7", "value": "f0caeecb5cf4ed51837f0f37ad54235b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6b1d13-0529-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686138489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138489, "uuid": "55b12a01-6061-4691-b1ae-b82cfafe4cad", "comment": "Malware payload (AgentTesla)", "value": "48b2bf49e8ec69f447a977cc1d426d47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138489, "uuid": "14b143d2-ba06-40d5-abcb-d15f15c909e4", "comment": "Malware payload (AgentTesla)", "value": "288f31a1063e8f1c9ad0d4619403094cac782c151947020b338d24336010dedd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138489, "uuid": "a267c0b7-60fa-4c0d-9042-e3884a41d1b9", "comment": "Malware payload (AgentTesla)", "value": "7885777dc91bca9459372d683ef153bca24fc1d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138489, "uuid": "143ea6c9-12d3-4375-b36c-29b2a67a862b", "comment": "Malware payload (AgentTesla)", "value": "ec543e2a3e22e4f1188b9aa5c1201bcb18685306db0b34ed342906ccc0d7744c23173948ea1c46dc43a3861ab0057975", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138489, "uuid": "7d48c73b-5dbc-45e2-b308-f790b6e51980", "value": "T1DA42941512FC6B3BF4F432F9D966810602B0DE3C872EBB1A8B80F47ADE426100D916F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138489, "uuid": "505af999-a1ca-42f4-a627-4d37f7967070", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138489, "uuid": "f2c25154-85c0-4df9-9ee0-ceb08bdaf000", "value": "192:ifTLeLFilLFEYjJ1DRulJ04PeUQZnawhddd0dJX+2lXXX5XXXXXXHXXXXXXW6eFC:ifTLeL4lLFEYjBsJz4XNOJu2SRyd8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686138489, "uuid": "d128b19e-6a6e-49cb-8380-caf092afd773", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686138489, "uuid": "1862f5ef-ca3f-4000-a45e-08fc4e1b8869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138489, "uuid": "f3cac986-b0e3-4f4c-affa-b7ffa95e4d41", "value": "288f31a1063e8f1c9ad0d4619403094cac782c151947020b338d24336010dedd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b830be4c-052e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686140871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140871, "uuid": "078d349a-c582-41c9-8e92-397785234134", "comment": "Malware payload (AgentTesla)", "value": "80258c5e4dad5920bd4edc1215c23d0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140871, "uuid": "bde243dd-fe74-4a94-9309-57bb6b6c38b5", "comment": "Malware payload (AgentTesla)", "value": "29cc2fbd6fe5239934f809dfa390b13659d89d5a0aa51bf9ede079b7130bd85f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140871, "uuid": "06bf6fae-8810-43db-be4b-08459ff2b6b0", "comment": "Malware payload (AgentTesla)", "value": "1b7d89e944b55225cfc8d49684b018984cb56357", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140871, "uuid": "a3a688e3-42d5-4fe7-b2f0-48f2e98b5c3a", "comment": "Malware payload (AgentTesla)", "value": "5c7c6a82b0fc1e9db03bddfeb2f4deff3b1d6e49f4a44c426ea5fbcc8bc9bf79d9d91f489dc7c5fa0c2f44a190a8c2c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140871, "uuid": "67ab2792-1d59-4325-a6f0-8bdd3a109e9a", "value": "T199E4338668FC81755BF18725BF73627F64736C8EFA5AB0375A76008252068851F7ECB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140871, "uuid": "e639023b-db8f-47e9-b442-aad28329b324", "value": "12288:h42idbGDRbLaPCWykblACo5arThBUoLLiC8BWDgBcEeszjv4QbhOAX0WNP5g:+1ZSiCWyWnoqThBUILitBoyiAvrVOKNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140871, "uuid": "d571b4c5-aa44-47e2-a9bb-ba874c30fc10", "value": 722224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140871, "uuid": "f21cee37-fc73-4188-9807-d699e0928a98", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140871, "uuid": "d7ea4567-8729-49e4-b9b0-0bb85d263a46", "value": "PO 614457.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6395e436-04d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1686101645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101645, "uuid": "ec2232d0-2520-42c7-b7f8-8b518494d82b", "comment": "Malware payload (Fabookie)", "value": "33c128ec877611207088b9ca2500e20c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101645, "uuid": "64f7b6e9-ba9f-4fed-a4cd-7538932fbd99", "comment": "Malware payload (Fabookie)", "value": "2a4ab7936bf50e890d3d4dee9e2b00cf81e60a022ed440245fe1734c4f8fd663", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101645, "uuid": "7c3bd64c-8cf2-4412-b79d-94af3f4480f8", "comment": "Malware payload (Fabookie)", "value": "35af516f6a332fbd468b05342547535fd2d87578", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101645, "uuid": "5118c8fb-dc34-4774-afe4-124d346adf42", "comment": "Malware payload (Fabookie)", "value": "389b4e87d77e51379fcfc549f92a150cab469e36d56ce2d35bfc83981d5f02332ee66c34869d854735fd9900dd56095f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101645, "uuid": "33a8549d-ca0e-4f73-8be4-74b07a5542ac", "value": "T19544F853D6A37D54E5254B72CE1EC6E8375EF9A28E593BAF2218AA2F04B0071C173731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101645, "uuid": "06aff18c-bc57-4a8f-a19a-065b0683660a", "value": "4bf83d17e4fe6ebaf744a99be88735bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101645, "uuid": "0119bd52-7ac1-40bb-ad75-d34524788132", "value": "3072:WRE3e//m9hDEz2H+fpxF9uqfjjv/OI2scwPcxwabpe2nXv:N3eG9hozRDnRiw0xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686101645, "uuid": "8902a271-aadf-46cc-bb5f-f18104ac7218", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686101645, "uuid": "40feb9e1-96b4-4589-9281-ab2ab6e1cd6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101645, "uuid": "b2938f19-4254-4326-aa5e-8fa3354c631c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2250cc87-0564-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686163812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163812, "uuid": "130fce84-d4d8-4e90-b65f-53dae78443d4", "comment": "Malware payload (RedLineStealer)", "value": "e113783086cfcc3b44440e14fda0248b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163812, "uuid": "9098fb56-b70f-4905-8fb4-dd184a635bca", "comment": "Malware payload (RedLineStealer)", "value": "2a5de2e7ec1dcc3e5b3c1a702b2efd8a60f928dfd641f152212647ed0c067218", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163812, "uuid": "74dde6c7-b916-4689-bff2-704e4e4cccc6", "comment": "Malware payload (RedLineStealer)", "value": "7f9f65f509dd31ad729adbdeb1d298308cabe287", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163812, "uuid": "c28bcfd8-4f83-40ca-85a0-a1ac6d83c859", "comment": "Malware payload (RedLineStealer)", "value": "9b5263609addeacf02c761fd3e2d5d356e0552ce78910864de2498e69585eaa6576cc839d72447c625815c33ebffc430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163812, "uuid": "5c56d303-6c0e-4f1d-83a5-ea640dfb1c2b", "value": "T18C84BF02E2D1B871F5E246364E6EF6F4662FB4615F3C67DB23464A6F09321E2C972309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163812, "uuid": "a95b34f7-42f9-496b-82ac-f11b5cc72115", "value": "04fcc8db11b5c1b7316151fcbb546c01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163812, "uuid": "aad58e8d-03f0-4dba-a72c-8e9640268e6d", "value": "6144:/ERgeoWMdbvduvviWtFTx/g90S8MFhQHLMWbnu1DCn:sVJQbACSzgCS8UOIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163812, "uuid": "08f6601d-85f8-4730-b8cf-d30d35f9ba4a", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163812, "uuid": "0a724bf1-9ced-4f34-91c1-46f3c93b1ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163812, "uuid": "07ebe06e-c69b-421f-99d9-296df971561e", "value": "e113783086cfcc3b44440e14fda0248b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe980e42-0530-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686141848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141848, "uuid": "bba0d2d9-2384-4c6f-84ba-32038479196d", "comment": "Malware payload (AgentTesla)", "value": "6bf5567db5d1b3d733b7ceddba51f1aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141848, "uuid": "289f45d1-d7cd-479a-9306-29a5290a7ae1", "comment": "Malware payload (AgentTesla)", "value": "2b34e51260313ef0ec7b341df770adfd5b4573ffdb60e6e59260eb38d217768f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141848, "uuid": "ca65734a-4ab6-486c-a354-9333c85162a5", "comment": "Malware payload (AgentTesla)", "value": "dd09502ef706d41b0311f0b9502b527b1c8db6e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141848, "uuid": "40790fb6-867c-47c2-9b67-c76b86c1b95f", "comment": "Malware payload (AgentTesla)", "value": "5541a2348710e9a185fd80d4bbe278e1d6a4adc81a4faad042fdf3497573b779a93b7f3371bdfa7abd9faada1db19bce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141848, "uuid": "60f48e89-d186-4c8a-9998-4bc256342493", "value": "T175E433BEC5D4B480FF31EBEAA9E408443574D2569C58F325AD4FD22A07582D786923CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141848, "uuid": "3490c50d-ce26-48d4-9914-595e64154bbd", "value": "12288:mwcpysjF0m4Wn9S/t5vTf4gbkJ2q8wc37MoaThtdeO0hlluCYNFpd4e1TBBSs:tcpyrmdqv74gBq8wuTghj0hlKNFpdp1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686141848, "uuid": "e8e0e8d0-ef49-4dfe-a5b2-88e3ef4d1ad8", "value": 718455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686141848, "uuid": "d271d121-0020-42ad-befc-de7dfb574296", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141848, "uuid": "52f2d494-ccac-47e3-8e0b-0751449d65eb", "value": "Invoice 38129337.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f543ea4b-052b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686139685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139685, "uuid": "edd5f7a7-495e-419d-831f-31dc70f3e3ff", "comment": "Malware payload", "value": "7385ab144469552f5e2fb5e29857ebe5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139685, "uuid": "4b780427-6817-44e0-aa91-83cc3ccf4002", "comment": "Malware payload", "value": "2d5f28202160c3fb16c435297833e9c6aece340cff9b0455cb26fbd725232dc2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139685, "uuid": "dfb853ba-e8d7-42e2-94ce-fbd543d444ba", "comment": "Malware payload", "value": "242bdef0084869b0e410f919fc73d2da1102a700", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139685, "uuid": "6af0a457-0674-404c-9959-fd0c29bdf517", "comment": "Malware payload", "value": "936db9a096bd083ebe4e77260107941b23236e7fde2887f71040d5fb38a402a51ed6a6aac3a2cc2905686c69bfc03abb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139685, "uuid": "df21c260-76d2-4779-96cc-e59fb64d5c30", "value": "T13422BF4F55C08BB2F02F9970C61EA586C13A3F317B2A51BC29D19688CFBCED8D4CA841", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139685, "uuid": "61853d27-31c7-4304-9101-e3dbabac2749", "value": "192:AuROj0jtFeL5LQ1k6RDoMa52UmgD3A3vSEEs5looo3f6ZJ94AUGRxWDd:RckFeRh6RDCQUmFqUlDov6f9FxWDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139685, "uuid": "be598140-5b16-4381-9685-7ecbe788617d", "value": 10692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139685, "uuid": "5e2fc23e-ac6f-41a4-ad16-5c26bd630ca9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139685, "uuid": "5a1bab55-8ece-4492-8d9a-e993f30dcb94", "value": "TRX67456745.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabc0874-0535-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686143989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143989, "uuid": "29d5e13e-2fba-4666-b53b-e3d03756da6e", "comment": "Malware payload (AgentTesla)", "value": "19941562c7a35cab712d5dc1485512e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143989, "uuid": "9c0055af-baf4-4b3a-9e6a-b5d47a6847d4", "comment": "Malware payload (AgentTesla)", "value": "2e7ca0ae22bdc084dbdc5672fc1d6f858d935e03866da20c898d6e69222aa32c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143989, "uuid": "2ff3584c-123e-4644-a6d3-2e92226e2258", "comment": "Malware payload (AgentTesla)", "value": "1d920bb88108decebc4b0f406b2207f528d3506e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143989, "uuid": "087de45c-e6f5-4374-98a5-38de4952d08b", "comment": "Malware payload (AgentTesla)", "value": "cc10e665b730bc5bc36824c0b03f01d21e1b983f2811c9fb39c055db8ccbb18bf17a2d7d334733f8f518d43531218ca4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143989, "uuid": "9d2960a6-4459-408f-a738-5c5b40a8864d", "value": "T13405E08CA2FAAF17C47A6FFE0420117083F5455B303EE69B5DD264DEAE54F090A84E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143989, "uuid": "aaa91f24-37b9-4727-979c-731c3e95f69e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143989, "uuid": "576bf521-c708-43ed-93e9-82d20e874e03", "value": "12288:wUlRuDthaDnLMzIL2q+RTdOL828dBJTG9zi4r6VD68fmW9sJW/XuixaAhMZAS:wUlRuDOyqGUL82OlV28e0/XvkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686143989, "uuid": "3e468523-e765-4484-be6c-d667c45f5960", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686143989, "uuid": "8c13dffd-5687-425a-a6d1-800d98964068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143989, "uuid": "7594e74f-d308-4d68-b415-5c7e4d0ce6a8", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3628d9b2-0564-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686163845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163845, "uuid": "bd25971c-ac1a-4ac7-b636-17d93264b60f", "comment": "Malware payload (Amadey)", "value": "c13bf8c9c81c940a9422d67e45794a85", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163845, "uuid": "35e5b6b0-9b36-4ec6-95a1-5099c361aad0", "comment": "Malware payload (Amadey)", "value": "2ea48de0cb2566d92d84d31e518ca7e3da48d1ffcc8268a4222e8f7b3a99dddc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163845, "uuid": "9d60224b-83d8-4b48-8fbf-bb86fecb0a01", "comment": "Malware payload (Amadey)", "value": "49379a6d7f3e5c36cf135b29378b7c50211386fa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163845, "uuid": "5637548e-5f11-41b6-8d84-ec68b31ba0c4", "comment": "Malware payload (Amadey)", "value": "351cd94f27e02b4a0b112f066cc2af4960384fc8ca9f68d52025397ab29ce899eb68e504a49a6dd2c99c4bd3864880d2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163845, "uuid": "ad937409-0dd5-4316-8981-77110b4ff9d0", "value": "T1710522069BE88036DD75373458FA47C30E36BEA19D70469F23C58D6E8E727D0A97132A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163845, "uuid": "029bd1f6-bae3-4958-a707-27d749f4e4ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163845, "uuid": "0f27d3c4-3e3a-4c75-88ab-1b0107a27b7f", "value": "24576:EynG9ikKG0B0c/aStCkbCnyQV7SInoX1Ihu:TGkkJ0WcntC8O5no1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163845, "uuid": "aaacf115-e25f-4313-876a-861e652dcbc3", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163845, "uuid": "b199ea62-bb24-4f73-800b-44b54db4cb7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163845, "uuid": "6a71dce9-65c6-44bd-8a8c-ebb7d4df8845", "value": "c13bf8c9c81c940a9422d67e45794a85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949d1991-0539-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686145535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145535, "uuid": "a18ed11c-9566-4bfe-8938-63da9128e686", "comment": "Malware payload (RedLineStealer)", "value": "3ba40bdf5e1d4b6b21d51c9f780eea0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145535, "uuid": "9a67849b-e453-482e-9974-68c68be14f3d", "comment": "Malware payload (RedLineStealer)", "value": "2ee168cc3abb081951ffc83d0844f482a76ae7b744f256bc2bff8e9469061b88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145535, "uuid": "ceacb07d-6132-4312-830f-a2e6efacfffd", "comment": "Malware payload (RedLineStealer)", "value": "c23402abb4509b9b4f2194ff5df6ee3c1a1f93f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145535, "uuid": "9ca2cadc-1ac6-44f0-9a41-6c562af8e778", "comment": "Malware payload (RedLineStealer)", "value": "86b10836f65b4e8e63ddce80529d22ecb23c17346f6be495a5ae1fbfaa6d69feb39a9eafb0db94d25b7b56ea6f106957", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145535, "uuid": "a77a5254-778d-4225-a4dd-bfc05f838b25", "value": "T103F41242BAEC5463E9B517B059FB03930B31BCB29DB4871B6702AE5A1C73650A87137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145535, "uuid": "5ca7b35f-0a45-4727-a636-46330099b488", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145535, "uuid": "6671adaf-984c-4aa5-95f7-eea1cf9bf1e2", "value": "12288:LMrZy90fgufLPVzOSvUOSSem3l2HiDJog8xUqZzoU3gN:GyIgufLzpd18iQxWQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686145535, "uuid": "60d97942-e01a-47e3-afab-2799996fa537", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686145535, "uuid": "bd45d2f6-3f25-4b1e-a598-c9d6bf37e57b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145535, "uuid": "bb43ba45-388c-4e0d-932a-d5252f3426c1", "value": "2ee168cc3abb081951ffc83d0844f482a76ae7b744f25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1275f966-0537-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686144458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144458, "uuid": "57a3f6f6-f4b3-4884-9b74-221c4a1eef3e", "comment": "Malware payload", "value": "e992756fcb69930770ca284d38d8c956", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144458, "uuid": "72e82309-8841-4131-bbec-b90151c3b2a1", "comment": "Malware payload", "value": "2f10cde67d693bb055e5992b95ced13859a3c68e2264e6ccb69533b69133f57c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144458, "uuid": "0a9e5acd-e242-40ae-8990-0681f477d2ef", "comment": "Malware payload", "value": "ee6c90ef3cddf85b0e107a18ada31ae299f8e314", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144458, "uuid": "ad183de2-aa4b-4bb6-b789-08938df6a3bb", "comment": "Malware payload", "value": "d53e58de8b91a4f728ab4c8024f531179e09eab5eba9a09b9285a326fff1f1eb3069a937389ca2f0c35a99939530bcd4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144458, "uuid": "d82fe503-8b64-4ab6-9313-02ebbb26a701", "value": "T1FDB2C034ED05F814C6BB4BFDE81922F6E508824FD7D2A3B968D07F5849869D3031EA8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144458, "uuid": "09ca32d2-abe8-4128-92b7-45684041a9d7", "value": "384:ErgbqJ3YEwCQAhjwhGDkomnVCY7NbNxt/ZtNNfUoBEr5lkGmaDiu1Od1LlfCge0A:QguJ2dGjsGGLxllN9ilHDiu+lfBdfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686144458, "uuid": "d6a32688-542f-4f2b-9981-e04bb0f3285c", "value": 25407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686144458, "uuid": "98623c07-27b6-4b00-b279-d226537ace6d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144458, "uuid": "ec25efad-328a-48af-925d-44577218e1fa", "value": "DY PACK LLC TX .docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3725333-0562-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686163250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163250, "uuid": "1020016a-0725-48bf-8e92-dc500c82ccf2", "comment": "Malware payload (Amadey)", "value": "4bccae4cf51ed918dc3be5e8de52da56", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163250, "uuid": "59a8ab5c-5f8b-44b8-9074-5b4aff401c73", "comment": "Malware payload (Amadey)", "value": "30dd3052643e94bb29c0d15b7de875c6e2713ae33767446582e39362cd490623", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163250, "uuid": "ed97170e-cdb9-4e55-b339-e04f42e8fdff", "comment": "Malware payload (Amadey)", "value": "ae97a4130d50f99376edc7df71eb9cafa44093f4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163250, "uuid": "e56db1c9-dcc4-40ac-b20a-6bb293d46ca3", "comment": "Malware payload (Amadey)", "value": "32605c42d4cb5cf4cc2bc911feea5b2fa08a8813b092a244d9a6e732ecdfa29e05ee04e6edfbc383999dba8639846efd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163250, "uuid": "d1df99dd-1c1f-4883-9782-d650b99a4cb1", "value": "T1A424F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163250, "uuid": "db0d45a8-9f2b-4df3-9817-adcd7a17fc32", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163250, "uuid": "1499bda2-602b-416f-9e69-f9d773054aad", "value": "3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163250, "uuid": "c58eebdf-c515-4a35-8651-1322117771e0", "value": 210127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163250, "uuid": "aed5e677-a4d7-4a28-953e-12b30727612e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163250, "uuid": "488c8f74-12b5-4e0f-8596-c63005d9d428", "value": "4bccae4cf51ed918dc3be5e8de52da56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94d6876-0571-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686169622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686169622, "uuid": "82401c17-b39b-49c5-bebf-cfa8f1ab5362", "comment": "Malware payload", "value": "122797bacbe21b6170c8c28825834f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686169622, "uuid": "cb811136-c926-422e-89e6-bed989ac0fe9", "comment": "Malware payload", "value": "34390cb5f30cac13ed346caa7df1e51c2ada7162aed564bee76fdebb4fd9fe2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686169622, "uuid": "828732d6-dbf1-4c11-ae6a-2c31138b477f", "comment": "Malware payload", "value": "cf269bcbe8ddd6ec7162a7319e385dafeb5a1e60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686169622, "uuid": "879cf76e-cf0e-45c8-bd5a-0bf3c4eb8acb", "comment": "Malware payload", "value": "32871c8c8698684bf2a736a58ca09dafbcce2c18615835a9fcc1641a15a74b1f9559512f371c06d6f65a959e1be362ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686169622, "uuid": "1af15a76-7ab0-42e0-998c-9d1f5dc7e66f", "value": "T182A38D1276DCC2B5D41A35708C20EDB66AFAB978377F005BF795166D2E233E042A271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686169622, "uuid": "9a7c02d2-b27a-4847-9c33-90dd948c09e7", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686169622, "uuid": "f38d3920-b167-4519-923c-73d78429bc9b", "value": "1536:ivp6kE69sL+kPINsgB75eGFuap525ynX9di2YDHLYjzDm:QVhV1uC5iy3xYDHcj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686169622, "uuid": "1971b5ce-7b5f-4fa4-8765-623393fbbaef", "value": 103871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686169622, "uuid": "b8a24b0c-ba13-4b1c-8244-6a3006fbedf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686169622, "uuid": "0cf1aa3f-c5a7-4c4b-ae5c-4d00535662d9", "value": "SecuriteInfo.com.Variant.Zusy.471732.3653.30398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0d375e-04d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1686101335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101335, "uuid": "202c00b8-7ef3-4a67-a94d-1ac333e7f480", "comment": "Malware payload (NanoCore)", "value": "bfed121961257c6bc74015682a282572", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101335, "uuid": "73799f67-14a7-4ebf-9634-91ab896b80e7", "comment": "Malware payload (NanoCore)", "value": "34ccf9c70f06b37e7fdccaa2d82815043e98298d22ac91758e929e0ab7f76f1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101335, "uuid": "3670e8e6-58fb-4d14-a6e8-b5eb54f289e8", "comment": "Malware payload (NanoCore)", "value": "a6fab6100ab474a89765fce36ea351a6f368598c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101335, "uuid": "4698b5ef-dd34-46cd-8dfe-07f1a0c12775", "comment": "Malware payload (NanoCore)", "value": "294c53f317bedf37793f6c56359e47c2bc61e17a0746ffaf7e730e54065cfccce840d7f313d2b8828685e4c0db828954", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101335, "uuid": "f78fb1eb-1aa0-4438-a23e-bec1ffbd57f5", "value": "T1E724CF567BA9492FE2DF8A7C61621212933982E3E8D3F3DE18E454B78F167E406071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101335, "uuid": "a408eb50-ca9e-49e5-945e-85d30d65bec4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101335, "uuid": "575f1ce6-15b5-4d6e-bd03-5dfc279acb45", "value": "6144:ULV6Bta6dtJmakIM5MLTS/szPqJ6T8oXb4:ULV6BtpmkbY6hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686101335, "uuid": "ccefc5e4-4184-4fd7-b0af-0ad3db2bb327", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686101335, "uuid": "86073eb8-f873-4783-999f-04803c9cbf3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101335, "uuid": "fd5091a7-4eb4-407d-b95d-3ae217e60ee0", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781955df-0537-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686144629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144629, "uuid": "bfdd9cee-a52b-4581-bb3c-907c0a49b3f3", "comment": "Malware payload (RedLineStealer)", "value": "5ab1c99918b79cc03c67e196b9224783", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144629, "uuid": "d10e8721-9376-4f52-8cf4-4cc04144041e", "comment": "Malware payload (RedLineStealer)", "value": "355c9549beaf765bffe74f81ab33c8fac8cd9bc0444dd672f0149965629c32da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144629, "uuid": "09c0fae6-1b04-480d-8fa9-aafccad6c1ff", "comment": "Malware payload (RedLineStealer)", "value": "5f1e225c6988b93995ca1a9d325ff38895bc2a91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144629, "uuid": "d3101d24-e93b-42c2-b0d1-d5f40320d38e", "comment": "Malware payload (RedLineStealer)", "value": "2527084bc4db32791b3366daea14c7614953edef47ba8f68abe7bef688eb9a966cf0d28d839c663a7203b3d0f5c9c390", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144629, "uuid": "2e89353b-b437-4280-9128-1abba88814c0", "value": "T14F24F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144629, "uuid": "f0d8f006-6a3c-4a0b-b8bb-23435d943c35", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144629, "uuid": "70b55ed4-be86-490a-ab21-59f7f629532f", "value": "3072:meTRJ0kHbnpN23kQKp5XzutZXKGrpeN84LuZAIybiy3xEfbi:FTR2AnpN2wDurXBeBuZAIMEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686144629, "uuid": "83824df4-c2aa-42a0-9d1f-06a4facbae18", "value": 212385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686144629, "uuid": "24834ce4-26f6-4279-bf94-6c5cd5a4fa22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144629, "uuid": "b784f60d-e761-40b7-9811-99f0fd82536b", "value": "5ab1c99918b79cc03c67e196b9224783.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb0839d-052e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686140769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140769, "uuid": "19cde8de-7f50-4680-b194-e26e8839f73e", "comment": "Malware payload (AgentTesla)", "value": "1b5b1738ca86c94ebef9a443903955ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140769, "uuid": "dd3a98e8-4ed5-4c26-b0bb-d60dc331d079", "comment": "Malware payload (AgentTesla)", "value": "35627e7170a5fe823720ff83f8d40efe5900dc8de507cb96366cf9fe0117a5c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140769, "uuid": "2bb7ac38-37a2-41c9-8db6-03079f403977", "comment": "Malware payload (AgentTesla)", "value": "04b08edb05fdda460a4d07c3c60568f906c9494f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140769, "uuid": "d98f64a6-7ee4-48a3-bd45-e5b65c138ab0", "comment": "Malware payload (AgentTesla)", "value": "851feaf35f2aa26c6ed49ad7e45ba448666d7b0c08bced487846b94f2f1ad82edc72b0da57f69832da66a0ba37fa4f3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140769, "uuid": "bca365d9-de62-4f03-99f1-9dad20947453", "value": "T189E4235A6FF22F6B3B4124CEFF2275B1A5A1F2B873247435A59C8611C70A20D954CDEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140769, "uuid": "fc476e6f-04f1-41ea-b085-da79b02b7bba", "value": "12288:hL9nXrX2wm+21oOZ0yp1sgtlgqBHh3sb4JIhTVoOKuGXLP2Sdnf11qSGJ6zx:RRrX8+S3ZPpCg/gIB3EhTVPKpXLnnfLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140769, "uuid": "3384f634-38bb-44a1-9952-be65d4eb494a", "value": 699005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140769, "uuid": "eec208e6-b734-4195-bb17-06e2a97825cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140769, "uuid": "4f24dd15-ea09-4550-86c6-0931bd08edf0", "value": "PO 4100001449.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77169f7-053c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686146990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146990, "uuid": "c6bebced-b1ee-4d7f-b364-43ca8ae64679", "comment": "Malware payload (Amadey)", "value": "513e2d52fbb7410cfddb4719badd11c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146990, "uuid": "c309eec4-6de2-4885-8b7a-54cf750b5e68", "comment": "Malware payload (Amadey)", "value": "38868db4dc9359d6145e5c7729f5e4af56920bc1e2dd7b01eecb913159813903", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146990, "uuid": "1e905464-2d94-48a5-985d-faa7d2df6912", "comment": "Malware payload (Amadey)", "value": "01c8cfeff3a4e77a487ec64fffa291322fcbf4a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146990, "uuid": "ba3ac7a2-8ad6-465a-a60c-fc36cece841d", "comment": "Malware payload (Amadey)", "value": "79671e4bc0440e95ec804150a31a9f0fcaa538df731af94df244ca9f9dde0da55e2dedfa0d53cd997e85dbe359298847", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146990, "uuid": "4c32b75b-c49e-43fe-bcf9-9b6b6af7df1a", "value": "T1A824F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146990, "uuid": "82ab952f-3e57-423d-9206-e83afbda6a70", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146990, "uuid": "7677633a-b838-43c0-a1b0-2e1dcc6a1db0", "value": "3072:meTRJ0kHbnpN23kQKp5XzutZXKGrpeN84LuZAIybiy3xEfbi:FTR2AnpN2wDurXBeBuZAIMEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686146990, "uuid": "ac19008a-8c2a-465a-bc87-eef4bac07059", "value": 212600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686146990, "uuid": "4359ae45-736b-4c6e-89e8-8d1b1a125e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146990, "uuid": "613582aa-a210-4750-be8a-8a53ee98e0ae", "value": "513e2d52fbb7410cfddb4719badd11c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c15f6a6-0525-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686136878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136878, "uuid": "71f4eea0-a236-40ec-99c1-0943f28e6181", "comment": "Malware payload (SnakeKeylogger)", "value": "1e25aa999c0fa54f44e6f61f5ecabf90", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136878, "uuid": "b12b3978-7688-4667-8b21-c00765220079", "comment": "Malware payload (SnakeKeylogger)", "value": "38a40add079a4dfbaf33406c9fb38ed051c98799a9f100444a291bbe2e483827", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136878, "uuid": "dc9c0c25-77db-4721-85b8-dfa3cdcfd594", "comment": "Malware payload (SnakeKeylogger)", "value": "9120f0b597f035d267ef7b8ead73a178612699e8", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136878, "uuid": "75c707e7-4e33-491a-86ba-685d765b0666", "comment": "Malware payload (SnakeKeylogger)", "value": "5c2895100799dd91ad33fc8c045571105c2378f7e3c542e2945c0b56579134a5adcc6d172d93bf3a88521d04e969f6c4", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136878, "uuid": "96dfdb3f-9d86-436a-96ad-751c6cbc7370", "value": "T1F51533E7700EE5AD43A09B2FDCA6217CF2135CAEBE4B98298FA4E715C5132257D74807", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136878, "uuid": "f796e80a-1d72-4039-8aad-7a511858dbca", "value": "24576:roZFSBkrAEWY53Yf9jfPML2AtKOWacbVXCi6:roiSH3Yf9j2tKOWacbwi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686136878, "uuid": "e1ad1863-08f8-4569-b293-3b474273e1f5", "value": 944068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686136878, "uuid": "abd24912-ed4d-4ea8-8805-3b8cb58cdd1a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136878, "uuid": "3b853f5f-499e-45f6-ad6d-cbb153aa6fda", "value": "proforma Invoice.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb92ddf-051f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686134198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686134198, "uuid": "3fe9f9f1-a3fa-4e6a-a477-ec67f8200dc2", "comment": "Malware payload", "value": "19ab5991277539ec1c93bb630f1a8d7a", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686134198, "uuid": "3cb1d72e-0b33-4e10-94ed-c4278e9508c1", "comment": "Malware payload", "value": "38ae8d60957e24c81f93b351a34d78a8ecb73b304f99e3db568cc7fb045362a5", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686134198, "uuid": "a66d7191-4fc0-4fc7-a4bc-8ae1954d6b5b", "comment": "Malware payload", "value": "eae49d3c05a3065eebcaadc5fb8a3125f7f76da0", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686134198, "uuid": "51c73da8-9517-4214-ac5a-7854cfd32a04", "comment": "Malware payload", "value": "d0b1c97374236936081c2f87e01ce60ea8be5fd84fc0eb0f7ae7f16c9bf15603b547459d820525cef76a26b3c5fe9bd2", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686134198, "uuid": "5f532f80-c4fa-4943-9b59-348b9e4c1980", "value": "T1F8B41207E500DF9BE15ACBB07F439E854B1AAE07FA1AB2C70240379F6B353C65A9254D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686134198, "uuid": "50d16729-3458-4045-9614-ac4a9d2dd093", "value": "12288:EaFiKXKqbJjlSDtGfTu3zXY6ts1n56XamXZmDIqut3Pn:pLK6OtET6zXYXdIqutv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686134198, "uuid": "23536fb4-67c3-40ab-859a-e3368968ef9d", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686134198, "uuid": "28d9189e-d775-4df2-a8a5-9e38d3052999", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686134198, "uuid": "539a5b36-cb4c-4c49-bb2e-19c7873ef970", "value": "Po876.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b6a45b-053a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1686145745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145745, "uuid": "4083b845-5d09-4ec3-b9c8-095090434aeb", "comment": "Malware payload (Gh0stRAT)", "value": "c6d9cfbc439204ddca63d1663520d43f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145745, "uuid": "bf10730d-6f8d-4975-8970-ca82b499f1e6", "comment": "Malware payload (Gh0stRAT)", "value": "38e1a4bca170e918c37356599979bfefc59e0499f08796798ac31478c69cc078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145745, "uuid": "7f182936-6cb9-4837-8ffa-38f241a9f767", "comment": "Malware payload (Gh0stRAT)", "value": "b538d662b86cc5974a81e45b563868b26f9dba0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145745, "uuid": "f95571fe-5467-4bcf-80c6-4ef068e59be1", "comment": "Malware payload (Gh0stRAT)", "value": "a4bb384afe7b44c881823616caf9017374f416d91e40daa4757fe851a6f1404e798e0fdcf22ac08e35d20ccfbd8e6c67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145745, "uuid": "06d25078-1508-4d77-975d-d715447df8e1", "value": "T1D435333769A3D135C508677384DB68DA661CEAB3BF649ACF0A50764DFD782206B30F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145745, "uuid": "d1d89ab3-aa00-434a-9b29-e33b65d07b82", "value": "73ec795c6c369c6ce2c3b4c3f6477daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145745, "uuid": "a7d1c6a6-5e6e-4675-b503-b8b7e9d10c29", "value": "24576:Uhf+HU4/LYScEfMj3fhvabMoD71e1UEs/5P11E569MqFlTF:gG/0qfMj3f9aTN0UbhPHX9MqFlTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686145745, "uuid": "72914701-f114-408e-91ba-463ac7b3124e", "value": 1091296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686145745, "uuid": "a6f232ac-3e75-4bee-a9e0-d5e0b9881224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145745, "uuid": "85a76ce4-a944-48b3-9628-629fea13b106", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6edd4ca-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686128413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128413, "uuid": "90bbd1a8-f7e8-4692-959b-2452157c5404", "comment": "Malware payload (RedLineStealer)", "value": "f2aa03059a1f2f67c3354d41db5487b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128413, "uuid": "b98e8a67-d5d6-4959-a56f-b509ff292328", "comment": "Malware payload (RedLineStealer)", "value": "39ff18916d45394e08dd2c2bd297f30671829ea91812af3c2a0a32b73d274e69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128413, "uuid": "c339323e-b711-42c4-bd33-eee820af486a", "comment": "Malware payload (RedLineStealer)", "value": "fcf0a00815c6efee1c87234011144ff237173df7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128413, "uuid": "d1175c4f-97d8-460f-acef-333da52f4e35", "comment": "Malware payload (RedLineStealer)", "value": "ecdfcc3304374b6afd968e0a9e2243c7797261eb130cfb6c7cb2c6d98b158d51cf3c8213dea91edea2af1eb5c78ccb05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128413, "uuid": "8141ab38-e24a-4e83-9a88-833acea68184", "value": "T1E684B0D3B2E1A873E67646358E2EC6F4662FB4637F1567C723485A2F09311E2C972341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128413, "uuid": "d6f1b30b-c7e3-44ee-828b-20bdf9c4fc3b", "value": "64e105a717e6a1cfeca9a1f4f5c8ed00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128413, "uuid": "eea2ee59-cffa-4627-aefa-b0c7a0ad9fff", "value": "6144:TuvuaL78TMHFsNxJPCBLZGKfdDTBHSkGoI9:KvtgTMHFSPCBltw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128413, "uuid": "59f81b88-5d62-4c80-b0b3-53180cf3d018", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128413, "uuid": "210e1eb9-5d6e-4d3e-9f21-acee4bdec6df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128413, "uuid": "9d81dc4a-af0c-4f85-b94a-09a90b078700", "value": "f2aa03059a1f2f67c3354d41db5487b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cb721a-04e7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686110080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686110080, "uuid": "6625866a-65a2-4ffe-8f93-1214c8a496f5", "comment": "Malware payload (AgentTesla)", "value": "083965a90714725c4f6fd725d87e7d06", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686110080, "uuid": "d476660b-508f-4c1c-b974-18694ca6f159", "comment": "Malware payload (AgentTesla)", "value": "3b9720e19ad5d4eb9d5d4a02823671962c7d763c74e7ffc34fc689a3ec61051f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686110080, "uuid": "7369fe64-289e-4967-a935-2f3d270eda4a", "comment": "Malware payload (AgentTesla)", "value": "aeed390a90c21d43f4d860db8532183b9f1b94b8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686110080, "uuid": "3504fc68-f468-4e75-a73c-e9c4f7f56acf", "comment": "Malware payload (AgentTesla)", "value": "b8292e41208cdc15a7b50a889cb57027ac83f7d1d35580fc793646c694eff57f381dc7cb82ad07ce5acf968d7aef3c6e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686110080, "uuid": "ddc918d4-8560-4b63-9398-12c5830a62ba", "value": "T11524D09C7A50799FC817CD72AE985D68BF6060774317C283A01762ADDE4D39B9F0A0F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686110080, "uuid": "3d229583-f6db-478b-a83b-b6e30ed1ffa5", "value": "6144:Jv5I6kaDdUV8FUQHXaIHxELGrEeO/UjABHRvj5:dC6kaZUYKuWLQEn8kBHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686110080, "uuid": "5b4f6072-0ba5-409a-90c9-ddda551c61d0", "value": 211008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686110080, "uuid": "86fddf59-2058-46b3-b1ca-670436584275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686110080, "uuid": "e23589e5-2a4a-460c-a5e3-89faf98079bd", "value": "083965a90714725c4f6fd725d87e7d06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea623f7f-0564-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686164148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164148, "uuid": "ea4efb8f-6837-40b9-ba2a-9681c3e498df", "comment": "Malware payload (Amadey)", "value": "8ada0d8273fab2340bdec6e6309dcd2c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164148, "uuid": "2d9460a6-f9af-4c0a-b6b5-a90defb1e94c", "comment": "Malware payload (Amadey)", "value": "3df7082de46414d8c9fe29ede55228e2c2bff95e604b3dd0816568a74ba0dd31", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164148, "uuid": "bc2d3da3-bd15-4ca7-96d4-c6572cdf2528", "comment": "Malware payload (Amadey)", "value": "187e129ac9f23fd277f83cfa4e4c3a7add6317f0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164148, "uuid": "b470fcc4-6d3c-4ccd-9102-0319318ff2c9", "comment": "Malware payload (Amadey)", "value": "8220578c2a70a98868e385f9da76c60f2cf5590fde789562685d85b2ae655705874d423781cd7337df54f471b991f0d0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164148, "uuid": "c4a263d8-cf44-402e-b277-36bab967bf91", "value": "T1A7548D1262E1B871E5E746314D2AE7F466EFB4615FF867DB23465A1F09321F2CA32302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164148, "uuid": "fd7f4661-09f3-4750-b09c-1298babb22ff", "value": "04fcc8db11b5c1b7316151fcbb546c01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164148, "uuid": "716a50e7-688d-431c-820b-dcf6b09fdb49", "value": "3072:Wfu6RexnYFpWxAZUyHfix2EyVOoTE7a5A+i0ItV5lxQiyp1VPXDiB:XFYTWxAZUy6xp+Taa5VMj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686164148, "uuid": "fe85656c-1b30-4923-a30f-2087227943af", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686164148, "uuid": "0373f08f-812f-40a1-8550-3734dc831849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164148, "uuid": "e9a3dd28-7386-4744-9781-26836953d076", "value": "8ada0d8273fab2340bdec6e6309dcd2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4cc0cda-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128410, "uuid": "5bbf922a-61e2-40b6-88dc-2f13f7ae34f5", "comment": "Malware payload (Mirai)", "value": "52cce0b856b7115d353fd9c38d7b1fb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128410, "uuid": "52384f79-e600-40a8-bb66-c6d8033a9093", "comment": "Malware payload (Mirai)", "value": "3e3cdcb29f597e0960197a99bc88cb57455d668828652373cc1835cb3e85ffb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128410, "uuid": "c219b163-17b3-4d48-8808-51eeac7ec7be", "comment": "Malware payload (Mirai)", "value": "450ca8db918719853a3b21ab799dde94e96a6394", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128410, "uuid": "56160dd7-4df7-4209-a337-d95dad4bb5cb", "comment": "Malware payload (Mirai)", "value": "06d76eefe385f966479875badd80f89344d3beaa71ebded8fc968bbd6fc026c7ce336a1458e6fd540ecd08ba185557aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128410, "uuid": "82da3ff0-5c33-4ad5-9c86-3c337746da7c", "value": "T134E34C46FB408B13C4D51775BAAF42453323AB54D3DB73069928AFB43F86BAE0E27605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128410, "uuid": "7dee9d1c-719a-4f62-8ae7-961eb335ac82", "value": "3072:vPMSI0P9aoMT8sdvhuO/ARNsje1Xqf7+M/95H4Iq308:3MN09aoMT8sdvoOWR1XqfSM/9U08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128410, "uuid": "575af74c-b0fe-4cd8-9c47-29cec29775cd", "value": 149949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128410, "uuid": "3b9b608d-b35a-4967-a970-993200b6fd3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128410, "uuid": "eeeccc81-29ba-4bfb-8430-6fb4791078bc", "value": "52cce0b856b7115d353fd9c38d7b1fb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9eaf118-0554-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686157168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157168, "uuid": "e0ca68ff-dc46-4060-a470-86db6cad3a53", "comment": "Malware payload", "value": "aa75d40544e04081d6a46dcb12cfac90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157168, "uuid": "58440522-1eb8-415b-8d85-196e58ac65ea", "comment": "Malware payload", "value": "408bf57ab458ca060c2b4a48f3065d834d2c9fdc044022b6bd0afe9760027c4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157168, "uuid": "1e36a980-7df3-42a5-85be-30b8c4853960", "comment": "Malware payload", "value": "40db2cba40ec26921a00f4cfaec29c7a36baf0aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157168, "uuid": "086105d4-8c71-4aa2-ac9b-afe28fffd1d0", "comment": "Malware payload", "value": "011fa9db67e34d922d171f951aad1c387fadb6eca66d04d8c0c64a3a2215c3404ffd0b16378acc4ca5b51fae36f70147", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157168, "uuid": "7caaba18-e032-4e9d-b43e-fe966eaf0c8e", "value": "T105C2E5057AE4CB22D9BD57FA593210A003B27D829962F72E0CC478EED9B2F5241A1F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157168, "uuid": "9a6956c3-fa15-4699-8555-2aa4d60cb95b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157168, "uuid": "719dd3a5-196f-4908-b4e4-516e7516f87f", "value": "384:ISS2tccFjj62j0JcgKkgrj1uM/1VWyJhgcNlcRUimDVVJpwZfnyjLlCtW:ILKprJ/zWyJhgcNCP6QtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686157168, "uuid": "082c0a88-aad2-403c-ae07-28198453bb82", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686157168, "uuid": "ce726630-d408-46df-955d-d7a8c7024136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157168, "uuid": "494c4812-7565-4c66-a0b1-51ac873b49a8", "value": "408bf57ab458ca060c2b4a48f3065d834d2c9fdc044022b6bd0afe9760027c4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23866e5f-052e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686140621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140621, "uuid": "9d70a897-6a58-40a4-8921-fba060418c45", "comment": "Malware payload (AgentTesla)", "value": "966151ed4c0dcbef0992a4576f24f56b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140621, "uuid": "84aa58d9-069b-4652-8304-c9b7c258507c", "comment": "Malware payload (AgentTesla)", "value": "415dba49ad160b272fc159f4a7eacba2990c09f0941127acb8c3366fe7866c12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140621, "uuid": "1ba4ddcd-5c89-4148-9d54-d9c9c8fcdbbf", "comment": "Malware payload (AgentTesla)", "value": "2669362f40b2287fa928fa1ded0de66f13d09e95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140621, "uuid": "9a0f877d-68a6-43b6-b89f-df597b16e890", "comment": "Malware payload (AgentTesla)", "value": "25b682a5677a83809937e682a84c7071ce5f476e369faa2e870c09a8430df75fdbd8315053f296120009bf0b55764af4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140621, "uuid": "bcc80e9e-d6d9-4ba4-abf1-d0b37a3e8a38", "value": "T176E4F13A07406B65F33EC23600903D41D5FAB28C651BE28DBE61AED096B23D49F57ED6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140621, "uuid": "f14cdfed-c741-4114-a756-7b5aebf187c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140621, "uuid": "416d78cd-2846-4ed4-baa8-69ed8d4aaad6", "value": "12288:wZXo8k47LVYmCADj0PqhgJP/vzDVjstrn+IUgqoyc4k:wZXomK2yhstr+FgqoycB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140621, "uuid": "13033ff0-314e-42db-8b0a-35cbee549d0f", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140621, "uuid": "d853347e-6635-4cf5-92ab-2bdbcea8abff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140621, "uuid": "8a9c5452-9e5e-44e5-a608-6ef41512f5d4", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e82024-052b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686139471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139471, "uuid": "08129449-c05e-469e-b3ab-1a1379a45733", "comment": "Malware payload (RedLineStealer)", "value": "a7eeab7e2e90d0373ebfb15243bff81a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139471, "uuid": "9a5d10ba-0cde-4dba-866a-1008e10a1683", "comment": "Malware payload (RedLineStealer)", "value": "41a037f09bf41b5cb1ca453289e6ca961d61cd96eeefb1b5bbf153612396d919", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139471, "uuid": "f70fcf20-5450-4484-82c0-9c9cdc9dc961", "comment": "Malware payload (RedLineStealer)", "value": "fc32670a240a9e42ba6c453a68dec0933a85355f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139471, "uuid": "4e1b27d6-8176-4573-9618-91645ba68e15", "comment": "Malware payload (RedLineStealer)", "value": "e94bc2804aeee28b75d65338d781bf7f08d45e0d8e2643b849e806283adb8fa32754ff1a68f09377dede0974263fafb2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139471, "uuid": "e1dc17f0-5648-4f97-9afd-0084ac5a5b7a", "value": "T1D7E6F032FE96D02ED783D13608D2C997F838459CE24AE56B17E0069AC9B4D8D4B53BCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139471, "uuid": "adb8a799-6fdb-4b4e-a7c7-1ffb087f0afb", "value": "196608:pYBQXEPt5WaR6SynIRkIqZ81rI61CYYY+YA+X3vMMIYlRCu+EGlYxMrdhMTbnb:8rt5WaRRkZ81rtTidk/MMUlwmhMTLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139471, "uuid": "d62b00ad-5f5a-4d54-9384-d891e0dafaf2", "value": 14612480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139471, "uuid": "8c7d28b2-0221-4eb0-b01e-8b0204d5611b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139471, "uuid": "2618222f-e7c4-4175-bdc7-cc3f65849139", "value": "178.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843ee855-0571-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686169560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686169560, "uuid": "9837ed76-d6a7-4d95-8837-eb349d7fbf24", "comment": "Malware payload (RedLineStealer)", "value": "06827c3618989b762b8cc24c953aecfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686169560, "uuid": "0eedc232-e5ff-41dc-b3d7-d043c4813396", "comment": "Malware payload (RedLineStealer)", "value": "4201978c9a5c160a6092fd51aa7391adf86c8e9c1baa39745f5f2116bc1e9423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686169560, "uuid": "d3865048-70c6-4e69-a382-6d83379562ca", "comment": "Malware payload (RedLineStealer)", "value": "4aac57a3a39681aef3598de3eeb62b35f1be4545", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686169560, "uuid": "5e9339b5-06b0-4f24-8849-dca221ddcd14", "comment": "Malware payload (RedLineStealer)", "value": "23847914f032b21ae66981cbe750f19512c3897a6d665426321425664c3bde339074c60040f4941cf1664b473e07c671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686169560, "uuid": "504225dc-60e2-4af2-815e-d0b9e67d69ab", "value": "T19BA35D3067AC9F19EAFD1B75B4B2012043F0E08A9091FB4A4DC194E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686169560, "uuid": "bb5d7987-477d-4448-b9d8-d58096f845fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686169560, "uuid": "58c2c309-256e-4f7c-8929-6ddabd720626", "value": "1536:5qsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2r3tmulgS6p8l:XEwiYj+zi0ZbYe1g0ujyzdb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686169560, "uuid": "644e9412-2ab4-4ec4-a684-e62d4e82ba8d", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686169560, "uuid": "ce966216-0b4d-4cfd-aa76-aee164b98f98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686169560, "uuid": "b437eb2f-8b4d-4f6e-91a7-521e0ffe60c1", "value": "06827c3618989b762b8cc24c953aecfa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af728502-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128401, "uuid": "5a38f98f-1725-4e69-bb73-cea2d6cea72b", "comment": "Malware payload (Mirai)", "value": "4b485083a4138423dc54c388627e73a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128401, "uuid": "045b0030-eba3-4cda-a298-71f693f8d0f5", "comment": "Malware payload (Mirai)", "value": "4264648240fb68c6e0d756d4a28cc20282f0574d40f951846a15b1fad722c4df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128401, "uuid": "09f572d4-0007-475a-a0dc-1a781d8cf96f", "comment": "Malware payload (Mirai)", "value": "56bff98f72384bb780dc64601cefa096ae266336", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128401, "uuid": "2ad958cb-f9a1-4139-858c-e244e3b3c8c9", "comment": "Malware payload (Mirai)", "value": "2f3421a9abbd137e8af1a96e27242eb281592e38dcf4b9ab31e0b61c90309fd18f3126dada770a1aaf006e2a967da291", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128401, "uuid": "0350a576-b1a5-4b37-bc01-ecdeb1a6e7ae", "value": "T107B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128401, "uuid": "9ddf386d-b254-4522-95e2-e6cd4d25b449", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZboamm/QcuLB1niDNb:YuFX0GIk1MHyphkamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128401, "uuid": "5bcc2bf3-ed88-498e-a004-b7ed5e4f45ed", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128401, "uuid": "84308317-0dcd-4e34-b4fc-ee1256ff0f49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128401, "uuid": "e133bc5f-ef10-4fa0-aff4-007864be867a", "value": "4b485083a4138423dc54c388627e73a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd3d414-0534-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686143427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143427, "uuid": "fddc9aa5-c0bf-4de8-b00e-a2e987be76bf", "comment": "Malware payload (RedLineStealer)", "value": "3acc9bbe0a4e64eb3613620f71010356", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143427, "uuid": "a38e6f74-e737-4a8d-9239-fcb4afd1c885", "comment": "Malware payload (RedLineStealer)", "value": "4300178e2ebadd6cdbb651732f4a9accb2040fcdf671ab473e80c53b3e31b424", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143427, "uuid": "fd094925-6e47-4cb3-aa9c-a0876e4f13b6", "comment": "Malware payload (RedLineStealer)", "value": "1c5e169586ccb7ba34fc7072a4ff69f3d4af0c49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143427, "uuid": "99ac5d9c-9d9c-47d6-89fd-5e77d4343e4e", "comment": "Malware payload (RedLineStealer)", "value": "08bea842761661d095bdee928a830a656ac8583d32862a90afdab8fee5fae95fa1b24046d8cb89e76f2d7374fe5bd78e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143427, "uuid": "fb807c5d-4587-4575-969b-0bc6cbc01ebd", "value": "T138C41242EBE98022D9F8277508F603970A367DA25E78462B37966D2E0DF32C4757137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143427, "uuid": "b159f58b-8b38-4027-8f24-6257f5545d78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143427, "uuid": "f693e811-58a5-4c42-8b84-38e8c364cdb6", "value": "12288:xMr4y90XX06avYoR4hfWZ04vBmhEG22XbJyIolOPBrl/Pca:pyF6aoht4vnwJyGPPca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686143427, "uuid": "de2082f1-dc0a-4f5d-a772-f0559ac032dd", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686143427, "uuid": "6469e79f-a9ad-45a0-9970-c7b930ff6176", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143427, "uuid": "a4151472-5a53-4a6c-9327-20fd47da8cf9", "value": "3acc9bbe0a4e64eb3613620f71010356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3354f2-051c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686132848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132848, "uuid": "ad7d845c-360c-4d3c-89a2-0f6baa6c548e", "comment": "Malware payload (Mirai)", "value": "5d9aa271ccf42630ba501e0b285a66f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132848, "uuid": "ee9985c1-eabe-45eb-8a9e-b6e75c51c4ee", "comment": "Malware payload (Mirai)", "value": "4388b7173bf8957e5d1039fd392986e9e18059bad6c715552905cd8d49457146", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132848, "uuid": "a3abb9af-855a-4b40-8602-7d4a47748c3f", "comment": "Malware payload (Mirai)", "value": "61aa37f26cc1903dbcace33a80aa578ff77c892a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132848, "uuid": "fdd1eae0-cac0-42e6-8b7e-56ce1f8e1344", "comment": "Malware payload (Mirai)", "value": "4c3fb2eb6541e583b1d062f8d66ec62c4529377e35ea8a66b2fff67814441d969109211d6c9bcf2bf87541f972606d53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132848, "uuid": "cdd48270-fa9e-4c92-8b4b-5c7a9e7fd18d", "value": "T173230271840E9EF164303C76DA95D393BAE129B1C6673013D5280A3C6F797131E57F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132848, "uuid": "02230b55-b73d-44a2-8a06-d98ec4a6abed", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3EM9q3UELbUXfi6nVMQHI4vcGpvD:gECFd+A6YHAxALRQZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132848, "uuid": "7986f449-9595-4d6a-b659-7bfe56103389", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132848, "uuid": "aab870b9-5553-4f0f-b13f-1c858a290c97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132848, "uuid": "3431e623-df3a-4115-a84c-125f6fa3f51b", "value": "5d9aa271ccf42630ba501e0b285a66f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46099e47-0536-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686144115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144115, "uuid": "9ca9ea23-80aa-4c6b-ac12-1dd37cf64250", "comment": "Malware payload (RedLineStealer)", "value": "36d0c105b088934e9f12dbb5421827ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144115, "uuid": "c3e7408b-f79b-4f63-923c-661338c800ec", "comment": "Malware payload (RedLineStealer)", "value": "43995a105461b688ffcc65191b90348961f312ba0bbbd1c8e1fbc2230e886329", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144115, "uuid": "4bd27ed5-a860-44ae-a918-b915d99e1204", "comment": "Malware payload (RedLineStealer)", "value": "f58f58389d17caefd8b05abcccaefc6e3279fe20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144115, "uuid": "b5f8b11a-5a74-4a48-abe5-a4263226f9f8", "comment": "Malware payload (RedLineStealer)", "value": "459bf0d861de71d1a48fb72c6642109035c91f19d29982a6bcbe87731eee83c983abb61f947265cd4e774850f0590185", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144115, "uuid": "29aa8dea-9233-4c68-b8c0-6440ffa1dec2", "value": "T131446B09E4EF42D2FE463175216D905AF5BF80F323BFC02ECF5A3AD61C572A096A115A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144115, "uuid": "13023a15-5e4e-4ba1-a041-0be0b2ffdd33", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144115, "uuid": "70cca0a3-101a-44c7-a0ae-84fc587e377e", "value": "3072:Ox/qx1OuyRyXFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2SUHcj/:a/qx1aEFaQ7W05AEezbMPZFzAy2Sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686144115, "uuid": "5edd3698-e1b1-4642-98d0-898a4889d39b", "value": 268932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686144115, "uuid": "d233e8f0-7625-41a1-a2b3-6527f0f9620b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144115, "uuid": "0437ba62-0907-4f18-a3a2-8597812353b1", "value": "36d0c105b088934e9f12dbb5421827ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8505a3-0535-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686143859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143859, "uuid": "2fb8a4ee-f1bd-474e-9a39-29bfb2e10441", "comment": "Malware payload (AgentTesla)", "value": "aec8743883c8342e2836d89cd38f7294", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143859, "uuid": "b7e69648-b0fd-4bb9-9d10-8f4f72f1d088", "comment": "Malware payload (AgentTesla)", "value": "44700efabdbbe386e2e689d0de94da92133cd2c36effe104ea5e8dc81a87fa5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143859, "uuid": "3bdb0f00-e428-47db-ad68-569bc17650bd", "comment": "Malware payload (AgentTesla)", "value": "4dd7b5b6130887d528926ae35ef316357a1d6e27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143859, "uuid": "b2e59b41-b291-4005-bc4d-3715342ccdb6", "comment": "Malware payload (AgentTesla)", "value": "093d510f8e416f78a6ea7081ea62cec0e82f587543b401570e863af10975e8588af1d07154853725bd7ce2e313b9b1bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143859, "uuid": "6665c2ad-cfce-4b03-bf56-104bb3794971", "value": "T101A396D3B212C8D6FA3847719D23C88915A7FDAEB8A4556DB096B7780AB73C30413D36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143859, "uuid": "02b131e5-af60-4e05-8b83-385980b43f91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143859, "uuid": "40a68ac8-7be6-496b-a534-bb5e912e3cb3", "value": "768:YNLE6ewSRmSTY94dWN2P7b1IzPrXMkN336DX2AA:KE6ewSDY94du2PmfMkN3KDmAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686143859, "uuid": "05bf8d55-412b-48ea-bd38-ee8d0e659448", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686143859, "uuid": "8802a8e1-9ea4-49c4-9d3e-1ec101c61e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143859, "uuid": "e716e9a9-b993-4a3e-ba40-044531ce068c", "value": "Purchase Order 11013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abb6277-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686130030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130030, "uuid": "8d3c8611-a029-4cb3-80a3-c37716ae6620", "comment": "Malware payload (GuLoader)", "value": "205bb0af230d0b37bd06c948eded9217", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130030, "uuid": "f1d6fc2a-1618-4ac6-bc73-f2f0ee8ef7ed", "comment": "Malware payload (GuLoader)", "value": "448ee61f6c180107964934d14c6374bfc80c41b1ea19fcdf0248820df12f22fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130030, "uuid": "64b49f3e-4b0a-4cee-b7fc-826296cad0fb", "comment": "Malware payload (GuLoader)", "value": "8c8641c392c47418a8551a6937b9ed6d343ae581", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130030, "uuid": "739cf1d6-c9c5-4dc5-a73a-acdf1c35d120", "comment": "Malware payload (GuLoader)", "value": "b163f96b14632e19d251cedf783fc17110a39141faf32e526db58b350e5808461ffcd5e24b571a3546941781ac4132fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130030, "uuid": "9a5386ae-d3d0-4456-92a6-f4405cef86e8", "value": "T11E741211F3E18CA2D8A5097C4C7AA636543A5D28E1A0C71F0769FD5E3F73213711B6EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130030, "uuid": "008bf57d-1738-4b53-b8fd-76e88eee1121", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130030, "uuid": "f2c337c9-303f-40fc-af45-4dcc80c9ee0f", "value": "6144:OQ606xHPOp6WkNhQBv/9tfv3vUywiHgXmPTPdiI2/vMssTyCRLbz8KHvtdOTOlRY:o2QWOhQBHrfvbtHfxRlTyaPz8m+6RY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130030, "uuid": "fe84da33-75ee-4406-a2dd-1b396fb15195", "value": 368188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130030, "uuid": "14212a39-171d-4777-b1b0-6fdfc34a8403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130030, "uuid": "cdc8528a-aa93-4860-8722-f33484e9b82e", "value": "0442IBTW00558263.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce2ac55-04ee-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686113418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686113418, "uuid": "ff7d88dd-45ca-4b0c-84fc-44a01d710566", "comment": "Malware payload (Loki)", "value": "cb2a173f508c65bfa2223a310e7e5cda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686113418, "uuid": "f66fc349-a17e-4d2a-b165-dd39c3b02850", "comment": "Malware payload (Loki)", "value": "4640e7f936f754a19cdbc2f5b598269de0daf3a421a9d9c283624c1a7f3775fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686113418, "uuid": "38a252bb-b962-44c8-b7c3-6bebb366ef3d", "comment": "Malware payload (Loki)", "value": "15d31842cad840c1b43f5f816bf560b7c2560e92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686113418, "uuid": "02cfc291-d712-4846-8bbf-a80151c2f7aa", "comment": "Malware payload (Loki)", "value": "e5543d169d7bc6c01d47bfdbcc724cd97572a66275c50bfa2fbaa0939bab77536118a4baadea7dfb767954aa1605f549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686113418, "uuid": "25e01885-5de7-498e-ae2f-ab9da89f9a81", "value": "T172E402A833E3115ECD6E3FBC1D490AB8C9F9AA423507D2879ED7389EEC18F455901267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686113418, "uuid": "6ffcc951-00df-447e-9dc4-c7f2342f5bef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686113418, "uuid": "a7d73556-70ef-4d94-9e12-e01057bc77c6", "value": "12288:Dd6L7PVgfEiCbhaDnLMzIL2q+RTdOL8RQjgvMoIfYg0H1sIYdCZri+t/dJ0VotjV:YOyqGUL8RQjgvMoGYtsN2rikmA4LyFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686113418, "uuid": "309c5cde-f975-46b1-8ed1-d6f89d715478", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686113418, "uuid": "e6a88f16-8b19-4d14-bbdf-0d7443b362e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686113418, "uuid": "71145942-f464-4840-891c-1f4ed400ca86", "value": "P.O.070623.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d3d81b-052e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1686140739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140739, "uuid": "2b36d42f-1696-4670-a86e-52006c6da817", "comment": "Malware payload (NetSupport)", "value": "fb1f55073adff2eb08a23531631b5c1a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140739, "uuid": "83aede77-1015-4268-a3c1-3708fef195a4", "comment": "Malware payload (NetSupport)", "value": "469f316a40b805eb289edf7f6183b484e7ddf060d3f647f1b398a4e21c728d7c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140739, "uuid": "0df58f59-c942-496d-93e1-1afae052671b", "comment": "Malware payload (NetSupport)", "value": "360749e9528ea0ece1c7d7ef1b5b44858908301c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140739, "uuid": "f342c03f-c8f0-459d-90c3-35f393771329", "comment": "Malware payload (NetSupport)", "value": "93da9238300cd80160c919a72d116ce27b1569254d230b0fc1ac14613abaf304d0e7740081e14af6b509f28e4f894ce8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140739, "uuid": "1f7c134a-1416-4b80-bc91-672520d78b3b", "value": "T16403F298AAE370905613F17F432FAC08A1B118538D08FE07784D5664EF9E52CDFB5AE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140739, "uuid": "a2be44fd-b68c-4f3c-a238-079d5b72721c", "value": "384:6Pf5Uh2T65leC1pDTEEZPTeAeC1Yea2frOEMMuJ7oYbwmQGrPJYpp5SU5eSVC60:6n5s2T6X9XffkUfrOiS7oYbZRCSwLV70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140739, "uuid": "f0167dfb-0a49-4178-94ca-1538e1afbe57", "value": 39412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140739, "uuid": "457fdea8-0e39-4d8f-a2a1-0453f4a605e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140739, "uuid": "d5a85344-6c19-4aac-b482-6d9c1eda1e63", "value": "TRX602602.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf16ffd3-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686128427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128427, "uuid": "65e59449-3e64-4991-843b-5c3dc8aa1477", "comment": "Malware payload (AsyncRAT)", "value": "98606a9e2540ba34e1c98760900ac508", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128427, "uuid": "477d4f46-518a-4c87-aeef-7e21edd12389", "comment": "Malware payload (AsyncRAT)", "value": "46bdfb06a8c272dff04b4eeebba3fffd7849193c8a0ce13c2dc7b3a16b26a1a9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128427, "uuid": "bbe1dbdf-9a89-481a-aacd-fdf70dd2e3db", "comment": "Malware payload (AsyncRAT)", "value": "9918ca6bf5c9b1ccc1206724514d56a41d7adeb1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128427, "uuid": "1397942c-45b6-4d83-bf36-36e9df7f4a56", "comment": "Malware payload (AsyncRAT)", "value": "16b75aff28066182d7ea2eac5c33c0a3e8eb779cbdcc3449da1cb225f69c6accac2a1c983eee2f1cc7df229e2dee032f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128427, "uuid": "74a6da58-d1d5-4aab-a6cd-9902df5739ad", "value": "T11FE4DFAC726239DFC95BD9B94D541D78EAB0686B330782479593149EEE0CADF8F100E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128427, "uuid": "2fac6cf5-c1b8-4216-b275-68000d1d42d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128427, "uuid": "32346226-1ac8-4f40-94d3-49e64c821fea", "value": "12288:LZyvbhaDnLMzIL2q+RTdOL8lUzKlXt0nKXRa99uk1UFDuhZCQUKOWkZJJXv/LiQg:GOyqGUL8lV3nXRwuSqQJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128427, "uuid": "38f09b5c-2039-4e66-b565-3d853caaa401", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128427, "uuid": "640240a4-d3bd-43bb-9661-1385bd6cdbbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128427, "uuid": "0e0715a9-4972-4fd5-be37-492a79b80fc7", "value": "SVD002837727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05950982-04dd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686105782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686105782, "uuid": "8a8b985e-6953-4b74-a4df-773e638afe16", "comment": "Malware payload", "value": "8788b0168a44f2cdd586a7babc92715c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686105782, "uuid": "4fb34841-fa50-4d85-977e-866f5dd05f70", "comment": "Malware payload", "value": "48a1c228a6619cceac65f1b2344ee908ba4e83ed4b5d3b9f6e27926630d46c57", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686105782, "uuid": "4862dd9d-032f-4532-b555-e4049eb5cde8", "comment": "Malware payload", "value": "34815139c076d14fe82c626e318d19dddbe04986", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686105782, "uuid": "43745d74-b0eb-41b8-a5c8-8f09ab1714eb", "comment": "Malware payload", "value": "4663498472952b0c34640a07e9101f6d06fc29ba8ed6fdb5fa13056e60e69f8a75645cd9e22d7836e27278cdd988fa08", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686105782, "uuid": "4d754f09-da5d-4617-9e76-d20a0a5a94c0", "value": "T132E60147FBC8EA9AC4F383360575522255074C269B83D7C36D68327C28BB9E44B4EBD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686105782, "uuid": "03f08c39-6f89-4c65-8758-701d424a38a6", "value": "393216:mKr4Y1UgdfeuTUkyfJAnUeb2Kt7c8tQzC:mS4YJJTwfJRea60zC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686105782, "uuid": "62562064-6248-4115-8c3f-92eac386eb40", "value": 14273903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686105782, "uuid": "2fb170bb-57c4-4c72-b857-e8699a3a27b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686105782, "uuid": "eaf6daef-86ca-4ada-ba01-3a219c1656b2", "value": "new-update.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f29024-052f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686141050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141050, "uuid": "80f09f4c-5e99-48e2-86e2-e6074bf3a852", "comment": "Malware payload", "value": "079cac763602947d7e912f7a7fddfa51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141050, "uuid": "e913b164-c028-4787-a429-6361a5b98fbf", "comment": "Malware payload", "value": "48f5c0f47dc2b56d1546a68b5693fd7f7c68bb2cffff1d8a0ed83efd4a6d31cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141050, "uuid": "02ecedfe-7ab3-43bf-bebd-1264d0bfa09d", "comment": "Malware payload", "value": "196b36bed5782659de033942b1292e38193b7378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141050, "uuid": "00241a5c-434e-4045-b9b8-6d025eb40af4", "comment": "Malware payload", "value": "e7be63b422df3a9fa7cfc90d51ecdc5f415e7415b0ff79859ac6193111470885f366beef1db4280359b600680e62ab13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141050, "uuid": "96cf64b1-eefa-44cd-bbe5-0e50b54f28e3", "value": "T177F4E9B2A9C6CDD8F2018F7DC29991641335DE411831C6DE266DBB962EB337E5C4B20B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141050, "uuid": "e79db52c-dbe6-44ea-9ef2-e42bd94d7cc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141050, "uuid": "0242587a-2e64-4a8b-b01b-8417abe57a39", "value": "6144:4/aP1NjE/a5o22qEwLvZWKaq+rZAubbGavSmj4bFN0DIh:4/aPESErwLvZW1Vn/pa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686141050, "uuid": "d072748a-ed95-4ab4-b02c-7acd9342d666", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686141050, "uuid": "3cce6f38-b35f-47d8-8af9-c2fcf5903b41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141050, "uuid": "e82b08dc-f4c8-43e7-8e40-a784e4b54a05", "value": "48f5c0f47dc2b56d1546a68b5693fd7f7c68bb2cffff1d8a0ed83efd4a6d31cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89051053-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686130054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130054, "uuid": "b2e14a5e-5eb3-47a8-b770-ff54dc5d38ba", "comment": "Malware payload (AgentTesla)", "value": "69d3619394774bfd3f2e8e15feae9a5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130054, "uuid": "e97e18b6-2299-4b12-9520-a8fe7dd67450", "comment": "Malware payload (AgentTesla)", "value": "49d6624bc410c9c12b48720165564f7b46633f3df09451cd2acf7e2b5bf33318", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130054, "uuid": "638e3598-ae1e-4861-bd43-f1008bce29ab", "comment": "Malware payload (AgentTesla)", "value": "6a6493af2622ecf5818b4d46cb24121fb2fb36fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130054, "uuid": "87478196-af5b-425e-b565-65427baea50e", "comment": "Malware payload (AgentTesla)", "value": "f4a6dca9aabdd28e6ea6eba81699f75dbea921e6cb2d68ae90d73b4c6abb9abfa58f2de0cef638ffefbbb474f33fec2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130054, "uuid": "cc92d2b1-3545-4490-84bc-1ba63d458d33", "value": "T1D005010872BADB19D4BA3FFC08D095B443F05256755AE74A4EE378CE2E34B418F419AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130054, "uuid": "e82fdf17-5fbd-45f0-8534-d99ef4b78922", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130054, "uuid": "9c881a34-c5a4-4a0c-b4d5-806835478399", "value": "24576:rM9OZHlWxMiQW/O4ue7zZPkHTwmG5fTWh9kXj:Q8lYMiQWmS7zZkHTwt57U9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130054, "uuid": "dd81b942-1ad6-402c-8e2a-03daa4967ebe", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130054, "uuid": "228403f7-996e-41e5-a2f0-f47099d6d370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130054, "uuid": "36e2f61f-6256-4b34-83c5-4137d1cb78a4", "value": "Ordine 1797A2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d0c14e-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686130055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130055, "uuid": "83afb8bd-0cfa-41b6-98a5-30d997d5eb25", "comment": "Malware payload (AgentTesla)", "value": "acfeda93527bf61983215ddcb7f58cae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130055, "uuid": "c15ad826-3919-450f-9813-b24ae28d7055", "comment": "Malware payload (AgentTesla)", "value": "4a06dad3c257f41ddde074d091dbb4fcaf4a4c1d6404bca42c628af3209540a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130055, "uuid": "bde741b3-0527-45d3-be39-068fcb1e4632", "comment": "Malware payload (AgentTesla)", "value": "e7bf041ca8213ab6e868ca5ae33acb7f998b7b6c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130055, "uuid": "b438e835-c245-4263-99c4-a2c510d8dde1", "comment": "Malware payload (AgentTesla)", "value": "7c7ccfcfa0f31768eeddf2f6ae5309a3e4e07a014120077d81ec6ebc346b3708fad4d88aa4c7179de6e86cd120ca4f53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130055, "uuid": "5e6242b6-f858-4b5e-895c-8503ec6244fe", "value": "T16DE4014C93FD079AD6B763B646B4463543BBBEAAB231D34F5E42B08E5961F004A20373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130055, "uuid": "48cec2fe-d53d-4aa3-a0d4-47a0a391507c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130055, "uuid": "40850711-9755-4e1e-8625-d2d6399e02ae", "value": "12288:msIduZ2iNfmFx2iqNhujGjU/ICE3vkzuybRmteIXj2viPpeGq74WkaXcvGbwPsYb:msIduZ1lmFxUbTMzusRKXXjWhMOwPsYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130055, "uuid": "88185a98-cc9d-40f1-968e-3b8741000d43", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130055, "uuid": "f68452fa-52bb-428e-a46c-cb96a634df51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130055, "uuid": "1323a165-36dd-41ce-aadd-f668ee63b2a3", "value": "PAYMENT FOR INV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce65e022-052b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686139619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139619, "uuid": "9641c887-377a-4714-898a-28f16cce1ead", "comment": "Malware payload (AgentTesla)", "value": "3a1bc3930a7482ba860fc39f1eb094f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139619, "uuid": "c68f307b-18e9-41a9-8bb5-4b1fccc57b2e", "comment": "Malware payload (AgentTesla)", "value": "4a23b372fc8c6f5d549fccc312e82d7f3baf80d116d40c7542ab171c9f0d3868", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139619, "uuid": "5a153ddf-57b1-4194-ad44-d670dbb5d142", "comment": "Malware payload (AgentTesla)", "value": "a1ae3e5b939563d9480c30efda16f39bf10438dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139619, "uuid": "9f200272-3d89-4313-abcc-289d2c804c97", "comment": "Malware payload (AgentTesla)", "value": "24f436a9053dc9eaecee0befd7e8447612a4816abe70ac7ac100196d17ee599349266f1f47fcd329ff86ef53f0405942", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139619, "uuid": "2e41935e-d7f8-4b30-bae4-af22c01a8530", "value": "T177E43322447D96853B8FB782EC74FB1139713C21D2411C548B6978B08A38EFF9E9639E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139619, "uuid": "11709381-0586-4c18-9244-c7b2f07f1417", "value": "12288:m1fDRg3eyXDqhGXkapK7IgmRVBJRJqD16Pz7YWrJFtAih7uInD21oj26:a2fmh+kaSuRVB9qBYznJFGitxD2426", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139619, "uuid": "23078d00-fd36-4401-92d2-b1fbff57b7ed", "value": 698486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139619, "uuid": "f5729eb5-a3cc-4a87-825c-bc9eb12e8467", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139619, "uuid": "5d09cca1-a553-41de-9cd4-c5f1de72e804", "value": "SOA JUNE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced7fc88-0562-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686163243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163243, "uuid": "de9caf58-b7ac-456d-9ac0-8308c2a734cc", "comment": "Malware payload (RedLineStealer)", "value": "00124154b84f676abaad588ac6aa3d7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163243, "uuid": "00e5593d-4620-4096-bc0a-083a97465a17", "comment": "Malware payload (RedLineStealer)", "value": "4cab772cf336933f673a8820c419cc033b9e2102aee73c18382c6dff574b95d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163243, "uuid": "2644df66-9d3a-421f-ac1b-a2c388f9e110", "comment": "Malware payload (RedLineStealer)", "value": "1a7a8b493fb1e7aa2e5a19b3dbbad1f8dfbf4470", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163243, "uuid": "52a921d3-89ab-4b06-8919-11d6d3afe10c", "comment": "Malware payload (RedLineStealer)", "value": "f64d84358f7721f18c3da836abd784cacbb0802c4a0920eacd1490dc0bb89f0c34170ff9af6ffcd429048a3cec9c2d4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163243, "uuid": "30251afa-b4cd-4757-82f2-18551449a8e0", "value": "T166F41213F3E45623EDB93BB418F603831E35FD626C7453AB66840D5A0DB26D4A83276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163243, "uuid": "6239d785-3b0a-4a91-b4ed-fed7ecd5f802", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163243, "uuid": "5cd2c696-f073-4fd4-8a99-c9b9ace675d6", "value": "12288:zMr8y90DSjUbytdnoAJ8HJOlNQZLTCeRhFVsNtt4xg12CdJ+5RvRM:XyP7tdnwpOjQhCeRhDazRACdc5RvRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163243, "uuid": "38f0aa42-aef0-4bb8-8fa1-b2e99c97fd12", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163243, "uuid": "855a6eac-d64b-4756-9df7-12b0c2a5a022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163243, "uuid": "910dbc03-5559-41db-bf42-90fa57fa21c2", "value": "00124154b84f676abaad588ac6aa3d7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5459e024-0575-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686171197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686171197, "uuid": "871bdbec-2f4a-40ab-9d59-16138cf08b1d", "comment": "Malware payload", "value": "2335270ac5650be7668b84185f9dd4ed", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "yt-malvid", "colour": "#43334D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686171197, "uuid": "0ee7e0a1-4ea0-475e-85c8-5abd43e36821", "comment": "Malware payload", "value": "4d152234f168692459b482981f469e96e4f933360295cd64f5089370a4b07118", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "yt-malvid", "colour": "#43334D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686171197, "uuid": "44733fd3-2c10-442c-954b-60cc92aec18b", "comment": "Malware payload", "value": "9815b54b685340ba65249710ce12bbd90940a5eb", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "yt-malvid", "colour": "#43334D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686171197, "uuid": "fd8de24a-f8b3-4729-817d-0e2440e9109a", "comment": "Malware payload", "value": "26aa2f28a586f1e4577edd73ac808cf27d1e5723f70b1f48d6ba6a26874707530478baf081e69df1ede6382f5c4d1f68", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "yt-malvid", "colour": "#43334D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686171197, "uuid": "12647ce0-b29d-44a3-8e95-634c04e3f75c", "value": "T1A40733BF682191E96330911AECBBDB019095DBF1EDD94966CCE12DC24B7C51C1AFF882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686171197, "uuid": "f07a4f8a-c3b3-436c-b585-e3f406b0a802", "value": "393216:/xSRGg7XrS0z0UseTcoZZJ4ijrsRF31XSVxXMbKcz:/xG7rSksedZn4ijQHhSkKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686171197, "uuid": "482d9ab1-b665-4cdc-abbd-163ea53670e0", "value": 17609518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686171197, "uuid": "b16bc71b-36c6-4258-b9a1-76ce3789655b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686171197, "uuid": "494d57cd-39f8-4756-aa79-53e29f6e5ea7", "value": "Passwords_2024_Setup_Full.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1392eb6-04e0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686107439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686107439, "uuid": "98b9ca7f-c6b7-4597-ba43-798e77613dd5", "comment": "Malware payload", "value": "8a62003e58e4e0b91d756f172af69396", "object_relation": "md5", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686107439, "uuid": "980acb3e-1782-4bc4-a35c-8f6b4a0093b0", "comment": "Malware payload", "value": "4dfb2a5c08058eab6efff6d3bed91d67f781312ff0be64d51d70bb39f61f93c9", "object_relation": "sha256", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686107439, "uuid": "537b5aae-86da-433a-89d7-1247a252a10e", "comment": "Malware payload", "value": "a2b5ce27926282f3253ad632a15c6048eaa474c9", "object_relation": "sha1", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686107439, "uuid": "6aec4fcd-fbec-4615-8973-f483c5c26cb0", "comment": "Malware payload", "value": "e6ebdf9e3c395c8089f023712df36d26ee63ab1e00a5fef65510a7da4933724c63dcce4564d35073f0b44799053ab73b", "object_relation": "sha3-384", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686107439, "uuid": "cb388bdc-aa41-4dff-aaa0-c3c065868de1", "value": "T18A4633162D562276EDB30C3E165EA34FB5BD785EBF50B1B492EF01F0A2F8164236C4A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686107439, "uuid": "06f6f661-20b9-4449-8c6f-92f65c79d7bc", "value": "98304:kJQ0Yr0kAqwYcR9ip/UQ6cAOOtq8h07fPJRhOM9iabOSqfEBNY/3:k+0Yr0kAqwp9LZc0w7ZRUM9ilSUEBm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686107439, "uuid": "d263973c-2e62-46d1-b3e5-1dd233fd78bd", "value": 5843300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686107439, "uuid": "f7e56550-3990-4575-8b32-32c4bcb0b64c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686107439, "uuid": "a5c70e63-a044-4400-a4c3-43eafa97226c", "value": "ChatGPT4.1_Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f679bd-0563-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686163548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163548, "uuid": "aeaaa065-2b11-4b1c-a0e0-313113cca40c", "comment": "Malware payload (RedLineStealer)", "value": "462e37feda761541f63c9ca5592f3ed9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163548, "uuid": "990bea99-46d5-4bfc-b119-0c0fc46abf0b", "comment": "Malware payload (RedLineStealer)", "value": "4e3e709c7567b27ffd8ae9188cde24f8a8e47940248b1e6db8cb08c951944a93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163548, "uuid": "2a29c536-aaa1-4815-a10e-0171fb8bab31", "comment": "Malware payload (RedLineStealer)", "value": "dc11f17b5faf4541ddadf63b7d77a41bd70975db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163548, "uuid": "d7a4e5f7-e84c-4921-90be-867291364073", "comment": "Malware payload (RedLineStealer)", "value": "f81abb62be29f3f4662b457ca6b75a0f88eb696f80f3f3d5df8518eb9c96bc635da4654ddb3640b48380084be3bdf2da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163548, "uuid": "e1238561-90d8-451e-a607-c80bfa6aa01f", "value": "T1CC446B09E4AF42D2FE467176216D905AF5BF80F317BFC02ECF5A3AD21C572A096A111A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163548, "uuid": "c8c93bf2-e98d-49cb-8930-6503e5623bf3", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163548, "uuid": "037d02ee-f8c4-486d-b7c7-e67f7ce96b71", "value": "3072:fhg7f1OleJRyHFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2yQHcj/:5gb1OpFaQ7W05AEezbMPZFzAy2yA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163548, "uuid": "2771565f-d4a8-4bc0-92b5-28aceaf02be6", "value": 268226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163548, "uuid": "4a2ccd84-7eb6-49f6-b8c5-90566d3c2f8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163548, "uuid": "55a618ab-880e-4980-bf28-40bfa3814dbf", "value": "462e37feda761541f63c9ca5592f3ed9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1446462-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128404, "uuid": "98c04dbf-e8ee-4e8f-a98c-f1724c0bf7aa", "comment": "Malware payload (Mirai)", "value": "dbd1a5a47fb5d9e99ee0eedf12034dab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128404, "uuid": "c3ef4618-ed8d-4bc7-aedf-10799192cbdb", "comment": "Malware payload (Mirai)", "value": "4f1c85bba5720965b954b1c1ac56ccf37421cb5beace0aa3cb18394e4d0e7f31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128404, "uuid": "58cf599d-25a5-4644-bba6-13a93fba1ca9", "comment": "Malware payload (Mirai)", "value": "4ee0f715fe3f127fc0769f4064ae444e7c95eec3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128404, "uuid": "3ce4b6d6-89d0-43a1-a550-4307d4625a96", "comment": "Malware payload (Mirai)", "value": "3ca2a0cb6d0aa833bc42032d70e4efab1f536f69a0740f7c70eaabcb92b72e77340ea2f367818293d656f718cd75f512", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128404, "uuid": "fd96055d-11f7-4f0f-88aa-4e87c0463aeb", "value": "T144E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128404, "uuid": "22be4d53-238b-4511-921f-cdc95fe3cc27", "value": "3072:Cv/WwsLgaq353qHiCOvhOpAqkDQHbeskmhxQwoVSUNu:KPLaq351hOpAqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128404, "uuid": "62e92766-6714-4168-8120-d78fdbb1432c", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128404, "uuid": "7b62d73a-af19-4050-aba1-b5065ef3dc02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128404, "uuid": "3b212b35-9f2d-42df-a2a4-cad35efccdaa", "value": "dbd1a5a47fb5d9e99ee0eedf12034dab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0d4426-0546-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686151235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151235, "uuid": "c01024d1-32b8-49c7-a8e0-429e641dd6d1", "comment": "Malware payload (RedLineStealer)", "value": "1ed85cce02c28c943233f736467e97f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151235, "uuid": "29740759-8aa9-43d4-8c0c-9878a1a3d351", "comment": "Malware payload (RedLineStealer)", "value": "4f415202a917f8935c1fb8eea6631a999c6d56c835d26e42a1ba4f3c6da22656", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151235, "uuid": "3bf03184-adf4-4fac-b084-9ead1c5af283", "comment": "Malware payload (RedLineStealer)", "value": "1fc10f69afc504377499e83789c4cebe95603127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151235, "uuid": "5b948db1-d49b-47d2-84dd-45409afbbc13", "comment": "Malware payload (RedLineStealer)", "value": "25de8f754efba5ac320ddc512d7ae92444a53cb38ec5618e1d740a29cc57da1545b3da02907d2457ccafaab87d7a5932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151235, "uuid": "ef3a6cfe-68c9-4999-b36b-76df02f1b91d", "value": "T155563367CA217191CF831D3827DA6EF37F7E10C822E90547E629E878CCD5B89E909B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151235, "uuid": "641419ae-31ec-4f61-a13a-eb931ded0388", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151235, "uuid": "218b835a-3a74-413a-ab4c-0761f9cae2be", "value": "98304:f/7xCcIQSdeEbi3OmqCkLPSquAAbujaog+aVZ9t+IcegD5nxf4vwyddcoVxKIsxo:EcEvSdqCgPSqcbujfmf+IMDRCdVe2Pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686151235, "uuid": "42f6c3f4-9816-49f0-87b1-b83fba7bd9ed", "value": 6030192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686151235, "uuid": "09e4b416-28df-471b-9499-45bbd690e604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151235, "uuid": "e02245c1-4add-4b02-a6ee-b09c53d8d273", "value": "1ed85cce02c28c943233f736467e97f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43960109-057f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686175464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175464, "uuid": "2efe0394-1cdf-4cef-a27c-24b323ef155a", "comment": "Malware payload", "value": "79435ff18a7883e824cf0844bcfcbedf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175464, "uuid": "70a29eeb-85f4-4a6a-b56a-0bac7c6b9b92", "comment": "Malware payload", "value": "5021596b70c732ff13320cd1a7a163f0ad7c7fdd1822ea2154294e6278bc6413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175464, "uuid": "d0be3ba3-6c62-452d-b15f-b5f5e690fade", "comment": "Malware payload", "value": "06d98260a412f0d2cbe4007167099ce7184737fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175464, "uuid": "9b23fc78-c282-426d-80b2-e8b5208d0437", "comment": "Malware payload", "value": "18ed3213fd1917bbafa9e8577c184a5525301f05a22b91f47c1295ceed3b32e2731f87acec2c8a8ef6046ace175420f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686175464, "uuid": "2710dae4-5d54-4375-abe4-04883dcb9064", "value": "T10FF4D1CBBB438776C84F557282C6E82003B0747FA576D98928C6B3A979523732719D8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686175464, "uuid": "40eb59e4-ef11-42ca-b05f-4f73309b3b22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686175464, "uuid": "32aa83a8-57d5-4dc1-b742-5e9ae3887434", "value": "12288:oCwVYzJVK9t4O7F9bz9ZkbxXfSgDazHMpKs4NR7pw76i6XDFYo:xLzJVqt7Po1fSiazHi+w76i6XDFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686175464, "uuid": "843704f4-ebd9-40fe-abd3-1f0fc68fe6b5", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686175464, "uuid": "80dd3e73-8af3-481c-a91a-161116e21016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686175464, "uuid": "d797c9b4-fd3f-46b9-93a1-e2fe3c1d63c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2279cb-0560-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686162431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686162431, "uuid": "4eec1ccc-b94a-482f-92fd-09c3e7b901ea", "comment": "Malware payload", "value": "afcacc204092f370c5f2952399ccc503", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686162431, "uuid": "85c82b5b-242f-45b0-9c96-0eda83628810", "comment": "Malware payload", "value": "50ee7ab95de8e4a91c87f0b161cd2cdb593f7083645511b2f012a8451e776903", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686162431, "uuid": "f5e3cec0-b39e-4380-adfc-49110f9cc66b", "comment": "Malware payload", "value": "12998919b8b9e1f20a25a9251ac73dfa72eb0d2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686162431, "uuid": "cc796bd1-7b31-4be2-a1e1-32a2348bed08", "comment": "Malware payload", "value": "1136ea5ce26f26b8d015339bbf9df7fca6f844b65cc6196ca0e7431051b82aa01a0bf229fb17f0f436dd435bc969e789", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686162431, "uuid": "d67bb6d0-14e0-4250-9798-6da368af821e", "value": "T174A38D1276DCC2B5E41A35704C60EDB66AF9B979377F009BF78906692E233D042B271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686162431, "uuid": "1e25ee6c-ddb8-49ce-81d3-1f100634c6c4", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686162431, "uuid": "6eb6127a-9d05-46a4-8cb3-cc6dd519a5b7", "value": "1536:Mp6kFya9c7Ok/YNQUgB75eGFXgizjyXX9di2YTHLYjzDm:UVBQ91wizjyHxYTHcj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686162431, "uuid": "95975198-a3ac-41c9-b894-6cbc0e3d516d", "value": 103363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686162431, "uuid": "33e030b0-f91d-4efa-ba44-8c62f5591259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686162431, "uuid": "04cbfa79-1a74-4091-be8f-56e20ef72d37", "value": "SecuriteInfo.com.Trojan.Agent.GEZN.15970.1682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b835b8-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686130047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130047, "uuid": "899f83b9-0cd2-4dbe-a804-4a51a0ac2f4f", "comment": "Malware payload (AgentTesla)", "value": "04ec09a3ecd862853d09b26d61f8296f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130047, "uuid": "e393afb9-b938-4679-b2a1-f3f9ee04eb54", "comment": "Malware payload (AgentTesla)", "value": "51e217e7f3597022c7e6e6d417af3f2437f048896aa015005a688ff2ae0be452", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130047, "uuid": "f20118b7-1b0c-4968-b2e8-14051d5e9d82", "comment": "Malware payload (AgentTesla)", "value": "dd90e39bcc52ef48d937329ed4a4848d0dad162d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130047, "uuid": "d5156455-899d-4029-a444-17620f5ef42e", "comment": "Malware payload (AgentTesla)", "value": "2e9a767cdc611a358b522de7f013fe99df4221cfff9705ee25a0c1504d2df3af679df255d1821c67c8ca9918597c545d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130047, "uuid": "1fe270a7-f534-4a9b-8e0e-aa2bba9ee4d9", "value": "T1D9F41257EF3F5B0BC5A2BEBC563080B5D6FCD985903ED1AAEA47481FD419E319C90122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130047, "uuid": "c3b7e6a3-dffc-4cc6-b213-6967d3ecf401", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130047, "uuid": "a651f36b-646f-42ef-b062-237efe36de89", "value": "12288:ftAMTihh6xhZ6OrWZyGg7zqNZWnKaBs6oHe9KDimRSCKdTeDhjUu:OMUgh8yrGOYoBIhDSC8TOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130047, "uuid": "a9414d38-05b4-4eae-93cf-d7b71e670daa", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130047, "uuid": "ac683e5a-c634-4cd2-9be9-830ec7995ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130047, "uuid": "63ba76fa-2222-4f77-8cbb-053c84c13f84", "value": "Invoice pdf.7Z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d952f8-051b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (XWorm)", "timestamp": 1686132544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132544, "uuid": "9a2d7b37-f88d-42c1-8c2b-e3e98fe566a2", "comment": "Malware payload (XWorm)", "value": "7f12f43252b958d6ab4640a57ce3273d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132544, "uuid": "0eba5110-668a-4942-8db6-ddb2e7b803bb", "comment": "Malware payload (XWorm)", "value": "529d29ba39bfe46cdb00865a3a8966523f1f0b36b491273e0f328367a36ca9f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132544, "uuid": "a81c3fb3-4bfa-430d-9864-66379fc7732e", "comment": "Malware payload (XWorm)", "value": "c46e6393182c320684f1e7afb87cb15c9ed3fe3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132544, "uuid": "40ba79f6-2bfa-446b-9226-1eebfc3bbf77", "comment": "Malware payload (XWorm)", "value": "ce67836f5f3cf02c4485418cca5de8d769ce378e4b242cdd341ae3cd1e60851a4ab38ef7df3fdfce227640ab5670cf89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132544, "uuid": "be1c0bdf-64d7-406d-886a-67a43a6469e0", "value": "T1CBF25C48BBD4821AC9FE2BF42873520603B4E603ED13EB5E58D859DA6F27BC54D413E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132544, "uuid": "83256945-865f-4d11-b638-a2850a514454", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132544, "uuid": "b6ddff40-f8a4-4a44-8722-dd24d72a0f07", "value": "768:PTHw9XNFwCjGMNIOFM9JqeO9hMSAsRbyAn:PTKUeVNrFM9J1O9eARb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132544, "uuid": "0c7168c7-ef1f-4e39-86e8-a11c7f442dd0", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132544, "uuid": "7458f145-197c-4ad1-b055-3dc53ce0f4d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132544, "uuid": "60e08722-49e3-41ef-bd51-2265f5683ec3", "value": "7f12f43252b958d6ab4640a57ce3273d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5dcb75a-057b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686174045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174045, "uuid": "bcfb19a4-1b16-4c54-8b50-4a305bacc25f", "comment": "Malware payload (RedLineStealer)", "value": "4ac169728f8b6ee29cd509efedc2ce37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174045, "uuid": "3d2b3cab-d29a-4fb0-a6a4-7503b4bd231b", "comment": "Malware payload (RedLineStealer)", "value": "52d1a16f2bebab754cc0ce36eda936464cd235ebdf064a868d7fc1822470102e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174045, "uuid": "c6aa46e5-c524-4818-87ce-ed5d5366f31f", "comment": "Malware payload (RedLineStealer)", "value": "33985f52d1050eb30e8dc2341acf3c709f9f09be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174045, "uuid": "75918fbc-6454-41d9-bd85-47dea1e15af1", "comment": "Malware payload (RedLineStealer)", "value": "cee2001e57f106b35fd50429bdb79e221eec55440d6453124399e37945e4374390d73c2e090c89fd908f58cd4d4b6652", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174045, "uuid": "78afac56-c007-4307-b119-5e81bb1e1df5", "value": "T1DCF41223ABE88477E9B2377198FB03C31B367C615D78562B27413D9A0D7258069327BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174045, "uuid": "cdda833b-63b8-4ecd-9a16-957b16927289", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174045, "uuid": "ea3cf01d-5477-4fea-88ba-90019b6ffd83", "value": "12288:zMrdy90hTlMm/eKO+en+185PiFAza6gtzbf4zHnGioC4XQRWZIMpJzw1e:ay4Xe+Xd6QzkzHGio5Xrzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686174045, "uuid": "cfb0089e-a478-4592-bf83-af95e0130485", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686174045, "uuid": "1c1b92e2-da79-4387-882f-2f74926b6784", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174045, "uuid": "9580fdb7-387b-4bc8-95b6-50dab1ac5f9b", "value": "52d1a16f2bebab754cc0ce36eda936464cd235ebdf064.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09893cf6-0565-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686164200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164200, "uuid": "d0aa9d23-54ea-4e83-9bca-245d7a00f72b", "comment": "Malware payload", "value": "f30f5986aba0b30b0b540fc2b18f5b63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164200, "uuid": "ac57c4d0-3a18-4620-b4a5-9dd003129cfc", "comment": "Malware payload", "value": "555e87aa3b04e227de914fe0b23b7c36578b4be3f91a23361305fd358848553e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164200, "uuid": "d57ed76b-5331-4eb9-a268-f8932c14ae75", "comment": "Malware payload", "value": "30ca9ca37cdded96bd9af1e23ebad478d306b82c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164200, "uuid": "da632f70-9838-4c23-91d4-40711b4180de", "comment": "Malware payload", "value": "69a242ccd463a305602d9d33a80ccfd35c66543774a48e3c9beab95b0f10857a67897161be88322d330d7e253bf7f0ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164200, "uuid": "d9559c53-6034-4120-b55f-3504d1cf373b", "value": "T113C41213E7C88032DDB6277458FB13830E317CA29979876B1347998E1CB2B91A93577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164200, "uuid": "9069fe42-4b11-48a1-b98a-f238ddf2eb12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164200, "uuid": "ad3a8945-2153-46f7-bf8a-d80475e610df", "value": "12288:3Mr+y900r+aFVcrpkZOoNfGa0uYtrHUsIFYr:Jy1+VkAoH/YhUJF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686164200, "uuid": "0c9748e3-20ed-4d18-b8d8-79970c8d96ee", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686164200, "uuid": "989ba7a9-da3a-4551-a7a7-52f2e59e4c21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164200, "uuid": "cd41d201-de2a-4d52-b7c4-65cdfdda8fde", "value": "f30f5986aba0b30b0b540fc2b18f5b63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd68782-0563-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686163539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163539, "uuid": "a68c5746-8088-4c8e-a361-9b9fe079b3db", "comment": "Malware payload (RedLineStealer)", "value": "a84430497ad950cdb1d33043003dd972", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163539, "uuid": "e8001f27-23f6-4789-8177-5ceb506c71ba", "comment": "Malware payload (RedLineStealer)", "value": "55cd35e3d1b71771cb7298584af77597588373c777a948bc308070d74fd5243e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163539, "uuid": "b23f691c-e861-42b3-9996-f924b5dc278d", "comment": "Malware payload (RedLineStealer)", "value": "d0cbc5576143ddba86956cc6309c0f80cfdda3c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163539, "uuid": "806a3853-2c0b-484f-a2df-f50d419bc8c2", "comment": "Malware payload (RedLineStealer)", "value": "cf151b1e2cf7468fdd4dad68248430ce476dd54763e2b752689bed80ee52529da9c764af4baded262f0f8776c3a13a85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163539, "uuid": "db41672c-0307-46a1-afcd-26d63d43d578", "value": "T154052352E7EC80B7EA756FB158F602C30F36BCA249704167234A6A1E1C725C4D57AB3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163539, "uuid": "d44a8606-40a7-4309-9ac3-ed2672360692", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163539, "uuid": "9333696c-cbdc-4ab0-aad5-a3e60a74499e", "value": "12288:+Mr6y90vsQY11fv0V1xyzd4qxGGWT9g4cHNV4ldQFVYGYnY3TCFoL3PRgNLQafHD:AyaV1Kd4q3mgjtwdGYnY3TIUPRchkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163539, "uuid": "b56c6bc4-78f8-4158-86c7-be1e589bb886", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163539, "uuid": "cf71a37a-47b2-443b-b85b-c443785e376c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163539, "uuid": "73d86156-81d2-4712-be02-86c58513d9d8", "value": "a84430497ad950cdb1d33043003dd972.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204f614c-051a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686132026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132026, "uuid": "f56542f6-5569-4703-95ff-401243402d86", "comment": "Malware payload (Amadey)", "value": "a64a886a695ed5fb9273e73241fec2f7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132026, "uuid": "57621647-7bc8-44b1-b617-0be251f6806b", "comment": "Malware payload (Amadey)", "value": "563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132026, "uuid": "ca4849f6-545b-4263-91ef-19c9a2de09f8", "comment": "Malware payload (Amadey)", "value": "363244ca05027c5beb938562df5b525a2428b405", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132026, "uuid": "06cf8442-0aa2-41b8-9c2e-b700f14c4572", "comment": "Malware payload (Amadey)", "value": "d504de7913cd2f3ffacc269b58dcc1aac2701487886d04cde418da95bb04641001dd60a35574e1163bd62853679bd7e6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132026, "uuid": "3ba6be55-ff96-4af0-9a69-4fc34cb085ca", "value": "T1681407657912C032D971A1B619F4BFF2C59CA825ABB149DB3B800F77CA112F73960E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132026, "uuid": "bea82cae-5ebf-47f7-a90e-7092551401bc", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132026, "uuid": "4702ceab-e361-4d9b-9b37-fabae6c59c7c", "value": "3072:lWgR9+o+G2K47yLk6E9EzwHxFTTDYUSNt2kLu5gf7or7wy+wXRcWfnPjt:lWu+5a4ukZSwH/TT2NE4u5gTovv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132026, "uuid": "94d66a72-dab7-4686-855c-c1faf1c4fc23", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132026, "uuid": "75f7d7f0-82be-4a52-9279-98fdd4c01970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132026, "uuid": "86850b42-8c0d-46fd-97fb-b05f712acf2e", "value": "a64a886a695ed5fb9273e73241fec2f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e34e88-0537-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686144469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144469, "uuid": "2919510c-e1f1-413b-bdae-75e486f11d6d", "comment": "Malware payload", "value": "65fdfd0e0aac6f78308bb9b1fc33616a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144469, "uuid": "9c5dcb2d-4f72-434d-95bc-ba3ab89e2b10", "comment": "Malware payload", "value": "5662f27cafd31f50e4b60c47601beb8a6ce781f7a01e04c5f878998738462693", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144469, "uuid": "6039a1f2-4bc4-4fa2-b310-67110bc47225", "comment": "Malware payload", "value": "e8bcb4e11a15ca9ed23e03ddfa8138a2a27def2a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144469, "uuid": "456ad8a1-f521-4dbf-96d9-b846e17093e5", "comment": "Malware payload", "value": "b9a70ab359fb56af95366a2d25894786af7cd77fc00b406a15c733bad9a4d2b9bb5e7cf8288212b09840a1c0e7716107", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144469, "uuid": "488868de-f302-460d-a647-7d0a644a70b8", "value": "T1B213A613B7D6AF16F12726B489F3C299A335BD068B76872F2158370F7DB14702A42762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144469, "uuid": "b5bb2015-5287-462b-bc69-724dc77fe395", "value": "384:2eLIuebzoOTIO2a077XrCPa4QZ4j9ds6/fWBPSmRqiOe6giSwvxjk+tRotex+:2SdxNFkagj9dFudSHBeOxw+tRee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686144469, "uuid": "ad3e3960-0558-490a-9bdd-a8de0388073f", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686144469, "uuid": "a30007fa-05b1-4f84-9eda-d405c49d62b4", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144469, "uuid": "0c815b6f-37f4-4c3e-9ee9-54b7970dd411", "value": "A TEAM TRENCHING HDD GP SC .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf17793-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686130034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130034, "uuid": "3a46b065-03ef-4e6f-9686-d192fd6dbdd7", "comment": "Malware payload (RemcosRAT)", "value": "f5d1bb9e0efcb13c9c3d60916e671b13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130034, "uuid": "3b272c19-3995-4a9b-bcca-07ff69abe3ae", "comment": "Malware payload (RemcosRAT)", "value": "5676b7a9cb31786a924b94b9dd8f92db7bf7beb4fe0267b077e9240c531d3af7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130034, "uuid": "71562f58-d2bc-4106-9f78-4a5c6d2c5754", "comment": "Malware payload (RemcosRAT)", "value": "815c85347a0b400d89f6991e5771fa3b6c828f53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130034, "uuid": "404d5a51-e2c3-4873-aa81-a88dfe158506", "comment": "Malware payload (RemcosRAT)", "value": "ade486b60510fa5e231fc4def93fa61df6b830a0de132980a18879e58ced50db66a363baa017e0ca4eb1d507fa5be7b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130034, "uuid": "3c3c4d88-3791-452c-a19d-b222f3c46ac4", "value": "T198A4BF01B9C1C072D57261300D2AF775DAB9BD212926497BB3DA1D9BFE30190B63A7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130034, "uuid": "da3296f1-a757-484d-bab4-a1a2fcd5831f", "value": "3f3d4ba55ce3e8f736704310c56bf5aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130034, "uuid": "cbe2518d-1aec-40a8-8349-e94c5ac90487", "value": "12288:U1EZT90uNQzYgScBvnn/XpTs/Zii0OhX:ucTiuazYgr/XpWZ/0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130034, "uuid": "7f714a7d-d5aa-4698-a022-7061643a29ee", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130034, "uuid": "283c228e-bc92-4f13-b414-0eabb321781a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130034, "uuid": "4a912e62-0b72-4a04-a0b2-1c6c49c688bf", "value": "5676b7a9cb31786a924b94b9dd8f92db7bf7beb4fe0267b077e9240c531d3af7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa51a287-052b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686139693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139693, "uuid": "5a8e5160-cce3-493f-8cdd-fc8b2f9f9567", "comment": "Malware payload (AgentTesla)", "value": "ce714d9737ab9038e37f643eeb82b81e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139693, "uuid": "12224a9e-f0fb-4873-ae47-20a38032f01e", "comment": "Malware payload (AgentTesla)", "value": "567bfb9eaa70ede7cd76b81e66462126dac93592171ee69aff1d639b3eb11ea7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139693, "uuid": "8a79e26d-f2a4-4b8b-8684-8449fbbe5ca1", "comment": "Malware payload (AgentTesla)", "value": "769ffbdf4151c33f71148f76d9415255aee1906b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139693, "uuid": "678a4f11-72e8-47f5-b9f2-94b8d5a603f4", "comment": "Malware payload (AgentTesla)", "value": "7c6938c3678f088834644689054b4b898973a43dce2fb54a38f5dc715b3103bf1564798bd191bf8882c43bae48b58b26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139693, "uuid": "f2003729-60c9-449a-9a9b-f17f2296cce9", "value": "T1BBE42322447D96853B8FB782EC74FB1139713C21D2411C549B6978B08A38EFF9E9639E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139693, "uuid": "23b6f14f-db11-487f-8b8d-7ff6c68fb274", "value": "12288:V1fDRg3eyXDqhGXkapK7IgmRVBJRJqD16Pz7YWrJFtAih7uInD21oj2F:T2fmh+kaSuRVB9qBYznJFGitxD242F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139693, "uuid": "befc8d23-00b6-48ed-baa1-8c64b51f0d94", "value": 698496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139693, "uuid": "cc9899a1-93c3-4fa8-a1b4-72fc36eb3712", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139693, "uuid": "6675b4de-5369-4bea-8902-4635f1b92e01", "value": "April-May SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0197796c-04e1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686107493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686107493, "uuid": "d5e37ec4-e167-45bb-89ce-5e1ad6f456de", "comment": "Malware payload", "value": "d90b0084ad6bcc797464a8fa9c4a00dd", "object_relation": "md5", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686107493, "uuid": "7756e2c1-ab26-4a04-8a25-345c9c478fca", "comment": "Malware payload", "value": "5749e40b4bb4dd5c0a4b752e5894c1b28238bdef0c851bfcefcbfbf7d3ce7cb7", "object_relation": "sha256", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686107493, "uuid": "9f215c80-1488-418e-b889-5eeed9d0645a", "comment": "Malware payload", "value": "90f0918f41943022d7c1a966596ad8ade64348e7", "object_relation": "sha1", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686107493, "uuid": "3a2c64e0-d472-4a55-8d1b-b884dfaa83c7", "comment": "Malware payload", "value": "24e673bd431b9a5ec9621b49713925fb8b771be3874d49d8c16a7e210784460f8bb8587b2dd831f8e4d6b84643ee9cd7", "object_relation": "sha3-384", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686107493, "uuid": "4d678fab-eaf3-403e-908f-8b2bcc96f6a9", "value": "T1F65633023EC79332C5BB0431257F5359267EBC216EB0966FA35972683DB1690236CFB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686107493, "uuid": "332254b7-4de7-4dbf-9772-22677abe9a6b", "value": "98304:gW+RSSy60+e+qgLdIR/IyAwqsOZI8R0v3ZfRjIKH8+bsAsNMbe:QRSSy60+e+7dxtwW+vJRcKH8RAaMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686107493, "uuid": "8a4821f5-8594-402e-829b-d08349c206fa", "value": 6179840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686107493, "uuid": "5b921c7d-2413-4fac-961c-9ccb610d6f2d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686107493, "uuid": "ca0a9ba1-36cc-426b-a3fa-f61c9280b62d", "value": "ChatGPT4 Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc6fd24-0555-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PureCrypter)", "timestamp": 1686157654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157654, "uuid": "daeace57-d064-4be7-9165-425fe9f10ec4", "comment": "Malware payload (PureCrypter)", "value": "ecc552bd491e32922dad83162d06e0d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157654, "uuid": "5a72088d-9d4e-4552-8bde-bedb29c3f7a6", "comment": "Malware payload (PureCrypter)", "value": "583171e9558d7ff43ac3ff0746df278a28a54bc114d966859005741504ef351b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157654, "uuid": "35f5048e-7c7c-427b-bf8d-21f4dd92a598", "comment": "Malware payload (PureCrypter)", "value": "73497e2b794eab38a4a503ecb7338956cc482a8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157654, "uuid": "30ce436a-75be-461c-8606-1946c1ed9418", "comment": "Malware payload (PureCrypter)", "value": "d90c813141a12d159aafe132c43ed382d65839039956201d565ce86ef55c00ebabc33788ffb61980ed803bd3aafc7508", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157654, "uuid": "9027a3d4-7f3d-4b24-8231-1748aad47c2a", "value": "T18CF3A224EF65D93ED2A43B39E84180906E7469159C03EF1EED65EFE93F67281083D28D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157654, "uuid": "28f8514a-5d76-46c8-adaa-a9c6888d28d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157654, "uuid": "c67e735c-8561-46b8-b361-07e543e79dba", "value": "1536:51TtQvMQZncjsdUIkWPqLUuWRRngIGPX2MNi61xdlq3/Tp:KvFZncjsdR0P2MN31R0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686157654, "uuid": "a6464fe5-9a58-4d1a-aa77-d466926b7fc1", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686157654, "uuid": "e31ab489-7ceb-467c-b338-3fcd013f0594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157654, "uuid": "7d364b5e-f5d9-4c08-be74-30598c1e62e1", "value": "583171e9558d7ff43ac3ff0746df278a28a54bc114d966859005741504ef351b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8dd8f82-0547-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686151717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151717, "uuid": "56427a46-3035-41f8-8301-80202119cac0", "comment": "Malware payload", "value": "c68af5c064be4a7dafa041f50f3862ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151717, "uuid": "6445bed5-ba1a-4737-93a8-2e6b64e32ac8", "comment": "Malware payload", "value": "5838a5a7fd5fc03f70347aad9d62a4760a0bbdd376bd1acf6c60b8c09e533fdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151717, "uuid": "3958cc13-40ab-451a-b13b-f2915c3dcd99", "comment": "Malware payload", "value": "8ddfbe39cd6d3a269ec97afef8c994d3f5fead7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151717, "uuid": "fe45f64c-a39b-4503-93aa-befb2196ead8", "comment": "Malware payload", "value": "b9a47e8e7f9c6b6089a2b57af1a6ff727c83e784f3c196a3d7deedbcfb4f22090e65f754ec8a79564a4357ecb70ac33b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151717, "uuid": "0b7e9349-2e74-48b1-bc5f-71264c3b57c5", "value": "T15D73391A72E91505FDD25AB02AB9B2426D35BBA24732C5DF1AC06C1F14B1FE2A970337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151717, "uuid": "8d46c23e-cff0-40c1-aabf-cbf1c42102c3", "value": "45ee545ae77e8d43fc70ede9efcd4c96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151717, "uuid": "ac458736-5232-4740-b7b2-f53156e12e27", "value": "1536:1VYIJtdRHzb+uzucD5GYLKYaU6s8B8koWXiVav6M:1midRHzMcDQY/aC8BDogkav7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686151717, "uuid": "bb7c7386-612c-42d8-86e8-1f8c995e1e13", "value": 75952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686151717, "uuid": "dccc8a1c-4225-4452-96bd-fb6e6f6f92b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151717, "uuid": "630d4463-4e4e-434b-9802-0bfdb2487708", "value": "SecuriteInfo.com.Heur.20230607145525978235056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbfa82f-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686130035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130035, "uuid": "a9e541de-b8fa-4196-b14a-7a96dd52a729", "comment": "Malware payload (RemcosRAT)", "value": "66dec3cfbfa9b0c0e3338190a1257984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130035, "uuid": "ff50c6df-75ca-4835-a579-8ec98e77af2d", "comment": "Malware payload (RemcosRAT)", "value": "58fb573c639d62595f7d87b34b86ad790e1031308953aeeaa7598aa690aa7731", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130035, "uuid": "8cef200f-ecb3-44d3-b01b-43a2fde5e230", "comment": "Malware payload (RemcosRAT)", "value": "5e9759c2ea437ce7b889277a1472570bc403c010", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130035, "uuid": "b5e1ab5b-1b6a-4973-a3ce-82c41fba98bb", "comment": "Malware payload (RemcosRAT)", "value": "283393e660427280d081fda4e5d9203adc507d69ae18d87fb4b9ea80c0c1bdf0c865248b6573569ce115915f3773b0f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130035, "uuid": "a766e0cb-7c96-4c7b-80d9-78e25d579102", "value": "T17EA4BF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130035, "uuid": "45ee05d8-706e-4346-b4a2-8aead8e43f62", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130035, "uuid": "c539d57c-630f-4204-bd7c-5b4de545a824", "value": "12288:VRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/Zf2XDU:Vx7cyF2eSsewS8W47eZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130035, "uuid": "5da52a66-15b0-41eb-9d9d-507d6e9fb241", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130035, "uuid": "418e20ff-441c-47de-a731-6590e379047b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130035, "uuid": "6be62793-378f-4619-ac28-377f60ed2498", "value": "58fb573c639d62595f7d87b34b86ad790e1031308953aeeaa7598aa690aa7731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62639b21-052d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686140297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140297, "uuid": "a83f8a00-86f4-44c3-ba3f-3b2ad389d6bf", "comment": "Malware payload (AgentTesla)", "value": "c6fa09d4cf156d9c274bc5abc5bd3cc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140297, "uuid": "8bb25853-98f0-4b04-a3f2-8601d36da8e4", "comment": "Malware payload (AgentTesla)", "value": "58fdb8219dec670bdc254e76796c99f7506c11330694bd12a8dc79cc12f6a654", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140297, "uuid": "de7ed5b3-493d-48b9-9af8-80a224cff285", "comment": "Malware payload (AgentTesla)", "value": "364dbf9bca1eb7f8783cda4e3fe1a3164b432807", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140297, "uuid": "1aba374d-1248-411b-a330-7813903154c8", "comment": "Malware payload (AgentTesla)", "value": "bc47a9997f8532b5c6ad39617b8685a0a8853c8bf31bdcd42f9d1132a0157c05ffb4646c80240ab08c1bae36c24db369", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140297, "uuid": "b4ce7a6a-d9a8-429f-8ce2-07819dc662d8", "value": "T15AF32969F2D94D11D33D00B8C8B113441AB2A17F527BE76D0DB5ACFA3A163C3F62A865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140297, "uuid": "7c94e6d8-b4d8-4b5f-97d3-aa3781c37495", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140297, "uuid": "ab854565-1995-49b0-aa3f-53f3e7bf6359", "value": "3072:MhLizJDrQxDWP3Ie+ajiJCTfTtBh4zoF1hBqiQW7rBCc:MNarA23Ie+ajiyF4zovhIilr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140297, "uuid": "824e851d-7092-495e-99c8-de369a63412d", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140297, "uuid": "240f2a8c-c099-4cdf-bbf7-465e2f9db6fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140297, "uuid": "17a85730-f89a-4102-b677-0d64cef66f08", "value": "58fdb8219dec670bdc254e76796c99f7506c11330694bd12a8dc79cc12f6a654", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d38137-0540-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686148324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148324, "uuid": "f4425f0e-4734-42f7-89d8-ca727daf48d3", "comment": "Malware payload (Amadey)", "value": "7209b8f7a4e8e7449ae58f75f942e9bf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148324, "uuid": "7c0e2448-837c-4e43-bdb7-c6f20c8a9f6c", "comment": "Malware payload (Amadey)", "value": "59458b3327dafb5b9ade9fb4a4ba01323675d95da17029d5f40d958756e44e02", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148324, "uuid": "a3ddc9b4-a2dc-402e-a434-1fa2ddcd6b36", "comment": "Malware payload (Amadey)", "value": "64cabea207ea89f92c244c8792f5f5f8030dee76", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148324, "uuid": "82d044ea-8929-471a-934f-a76240b637d0", "comment": "Malware payload (Amadey)", "value": "a9b70719763b951dd76c507700e9f736569732f467c1f90ae1d8f65275055dc0ae1f3b15e3934367f164ff28adb914e8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148324, "uuid": "79fd9dd9-8933-4644-9223-442cc6f3faf7", "value": "T182C41242D7EC4437ECB1277058FA13C30A3A7C92AD78976B1329A80A6DB35C4A57177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148324, "uuid": "00dc3155-a2b0-4154-87db-31a9d2b1d130", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148324, "uuid": "98016122-a1aa-47f2-83be-88e449d7f4c1", "value": "12288:FMrxy90LHoLFO2MQL7GHiBbrNU1HOJW84yjsGduVh6Q4GFdbDp5fe:0yWi6N1HOJW84Y73vGnp5fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686148324, "uuid": "a78d4c4c-f40f-484f-ae9f-84b983b825de", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686148324, "uuid": "c9a1f6d8-71b3-4c8d-86da-48ace0c7e417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148324, "uuid": "151bc2a5-e94c-4a8a-bbb5-2d0fb7b2ceea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e215ae-052f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686141026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141026, "uuid": "8ac2ade1-7221-47e9-b856-64723c4211ea", "comment": "Malware payload (RedLineStealer)", "value": "c5ab4d12f41527f06640b409293c99d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141026, "uuid": "1f5c9856-38bf-4c17-ac49-a9d88fc18c99", "comment": "Malware payload (RedLineStealer)", "value": "59a1ad57a529e313eee89fa220db9b08333e3b1a73305cd5444ac82acd6d09ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141026, "uuid": "4a6d1a0b-7538-4eff-a7c0-c76ff2a3aae9", "comment": "Malware payload (RedLineStealer)", "value": "2e774415805d44921ad6bd68dedfcac4422e50d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141026, "uuid": "c4a1ee2d-8773-48aa-afce-7f20b481f9a9", "comment": "Malware payload (RedLineStealer)", "value": "b254cc15911887c65e38bcaff6ddbeb61752ddeb2e744c2515126713bd8ec0a31b62fb01683ce34137f129e1aabdb753", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141026, "uuid": "ac491bfa-8ff8-4caf-a97f-61444454dd9a", "value": "T1BBC41217EED84573DCB507B0A8F703930A39FCA16D74536B7395886E1C722D4A136B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141026, "uuid": "6baf7bfc-d9a9-44fd-be48-a0666169af78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141026, "uuid": "3b778ff6-2307-4bc7-a37c-fa143e21c9cd", "value": "12288:VMrYy90hwSLnAL9r/v4YH7jgG0lJPLYIpbjASRaevRa:hyAburIYH7jgpYW/AdevRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686141026, "uuid": "432647fe-2a48-445d-a3d3-40901dde01f9", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686141026, "uuid": "0a8412ba-2763-4272-ac4e-67fc2e60f08c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141026, "uuid": "2f2f0a68-7250-4816-8847-85455ea530c9", "value": "c5ab4d12f41527f06640b409293c99d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bdddda-0542-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686149542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149542, "uuid": "514df21a-900c-484e-a688-2d248e037250", "comment": "Malware payload (Quakbot)", "value": "c64364b7403495f436c5ba2d6eba7fa1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149542, "uuid": "37fa726f-7d05-4d47-a4a9-8f81d7cc0115", "comment": "Malware payload (Quakbot)", "value": "5a403cdac79a62cb3db13d993941524a2ef9e2c333d89fba62372698370fad52", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149542, "uuid": "52dbcaf8-e060-404a-a781-e1f5dff20b4c", "comment": "Malware payload (Quakbot)", "value": "b1fc62bff808f0115ced1dc20ae73897b9afd117", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149542, "uuid": "b1fec4c3-c4d2-49d1-a9dc-00386a219567", "comment": "Malware payload (Quakbot)", "value": "d39c3c5e297ed38d4a67abe37372c19dae15f1d54bf3277ce025bbb3739e81aee7f239282dc8e9796a68b41e995c0c02", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149542, "uuid": "382462c0-9f80-494c-9db9-f974f4b6bedc", "value": "T189E3D55460C3A4014B9A7F5772B784DAE11E0660C6C54F26E0ACED90A3EEF26D87D4BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149542, "uuid": "db6f2937-0536-4338-a58e-09827ea0786e", "value": "3072:gRzeIwVOOpMRgFAzMeTluFzdYfoJ+v9oh:B6Op/FanTluFzdYf7Sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686149542, "uuid": "694a305b-fe84-480f-80a7-d44682b6d43c", "value": 152707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686149542, "uuid": "8b4ca9e7-f59e-46d5-928e-4a771b86cfcb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149542, "uuid": "baeea2b9-c4f6-4095-9183-92a4b2e13e5b", "value": "Calculation-of-costs-647746213.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e1bbd9-0521-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686135013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686135013, "uuid": "346fb779-2219-4a47-af6a-5aff2e7a9b11", "comment": "Malware payload (RedLineStealer)", "value": "ec46fb043f2e7ee348cd68b7d3237f21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686135013, "uuid": "5305feab-3eb5-49e2-b780-2638f2e0227a", "comment": "Malware payload (RedLineStealer)", "value": "5a6efc81f1a3e1c8266cbacdeaf04ee400dfcc3bc5998c6df13e68ad6f51cdc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686135013, "uuid": "6164e2e7-060a-4718-b06e-8a0cca49e3ff", "comment": "Malware payload (RedLineStealer)", "value": "7e33dc696b2a598ef0a6347f700893e3b5f6a5e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686135013, "uuid": "1736f53f-1a56-4612-94e7-187f05b65418", "comment": "Malware payload (RedLineStealer)", "value": "e17a5691557deb3a0f4e9e395f60a845e05eb3084064a74582d76b010649bd15f46b8cedd8edd589bc6b9180c50c86df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686135013, "uuid": "3a7805ab-a729-47ce-bda6-389faf57e46d", "value": "T1BF84B012A2F16871E57646714E2AC2B466EFF4617F34EBDB1348DA2F0C715E2C972342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686135013, "uuid": "96bd8c9c-0eaf-42a7-8870-aab7bdd17060", "value": "3d0c655c32a535ca28a2093dcc0c4d13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686135013, "uuid": "9fc1970e-d102-4942-bc86-4e9d52fcf886", "value": "6144:PlJY828QW4uSz6johYa9QXA0JMN1KvYikHODhD3+iXaKf:PdzWz6j6YGQX1GDKrkuFrpXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686135013, "uuid": "4697ed42-7145-49bc-bdc6-ad5625e730d9", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686135013, "uuid": "ab735e23-8547-4b6d-ad23-674368085ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686135013, "uuid": "c371ad03-5417-4811-a268-ad076656aebc", "value": "ec46fb043f2e7ee348cd68b7d3237f21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f241b9-051c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686132873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132873, "uuid": "6cc9898d-b87e-4b1b-b33c-d134cb24dfe3", "comment": "Malware payload (Mirai)", "value": "e8c3b11dbdf44a2e019485f22a64c355", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132873, "uuid": "b5a24da9-f918-45ba-a56a-450e5d24e7a8", "comment": "Malware payload (Mirai)", "value": "5a98cec24e72bc56185852143655fd21a5fa00f93770842ef66c635422c799cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132873, "uuid": "ca90170f-a58f-47e1-bdc6-bf3fe5ad1886", "comment": "Malware payload (Mirai)", "value": "4e6c11e373a02b1307955bfe33e31aae20dd407c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132873, "uuid": "665b1afc-469a-43ae-a60a-50aaf02a6c5f", "comment": "Malware payload (Mirai)", "value": "6a26638bb7ed38eb9f3fb30bd0c1c874d656f3cb602e216131774f28dfbf9aad20c1c6173a9b5e0dace2053aea65bfd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132873, "uuid": "180c5e5b-86a0-41c3-9225-6e1af9899cdd", "value": "T171A2E11172632D55E3ED1C3DC9AA835BF9671BFC90F6327679405620C90D24A3E38B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132873, "uuid": "fd492b30-6f76-4a79-850e-32fd734af837", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjHhymdGUop5hZQ:vvQn4j+ZO5fKAlx7s3UozLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132873, "uuid": "352f51fe-03c2-46eb-9c0b-cb4329b2d956", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132873, "uuid": "8799d245-2d81-4755-8695-67e215db7cfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132873, "uuid": "d68f2223-37fb-488b-bc4a-c979cbac328f", "value": "e8c3b11dbdf44a2e019485f22a64c355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1cd296-0555-11ee-b3cf-42010a9c0076", "comment": "Malware payload (FormBook)", "timestamp": 1686157545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157545, "uuid": "1461f0cf-661a-418f-859b-f12cec02b2fe", "comment": "Malware payload (FormBook)", "value": "6af6482eaea904c61ecb47b75658e26c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157545, "uuid": "86785161-2045-45d7-a344-6dc25775e1a1", "comment": "Malware payload (FormBook)", "value": "5aaa7073190a78be5f0cd4545823ab73697b81b7031ebde5c5ed07ee5c874000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157545, "uuid": "2e78c127-8158-4eb5-8843-877de8919779", "comment": "Malware payload (FormBook)", "value": "fca288e592d10ead2adb5af94806b06d208528e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157545, "uuid": "9f50b2d8-edf6-47ed-8448-320c2f554192", "comment": "Malware payload (FormBook)", "value": "91292b8ae04bf403acd3142d7ccb11ca6beb0d477a14ba68410ef5fc4b4555b71fc73d8155a111baee224d88cfa120b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157545, "uuid": "ddb95e91-0ce9-4842-bed2-6f0a365776f7", "value": "T180057C1AB2D1D933D1A3AB345C22CB44A41CBF24192FF9973BDAB95CCB36A423D01D56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157545, "uuid": "166fa7eb-015e-43e2-853e-830e831e37e8", "value": "b994e2b35fac0eca9b95949a165480a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157545, "uuid": "93df80cd-ca5e-4b76-b879-b6ef6ddd35d8", "value": "12288:IEaSIJxsS4ISFSs417nXbaGBazVb8N0K1Wq9:/F0mcSFS77LaG6VIEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686157545, "uuid": "5fbd198f-bc28-43c6-8ba3-aec1aa67d261", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686157545, "uuid": "c3751c79-2f0c-458a-b159-7905b657a385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157545, "uuid": "32916295-ec8e-4100-b224-b5daae93529b", "value": "5aaa7073190a78be5f0cd4545823ab73697b81b7031ebde5c5ed07ee5c874000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475dbefb-04e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686109328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686109328, "uuid": "95a9bb07-908b-480a-86c0-012e1671954c", "comment": "Malware payload", "value": "c48a3beef99cf229c77d9382141897d8", "object_relation": "md5", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686109328, "uuid": "283741a4-7711-4798-ad4a-9fec2362dd82", "comment": "Malware payload", "value": "5b1280ee7a367e40f824d779c603ff222c35148d41c1b5ce1482623c6b1624be", "object_relation": "sha256", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686109328, "uuid": "9de699c8-c8ce-4d08-9bb9-1fda929527ab", "comment": "Malware payload", "value": "61ae8283a656b59eee093ec5b396dfeb2ad9110e", "object_relation": "sha1", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686109328, "uuid": "eb809b34-2508-4b31-8dd1-e232d87f7e00", "comment": "Malware payload", "value": "661fdddb02f428de490df3173a8bec81930a4ab7dbfdf3b3a82b77dfa3aa971faf1746f3c9d3ba2e6e6a233529b492f7", "object_relation": "sha3-384", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686109328, "uuid": "b1675660-3fe1-45dd-97a3-14f6b30d69e3", "value": "T1B956335139CBBA32C2660771217F1B98563EBC206EB0CE4F5359B51C2E32690B3A5F97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686109328, "uuid": "e198a1fa-7c6d-4e7d-93f5-8d9470ccf392", "value": "98304:8WVaC9U6QwAGtzjy3E4BtBn8wD24os7OMcTyU38HtyGA7f0KE2hcUwY69NiTfNNr:Ppp3y3vBtBn8c24lOMcTFM1A7UgdaNij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686109328, "uuid": "0a48a1a3-bb57-4048-9344-66ee4da8ae0b", "value": 6189056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686109328, "uuid": "877853a0-a1b7-4192-b4e8-b4fb01c4ed88", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686109328, "uuid": "951fcd66-ad47-41a9-b98c-b92d8c716dc1", "value": "Bard AI.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e56308-052d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686140303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140303, "uuid": "be93c75e-91d3-4bee-a783-48ed1919aea2", "comment": "Malware payload (AgentTesla)", "value": "42dbfd5096c6e4671ed2af27e6bb99bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140303, "uuid": "fc65bb06-999f-45fc-ae28-629ff12df49e", "comment": "Malware payload (AgentTesla)", "value": "5b8948792a5b2526366ffacb54910d5fb0c9ed456ce1e721d634be6e6f3708d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140303, "uuid": "49b2c3a8-60db-438c-a621-6d5c0e1898e3", "comment": "Malware payload (AgentTesla)", "value": "cadc0f0db266dcdaeb679956ada92844ddee88bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140303, "uuid": "2dbe48d6-165c-407a-9419-827683747ab0", "comment": "Malware payload (AgentTesla)", "value": "9ce3d8292268596e0d0f6e5799628b053b80d1697486b700d87e453d6d2135faf71e88f669c33e61d7b1aafa651f26ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140303, "uuid": "f3aad846-7d61-4533-9a1d-608b927ef841", "value": "T1D3E433BEC5D4B480FF31EBEAA9E408443574D2569C58F325AD4FD22A07582D786923CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140303, "uuid": "7dc3d97c-4e4c-4f13-a314-5b44341bed8a", "value": "12288:5wcpysjF0m4Wn9S/t5vTf4gbkJ2q8wc37MoaThtdeO0hlluCYNFpd4e1TBBSb:ucpyrmdqv74gBq8wuTghj0hlKNFpdp1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140303, "uuid": "29d304d5-8fb7-4a0d-807b-2ab6c16af9fc", "value": 718477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140303, "uuid": "ffb85120-dbff-416a-a76c-522c85ded403", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140303, "uuid": "29706318-a332-440e-84e3-78ebdb4c9ea4", "value": "Amended Order No. 60-230235.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ae1ce9-054d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686154233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686154233, "uuid": "6295d358-16da-4bd1-b5f7-da56fecff186", "comment": "Malware payload (RedLineStealer)", "value": "9374f46c8d46cb0b95e041db569ec1f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686154233, "uuid": "f3a67cd2-cd8c-4ea5-a87d-dc93b826ac2a", "comment": "Malware payload (RedLineStealer)", "value": "5b9e7b70c820e2fb2f447a98ac7fe01d0d8c701f676e9efe7bfb5302e8ea7327", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686154233, "uuid": "4d974b23-3fd9-48aa-9f1a-d0665665c0b6", "comment": "Malware payload (RedLineStealer)", "value": "92849da81cb49122b53b6e95ecbb26072ef2349d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686154233, "uuid": "356b1f2b-4be4-49b4-9f38-0a7597e1ec79", "comment": "Malware payload (RedLineStealer)", "value": "f4a3d3ff9e5aa272e58d327699274c68e84c3d3a12c32fb9aa4bf91bf87d327e032569d0da9d74335506e29ee3eee86a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686154233, "uuid": "359a6444-c89b-4e24-ad0f-01cf85edb372", "value": "T14E25DE9D366075DFC85BC472DEA81D64EB60B47B831B5203A42726EE9E0D89BCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686154233, "uuid": "6fb81781-8442-4730-94aa-ee2aef1e8fde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686154233, "uuid": "d993c6d7-6859-48fc-bdc6-fcc11ed354b8", "value": "12288:XTunKobECuu3C3O32STjl6owrL5PAjEwmfnfa6RmmHXLnWawunLKXau9LaIddisi:WK9ZuyemAxDg6jFo3RV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686154233, "uuid": "bcfff44f-fe91-4070-bcbc-29c8ed7c2d30", "value": 987597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686154233, "uuid": "8781f612-12fc-474b-b742-fbcc75b5c4bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686154233, "uuid": "d4f366aa-b8c2-4493-80c1-8b6e67cc7c30", "value": "5B9E7B70C820E2FB2F447A98AC7FE01D0D8C701F676E9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff58b3e8-051b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686132830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132830, "uuid": "8e2c412f-36d3-4416-9536-735d1eab59e0", "comment": "Malware payload (Mirai)", "value": "27263ba6350fcc076e69a17d501ffd51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132830, "uuid": "46f4f868-ff84-47ae-82fc-5236d207babe", "comment": "Malware payload (Mirai)", "value": "5bbb37c0e7b0a36d0720055560d7b1595f38c7a924cfcb5ca42c50521fa1033a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132830, "uuid": "374ffd0e-e0fd-422c-b527-3ffb8bb30dd5", "comment": "Malware payload (Mirai)", "value": "1db8fc9f9efa2d36355ad3c8703db9d61539c7ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132830, "uuid": "92add784-b174-4813-8f5c-c4adac8888c0", "comment": "Malware payload (Mirai)", "value": "aea74ecc51cc1821afb382cc0f1d3492330e0ec155e68616973093463e1469f4ed1e9899178baff1eb4ed23d0395f4bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132830, "uuid": "f60c5f81-69e2-4a80-ab29-c302a220baab", "value": "T12EA2D025D3456EF4DFAF9DA452C1C2C2B6E546C7278AC8F340FEBF01290A046B788D19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132830, "uuid": "b353df84-b60b-46d3-b145-48e39582f1c9", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5uvM4uVcqgw05VxJR:9RxsSVsMD6xiJJE5zRWNb4uVcqgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132830, "uuid": "85a87564-2b3c-40de-b7c7-c87a4e0fe98d", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132830, "uuid": "6b86967f-d235-4a7b-ba8a-6e7fa09d5940", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132830, "uuid": "8dffaf9e-edbc-4b49-800a-4f604b9d4941", "value": "27263ba6350fcc076e69a17d501ffd51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a1ff14-0547-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686151715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151715, "uuid": "f4ffd393-9b5e-4e32-a7d2-2b984a97a9f4", "comment": "Malware payload", "value": "ae66b5b024e79f8b158bbedecd75f71b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151715, "uuid": "0fef12cd-510a-4b12-a90f-9b0756f3139e", "comment": "Malware payload", "value": "5c3e7bbb06ebb134bed7b1231fdf3139a2052cbe5e8c8418e54237933b51bb4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151715, "uuid": "74915bfb-8ab1-426d-b588-ab8f17a6dbdc", "comment": "Malware payload", "value": "72abf8ea3b82eff3c7da99500afc87670bef9c82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151715, "uuid": "7e0a2c37-a0f3-4d73-8164-262b99c499f0", "comment": "Malware payload", "value": "2052170b20b403989a9d2f38594fb0e6653cde06ad0939e14e469ff063d67fd17373f239c875c8eb33941e752cd75b77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151715, "uuid": "04a69996-0c58-45c9-9b03-a57a3ee5aeb2", "value": "T1DD935C46A2E201C5F9F6C97895B59253EF31FA91AB22C7DF11D0981E4F21BE0BD78321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151715, "uuid": "c0495b95-a77e-4ac5-8d19-8c41d525667b", "value": "0604bb7cb4bb851e2168d5c7d9399087", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151715, "uuid": "61f5a714-4840-4538-9767-a919a0bde2f4", "value": "1536:7ovgCRgYL/h//oJJw5AdPtey2AyWpdsimpxpWXixv6W:74jmJJsKle9A5pdsiypgovl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686151715, "uuid": "0f78e777-c33d-454b-833e-35a661a5b8ed", "value": 90288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686151715, "uuid": "e8c04374-0307-49a4-8c0d-71d0f90042a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151715, "uuid": "c88bc519-ce75-4dec-952d-9fc069d560b5", "value": "SecuriteInfo.com.Heur.20230607145525923795444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e269ef-058c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686180939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686180939, "uuid": "bd5f7757-3ae3-4e11-9be2-0f6dbe8f44da", "comment": "Malware payload (Amadey)", "value": "fdbd54a5ca7f1dce5ee390af45d53a55", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686180939, "uuid": "c2891a10-bd6a-46a0-9c39-a5b3925b4ca8", "comment": "Malware payload (Amadey)", "value": "5c671a7a409c3a6f2d041017fc2a801907248dad36be8041050fae4a6c34a4fd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686180939, "uuid": "c8f6995b-af1e-46c8-a1b2-fd8d44b4a881", "comment": "Malware payload (Amadey)", "value": "52016bbe68eb88a0ff930e5b278e9fa0602d8439", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686180939, "uuid": "b9bcd443-f118-47db-a5c4-bc840327c077", "comment": "Malware payload (Amadey)", "value": "557de00101a830f532a82b07244f14f10c89772055fe8d76cde3baaa61e2e0ec6de305e8667d1567a01669e3f8e06093", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686180939, "uuid": "f4b4cad7-cc3b-4eae-a344-328c3c516d8b", "value": "T1ACF41395F5D89073D9B91B7045F703870B3EBDE129B9821B3A409C5A8CB2BC4A57233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686180939, "uuid": "9937a144-152c-431a-8c7e-336c81de83d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686180939, "uuid": "ad914b01-86cf-4e79-8034-50a779f6fd90", "value": "12288:qMrly90kx+5vyU7xzDJUGP1yxqXNbl/wVHBOb32YWqJ2AIsljZ0zN8S:fytx+Nr7jxP1yxq1ABY4qJ2Azll0ZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686180939, "uuid": "2a503973-00f9-485e-8be6-21164d970e53", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686180939, "uuid": "fd30ae49-9217-4d91-92e9-c0a107e56af8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686180939, "uuid": "97573ef0-1376-494c-95e0-bf472a4e49d6", "value": "5c671a7a409c3a6f2d041017fc2a801907248dad36be8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0a8812-04d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686101795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101795, "uuid": "d4dfc558-9a07-4325-be0b-a0b397595268", "comment": "Malware payload", "value": "6220287f87ff3faca8c13a1e3538992e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101795, "uuid": "e167a2e1-3488-47c9-8878-467942120420", "comment": "Malware payload", "value": "5d81030fa79538850bef6375df9bdaebffd251271a04b984d356de49ac208bfb", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101795, "uuid": "fef07fb7-eeca-489b-bf8c-0d26900f4324", "comment": "Malware payload", "value": "43347dc4b7de70047299a94077d01c8db01573de", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101795, "uuid": "fa5c108e-c6cb-4409-83e1-0740cd019c09", "comment": "Malware payload", "value": "80af350fe7cf259e6addaab56803b2a53a404129d624f0a88c7117f883668a0c4ce7648259d36b13778db9b69993f8ca", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101795, "uuid": "89b7c89c-dd0c-411b-a99e-620f82537c4f", "value": "T1D8C53383B44663B5E80E6C705B6DFCC6911450138FC83B250EE2C5F990FB6F5A2F6A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101795, "uuid": "57bf410a-396b-4593-b944-26f7a0adc1c8", "value": "49152:8+C0sw8Opz8dLYy9H0qIorAj9tXt+krhcnfceKu09BjArM1rqDO4rJunWqo:LCPIpcLY4IorAj9Rt+OhKfcdBjAKWDOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686101795, "uuid": "7044d951-d017-4b45-b24f-f04b27ae1cde", "value": 2603436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686101795, "uuid": "b21d0617-0ca2-4328-b5fa-9c67c9b9f4af", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101795, "uuid": "4c6213e1-73a4-4d21-8ea3-e428b33bcf5c", "value": "snatch.bin.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c497b7-04e7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686110072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686110072, "uuid": "4d9bc539-999c-471b-bc1d-528e760412c0", "comment": "Malware payload", "value": "865f5d2c00bf96b95319d42d007bea2a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686110072, "uuid": "5c197cc3-f9ae-4ac3-b5d3-6593318485eb", "comment": "Malware payload", "value": "5da3df88c52c3ceba281842b431c20d0f35fbcb8739e789fe6fee39bcb0a1443", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686110072, "uuid": "10121e02-8b9b-422b-b45d-c6967e5445c7", "comment": "Malware payload", "value": "b553c2e73d7ab9459e77a00ae5b36b56e13ada22", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686110072, "uuid": "c50cea77-8f55-4cdf-96ad-b400e5790a0e", "comment": "Malware payload", "value": "6cd7dc85ca11a63dbb0c6877324a75f0d3138eca58f052859a3f63e0374f9ab2b1a227708f13af041080b71b646b6c9f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686110072, "uuid": "adaaa049-8910-4f46-b92a-853e12fcd342", "value": "T167E4239EF7E21096CC79A33B9F2D10A10428AA627C1B93D43EE1F9134D6DD8D4E55C3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686110072, "uuid": "0dad43a2-8cc8-4f7d-a8d6-2c21571b1241", "value": "12288:g3F4L16JYy/3lTjrN+PU1MQvq8hut0M2niS2SBKXK0NSDw:g3Fa1PcjrNpMYfct0M2nGeWck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686110072, "uuid": "971f3a24-85bb-48a2-9545-bd780697345c", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686110072, "uuid": "0de61348-cb49-4cad-9b0c-def47819ce61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686110072, "uuid": "b7c5b89a-40a4-4afa-a096-557e964115d4", "value": "865f5d2c00bf96b95319d42d007bea2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ece823-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1686128363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128363, "uuid": "335346a2-3cba-434f-8725-284d1f3ae852", "comment": "Malware payload (NanoCore)", "value": "5857b3931634147a84d0be6e740e75b9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128363, "uuid": "77dbd870-a274-433d-9038-5940e92406ae", "comment": "Malware payload (NanoCore)", "value": "5ddf1289ab0bc93ce442ae80a0ba8b4c25d4dfc78fff12da0f41a691c351aa32", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128363, "uuid": "b0ef5ff3-9227-4f3f-a5e6-5416871359a2", "comment": "Malware payload (NanoCore)", "value": "0dd7a7d801fb2592c31a3f4e28e690b0cd90aba4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128363, "uuid": "5bbbe9a2-348d-44d0-9d37-c609d3bf59cf", "comment": "Malware payload (NanoCore)", "value": "465d03588253ae398eac7882d4e4f481d1182574d5350a7b504fe4a3eb2abe1ce3f2c249c39ef9d0210d53f7fe170520", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128363, "uuid": "5de52887-0018-4c2a-9da3-cd22a44152c1", "value": "T11464CF9C766071DFC82BC9729EA85C68EA50747B931BD213A44312ADAE0D9DBCF144F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128363, "uuid": "1ea4dc95-4076-48bb-ae19-27f9c43dd4b5", "value": "6144:PLwZuR5PhoumebQ9bFyXDa9C02TUQ2qeli+Znwo8wJlspsWl8cCE0Y/lxur:kZuR3NmebQ9b2D372qs78wlK+Y/lxur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128363, "uuid": "55aae565-4714-4add-ba0e-fca08904c0a9", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128363, "uuid": "2d325424-3332-4604-94c2-6e20222f1e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128363, "uuid": "1501bf0b-6ed1-4676-938e-6338292a9ef4", "value": "5857b3931634147a84d0be6e740e75b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27619c2c-055e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686161244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686161244, "uuid": "a29beb09-a1c7-4cb4-b68c-07c0c70a7ec6", "comment": "Malware payload (RedLineStealer)", "value": "567190f15bc9b1ba3b703c48cae6d99b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686161244, "uuid": "d9f22e54-6197-4aaa-a3ec-250ee7805de6", "comment": "Malware payload (RedLineStealer)", "value": "5ece3fc4237fdcf2e32a152379278833c360f1f8d506bbf8f76ee6b052ba76c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686161244, "uuid": "489eb1ef-a502-4b56-b0a0-7d1e2cd1674e", "comment": "Malware payload (RedLineStealer)", "value": "1499381e44ba42488fbf638e1d28626c013ca698", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686161244, "uuid": "447fcf43-1b8e-463e-8d4e-d81634be1207", "comment": "Malware payload (RedLineStealer)", "value": "f30d093e7d28a9c0b569dea7f0116f2a795b1f0a7d94f24c36a939a446eae735b17e6fd8fc9e33f1fd60fb2156bec79e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686161244, "uuid": "1aab5868-1598-4c0d-a53f-5963798e2cd1", "value": "T13BC41246A6D98072D8A5677009FB03430B37FCA05A3C475B3B499A5E1DB3B94E932377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686161244, "uuid": "4a7a9ff7-289d-4646-83e8-e9d03a1a2732", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686161244, "uuid": "9378b10b-9d41-4259-8b50-d110b642c693", "value": "12288:nMr+y90ErJ0v+IAi5Hy6N1vhU85wS62XkFMpFxd9e:tyBJ0WxwPhU86S6RMpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686161244, "uuid": "b303f250-66b9-4e6d-a965-4ba3c16389ef", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686161244, "uuid": "ff3d7f77-247f-4c30-8393-1e9ec698ce1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686161244, "uuid": "194014be-f917-4ed5-878e-14f7404677fc", "value": "567190f15bc9b1ba3b703c48cae6d99b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da390122-0529-11ee-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1686138780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138780, "uuid": "9e527492-48e2-4906-a2bd-e680d423968a", "comment": "Malware payload (zgRAT)", "value": "0a9b2470258f89eb8b31bc53d32b1d05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138780, "uuid": "4cf93e75-c206-494e-92b1-d4afbf4ae77b", "comment": "Malware payload (zgRAT)", "value": "5f2a6e445a1fdbd5bdcb58865c26b08a839e233b9ae6ba7963f00721c47d2721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138780, "uuid": "a03df85a-f3eb-4af9-baec-bf5a4b544a3b", "comment": "Malware payload (zgRAT)", "value": "9ccd73cd75ad958dfaa2920c9c961ff462023ed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138780, "uuid": "165e0dec-f5d0-45f3-81fb-62a506981273", "comment": "Malware payload (zgRAT)", "value": "7e76595417163de30c6d2ff89df15fd16affd34e21136defd24df76d3792b55d6b6bb430b459c562147c07116a65f09f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138780, "uuid": "518c189c-c047-4376-94d7-f13aaf342291", "value": "T15774F105BBE7851BC59919B9D0D3402407F2E3833673DB8F3CC582820A16BD75AE97DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138780, "uuid": "75e876c1-f13c-4743-99cf-ad0b1410a17b", "value": "6144:9Wn3d8gXU5GEXZtV27w1k4eDiFJKykOhmcvUEy1oe8pw6goMXen4:+3TXBmtV+w24e+PNkOhmcMEykbMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686138780, "uuid": "ab0d3b88-0591-4be7-a598-8da74eadd81d", "value": 364104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686138780, "uuid": "8fc1f451-a33d-4ae2-b175-bfec8dd1867e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138780, "uuid": "c9a91eb7-82d4-4a26-84b7-d4adbf54572f", "value": "5f2a6e445a1fdbd5bdcb58865c26b08a839e233b9ae6ba7963f00721c47d2721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af68a3b-0525-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686136956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136956, "uuid": "03334531-205e-4f15-b78a-05a36c13766a", "comment": "Malware payload (AgentTesla)", "value": "5f7188fae3ece6c200d0742f1fffcbee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136956, "uuid": "19fba01b-8684-4653-80f9-c86d65c37702", "comment": "Malware payload (AgentTesla)", "value": "5fcfdd1656b83d9d0d5e804ca127c129f1581a86897ba5baa98c14c8789b8f06", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136956, "uuid": "5e7accd1-003d-4164-9440-3f70d625c015", "comment": "Malware payload (AgentTesla)", "value": "45f80bb4be0caf18dc6bf065006e2ee9166aafc0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136956, "uuid": "e656f356-93f6-416b-a223-b1589df68aff", "comment": "Malware payload (AgentTesla)", "value": "51f92d5eaddc6975d9247aded1e986e1cd0f9d7e39ad423a696beaa24eb6382648b1d7ca1dc896ca66de4babb208bac9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136956, "uuid": "862c8345-2ff8-4b66-889e-ba5aad3fafc1", "value": "T15B1533582191BF28CF41B4D7A72514D6CA6B05FC94BA403C3CEFE225F2A667240B7BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136956, "uuid": "05a78365-3622-40f3-9acb-ff0c7ed35c34", "value": "24576:kZQJ76tQ1xzT7/cqS4DzJ1Y2rFaUK6OblQrxVtdJecZi6/AKDrGyw:kZLt+zT7kavJ1RiUzdnH9HGyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686136956, "uuid": "d8a6d01d-f810-4148-8654-9968b1c21fb3", "value": 939372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686136956, "uuid": "4004c2bf-4173-4df2-8637-72af899f32b1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136956, "uuid": "97f0401e-1913-4473-8182-dcc51b1d8ccd", "value": "Oferta-CTHU- Equipamiento.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8420ef0-0547-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686151716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151716, "uuid": "bcc8f31e-98fe-456a-bf29-13e261d2a176", "comment": "Malware payload", "value": "88e1c19b978436258f7c938013408a8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151716, "uuid": "4b6f8d03-66cb-4c39-9241-b7d35a8db4a4", "comment": "Malware payload", "value": "6110bfa44667405179c3e15e12af1b62037e447ed59b054b19042032995e6c7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151716, "uuid": "b95601c4-97c0-4a64-9d0b-8e3ff8142d7b", "comment": "Malware payload", "value": "09b77c8c85757e11667a7b83231598dd67fe0b8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151716, "uuid": "86c770e4-0f71-4133-a802-484573c3a45c", "comment": "Malware payload", "value": "9b962ac402ed6d0296ed3e920f2903cd82aa462278efb8a1f31e96e67760e569dea269e8533d100c6cdd9683d24d056c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151716, "uuid": "8fbd2976-9b16-4260-b917-356ce04fcc23", "value": "T13E23C703F64251BBC568C27083AED3526E22FCC66354FADF829FF7952885F42DB1A509", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151716, "uuid": "76c893fa-08c6-4936-a40c-e4834eb7c05b", "value": "0b649f8e17494bb31b47f6e959a1769c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151716, "uuid": "91278288-8840-4630-ad12-d79165cd812c", "value": "768:itSVluu2agCfRSB3QEw2VWHxWYuaO6JXtltdUUwhqWB8TicI:bUZWECHxWDABdIyTic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686151716, "uuid": "62dd1eb3-c2cf-4cb2-a830-64e0d41e1abc", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686151716, "uuid": "fd50d47a-772c-48c6-abe7-f3a16dd6e5c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151716, "uuid": "88fd4f39-e756-448b-9b4d-318ff253bed2", "value": "SecuriteInfo.com.HEUR.32078.19672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab884c0-055c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686160498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160498, "uuid": "10029bc2-c0d3-4c35-a4b6-aee82a49417f", "comment": "Malware payload", "value": "972145d3a9f7d0c036ff104f9ebb2ed4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160498, "uuid": "2b667add-732e-4f08-85c3-4ef867767bd4", "comment": "Malware payload", "value": "6184d03f97b181a2e2ffa02edcb07d2ca4924b73352b1ea6be251265dfa26a1a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160498, "uuid": "ac709db8-793d-43b4-9867-4450f5090989", "comment": "Malware payload", "value": "aaec8ed82f418f4b734c21f7b66d17806d2fe9b9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160498, "uuid": "d4274e62-65d5-4898-ab93-c5d1e58dc33c", "comment": "Malware payload", "value": "12d558b87c5d3049797243fe071bf5e67af2ac22bc1e329fff4e8587c3a33664f4a6805b6d330fbfee2fd9e6d6ed8e6a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160498, "uuid": "4ae0d602-ffca-417c-a55e-57c5a8444be9", "value": "T1DAA35B41B5C0C4B1D6BE493E1824CAB49B3E7A70DEA09D6B3758077E4E302D2DE35E66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160498, "uuid": "234f22b3-3d96-41b2-af6f-468c7039966a", "value": "6c2e0f02de28ab24c664229b8c5a8765", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160498, "uuid": "be9bfee6-1f66-423d-864b-e77f304901cf", "value": "1536:N+LFV9m+8FtxNCwIwLRT7j5T5i+emfrDGNZgMvwsWfxLcdrqsUPyY+2/aqvps:N+xm+qNCw9RT7j5zGNuBarq1PyYL/as", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686160498, "uuid": "0e2d09b7-098c-4e83-ae57-7ab8c8467f27", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686160498, "uuid": "04f223a9-a82d-426f-bc40-82d12904babf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160498, "uuid": "fcfeff44-fd10-4e71-ae24-72ac7bd4561e", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bab5075-0569-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686165948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165948, "uuid": "de17f596-df2a-426d-80e1-840810b99988", "comment": "Malware payload (Amadey)", "value": "20e3f5f287471b86a8f91fae08527821", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165948, "uuid": "4981312e-9322-4c8f-9651-253cc14c8228", "comment": "Malware payload (Amadey)", "value": "619643c86a3aca0d37a3546dcd88b7b38ff6a8d51da379f209dfe69476758664", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165948, "uuid": "fbb1c242-1ace-4877-8f72-e9f9f3949b26", "comment": "Malware payload (Amadey)", "value": "2168f6f934e32e41f661fa670ffce90504e04364", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165948, "uuid": "260463c3-8f15-4f09-a969-f0353b4e2826", "comment": "Malware payload (Amadey)", "value": "801d240c482a2e05f7fcd502fcd8995f9bd21aaf4f7336e5b33ed049d17470452aac0262742a0e46c768f158fcd0f0d9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165948, "uuid": "30801f78-7bf9-4415-ac77-48672795031d", "value": "T168C41283AFDC9473E9B657B01CFA03830A36BD928E65871B3645AC5E0CB2A547974373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165948, "uuid": "55b40269-31ec-4c17-b88a-4b5e3af79345", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165948, "uuid": "6a82e606-1037-4ea3-bb17-13c3b8ec7887", "value": "12288:jMrcy90M7mQ4oFGALBxsbspNyzRjGsWtRYLD:ryc2GgxsYz4RYgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686165948, "uuid": "83919b68-aa4f-49c9-87cb-e5cd7af7f6b0", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686165948, "uuid": "605c8144-bfb1-4ee1-b912-c13c5b4b890b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165948, "uuid": "966b04c5-06a3-4ae7-a247-8c660fc77010", "value": "619643c86a3aca0d37a3546dcd88b7b38ff6a8d51da37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca3d388-0529-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686138489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138489, "uuid": "411a62e2-a8cc-413b-bf0e-a4f09aeee93d", "comment": "Malware payload (AgentTesla)", "value": "15ff9955368f9c4b2e5042bcccf84331", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138489, "uuid": "a978df1f-0fa2-4706-b01f-d8927cf93731", "comment": "Malware payload (AgentTesla)", "value": "61c75c0d5321db299e58bf919860e9afa4471e4e97dddd00fad6a761cdd0a61e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138489, "uuid": "1e9b3c9c-0dd4-423b-8481-54f5d45e8c55", "comment": "Malware payload (AgentTesla)", "value": "42243d2d6cf54f11021262cf46346088d33e602b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138489, "uuid": "0618030a-512f-4e69-bf0b-ffa5646a7f90", "comment": "Malware payload (AgentTesla)", "value": "98e2e67d565967b6b68fc171a11feb8b16e5fe1f7bda901e768ab9055234d3a6ffebfe1726021dfe46ef85525844bb12", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138489, "uuid": "254e5050-152a-4568-8777-163329c946e7", "value": "T1C425021477FE4F1AD8796FF80910513483F6662A247BE2195EC369EF6DA0FC04E80A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138489, "uuid": "008297e3-037a-4546-9531-ad734b1ee108", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138489, "uuid": "af6fe289-4eb4-43e0-b96c-27a6daae135e", "value": "24576:ryr5/47m5E+8sFDi0HSLwQ12g0Wli4xj:ryr5/4sFjSR2g0WM4xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686138489, "uuid": "4fd838ca-4911-4aa8-b749-e99ee7872001", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686138489, "uuid": "949e173c-b932-4a6c-8436-3fe1d4076b74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138489, "uuid": "96a24da6-bafe-4d0a-8390-86771fa2bfbf", "value": "QiHu2b7HMHafiPp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246da16a-0523-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686135898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686135898, "uuid": "3eee0ec7-6225-4f56-aa95-ac70b0969a4b", "comment": "Malware payload (AgentTesla)", "value": "4c6ad4d360176c63d6da4b643c3e3c09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686135898, "uuid": "1d82f4e4-ae34-470b-b065-196d0dbedb85", "comment": "Malware payload (AgentTesla)", "value": "61dd3e9007dac2b0144139dbe2a980c5e8335a3d0a730548d0b9c30d80b1a3c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686135898, "uuid": "4f51b7c1-a557-44e0-976d-d4026cec11a9", "comment": "Malware payload (AgentTesla)", "value": "a52e29ce7f726e8ed690d4c08d8a201876f64c3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686135898, "uuid": "4264d704-f92b-42f4-8ade-81a712e0bc76", "comment": "Malware payload (AgentTesla)", "value": "da8c63e323bf2a1a32be1460882358bc2f258a4260c07bae2a1537b0cd211777fa71964d635ce0f5df51f29166b44358", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686135898, "uuid": "a07b61c8-a41b-4937-b518-bab489c3e45c", "value": "T17ED423738BA268C3E0D12E0C158DF3EE34BD86914453D5C251A3EBE76B9A6709F72C91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686135898, "uuid": "cb958991-c16b-4750-8899-40cf3dfae688", "value": "12288:wAH0+n6+jMoTn6FQckLAlhWy08lX20W3dC1UGEvCE:wA7nNTKKKWy08lXSCbEvCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686135898, "uuid": "05d126cd-af91-4838-a359-049175a4630d", "value": 621649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686135898, "uuid": "8da34224-6559-45db-bfef-883e08197348", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686135898, "uuid": "239597e7-2f18-4bda-9c2a-c7cc8660c92d", "value": "SHIPPING DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f977544e-0547-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686151718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151718, "uuid": "e7d5548d-5de9-425f-8b8d-c4e16ebaa844", "comment": "Malware payload", "value": "1cb0efd60883b5637b31bf46c34ae199", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151718, "uuid": "37abd38f-3723-456a-b471-e276c8b2a553", "comment": "Malware payload", "value": "625ffdd95bfabff32d0e8a95beabcd303c01c8bba73b90402d4e84d6e15dd8e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151718, "uuid": "7aca22a9-30d5-4bc7-ab24-b1e28d094eb0", "comment": "Malware payload", "value": "b91de8d5f072f8c6aabd029d96568effdd5662d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151718, "uuid": "aaec5fd3-fea0-47f4-a2c7-bb72b06349f6", "comment": "Malware payload", "value": "3dd281cb66fa4e3ffcd950addcbed52e38e7868c68398b44177462aa0bc5463c3f25d12d09c1ac14cd0e5ccf1a3323f9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151718, "uuid": "f7555b37-3e38-4272-bf37-2ee8aac015e2", "value": "T14D133B8AE793C0B2C87E8AF0225FF7E619281570F945C6CBD7D41D6C7C569B30839A86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151718, "uuid": "2dca04c2-9723-4ce5-979c-12d2b53970bf", "value": "a8e7995c1f834b606568ac0eb04eba9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151718, "uuid": "921cb895-6816-4177-965e-a7de75aba538", "value": "768:/BD4bCa+EfZ9+EwleNwYLWKkR9c5s1R2wdRt7JtXwxwprTKkimOyd:/BD4bCofZ8VYwYyKkR9c542wdRQ0TKkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686151718, "uuid": "8a094821-9cac-40fc-944a-8817f28c1911", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686151718, "uuid": "62320320-4ba5-411c-84a9-0c240ed4cf1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151718, "uuid": "09a04ad0-ed6e-44d9-9bd3-8d781da0769b", "value": "SecuriteInfo.com.HEUR.1067.9111", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876981a2-057e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686175149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175149, "uuid": "8a6a5020-4e69-4ea1-8e1f-b374c96ab720", "comment": "Malware payload", "value": "aa727e598ba7c5a947124cd5fd93ed6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175149, "uuid": "aa334f76-a293-4c54-8e64-90a1a3a3343e", "comment": "Malware payload", "value": "62a2221333631de6cf65db3fa3e2650947b23f24ea172a3ea998d77baa0cb270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175149, "uuid": "223a7720-2a7e-4e2d-a74b-f14c0ccec20a", "comment": "Malware payload", "value": "0de18ccace13691011506ddaad4ab72a2731bce3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175149, "uuid": "6da03c18-63a5-4eda-829d-4f44dc3a2b59", "comment": "Malware payload", "value": "48798d572ec88764a89269a2c6d1aedd70bd8de86b77e9a03baf366da074789bc8062abe29b9124664f8f0e488f4217a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686175149, "uuid": "09917c15-4a59-47f7-a17a-eb3ef8d02c36", "value": "T12574BF0362E17E61E5E646729E2EC6F8662FF5E0CF7CA65B32064A2F04723B1C563311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686175149, "uuid": "eee85a41-1de3-4c1b-8868-15397a13d67e", "value": "ed6a070bf0eed3feda93e1f7e2ff5c98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686175149, "uuid": "6eef3eb4-dc15-4442-8856-4896dc5f4de9", "value": "6144:JvYd3tEPMde9vknpuXdSovd4OUHtDtUP:Jv8ckUXdpdCNDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686175149, "uuid": "7683de7f-6177-4998-9705-e140c851e8d8", "value": 340480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686175149, "uuid": "16fac69d-c24b-4635-8f95-d62f73590750", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686175149, "uuid": "dad66f1a-0c8a-4e2f-9d38-ff99a97437fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751e04e1-057b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686173829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686173829, "uuid": "d23918f0-4e53-4dd4-9399-ee02125770b6", "comment": "Malware payload", "value": "22d5650cfad7fc8e449955c10296654d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686173829, "uuid": "abfd88a5-5fab-4f52-aedd-796a9e248877", "comment": "Malware payload", "value": "6402b1db860c51283776ff3476245f8ee38b9dca669eb005dc6d84f00a833ca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686173829, "uuid": "b5bd12d3-0484-4ddb-8e6b-59fd91bcf775", "comment": "Malware payload", "value": "89905da40c943317d2e4b1ca2169c2d1226974b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686173829, "uuid": "1bc169c3-3656-419b-9699-59bbe692be34", "comment": "Malware payload", "value": "932ae96738dc3639948e49f862378e2869a0f1aa200d49629b6ce76a6a90bdab41db9c203a14f73a8ea67910e2258e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686173829, "uuid": "1d476fe9-a8cb-4407-be6a-579ad2e12472", "value": "T16E26337F64BC3991F6039D3B030ECFA79D2E97958CC09AE61B7292E611DE41986E704C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686173829, "uuid": "9cca5739-8c72-4159-9d12-d4ed94c692e8", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686173829, "uuid": "a39247eb-6f9b-47cb-9322-393032489b19", "value": "98304:VQUDP5N/+fYS36RnB3mjr2GtSdQ9to8HnwbaRWZu:bP5Nmfw3WBKQ9to8QWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686173829, "uuid": "9eb9a167-0d0f-46d5-903f-3b8381ab2119", "value": 4533536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686173829, "uuid": "ce91f3b5-a60e-4903-bf5c-bfc89bf2c09d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686173829, "uuid": "ae92d162-db07-4235-92f2-dbad2b942086", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef09ca9-04ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686112804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686112804, "uuid": "afe730cb-bb58-414f-b8a0-e25d10482b16", "comment": "Malware payload (AveMariaRAT)", "value": "9cd5f46e90da02f0412c71ef8e02b5a2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686112804, "uuid": "d5355bfd-7292-4256-8655-5fa8b3dca8a3", "comment": "Malware payload (AveMariaRAT)", "value": "6472ba0968eac5173f6171210e9f29d592b902e1d64800f34a09e5aa1641a98f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686112804, "uuid": "ed13d80d-781b-41c4-b551-3cf71af26dad", "comment": "Malware payload (AveMariaRAT)", "value": "0c69ab2582ed674102c4d1244c6908c9c8d3ca62", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686112804, "uuid": "41e447df-9d8c-44e4-8875-d3ba02fb876a", "comment": "Malware payload (AveMariaRAT)", "value": "44f48633ff7c27b737e5cc4fc3769b0d722166c0b46f7680662af846e954cd639e8963312efa022efcfca0103d264935", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686112804, "uuid": "81c94638-f952-4e88-88db-6dd00e988dae", "value": "T1761523807A6DAD2216524B8E71AAD844FAA7F11E8122352134FF7535C7FFE490D8E873", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686112804, "uuid": "16f43c29-84bf-46c5-a8a3-3424e1348c1e", "value": "24576:e+/IoTi+QDkLjNvZV0kcxVR2MtCyMBCnrLhx:z/IoMDkdRV0keR/gyMB6Zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686112804, "uuid": "9c6c15c9-a09e-4bbf-8c4a-87679fe9c362", "value": 919081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686112804, "uuid": "2487dd77-8a3f-4de0-9de0-8f8f57c7913a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686112804, "uuid": "0b9484e5-4b4d-400a-a322-e023319a609d", "value": "Quote_JUN75698-LD8972390.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15238044-051c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686132866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132866, "uuid": "439d80d1-0c43-4fe5-98b9-63dbc153224e", "comment": "Malware payload (Mirai)", "value": "7fc980a6e2d5e36491d2ea7dfc8ae7bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132866, "uuid": "03b201bf-9040-46c6-afab-ff5de7902973", "comment": "Malware payload (Mirai)", "value": "64eb191307286c997a5e3d136a94bdbac039a4e45d150f1f4eefa5239d9cfb15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132866, "uuid": "cd3f875c-1633-4c94-bd88-28ec31308e63", "comment": "Malware payload (Mirai)", "value": "4bb8a00f31f5fb90aa63e27bd155fdbe070374e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132866, "uuid": "51ba741d-4e96-49cf-911a-67705b5b3b2a", "comment": "Malware payload (Mirai)", "value": "d365ff9604504e79b7178ee555521deaa7211cdf7822b13411579146e22373d6ba410b61de75d3762ff5422562116b4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132866, "uuid": "b376bff4-56be-4764-aa83-82d55fdd8a0a", "value": "T195336C36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132866, "uuid": "7411146a-0b26-4b4a-b776-80cc78cdf4f4", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132866, "uuid": "fa9b910c-5e17-4717-bb7f-cf0aa681b7c8", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132866, "uuid": "db00862f-558a-43b0-b7ee-9001b042f6aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132866, "uuid": "8b342912-14d4-42e2-ae29-524e2aef3b59", "value": "7fc980a6e2d5e36491d2ea7dfc8ae7bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b907c9a-0518-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686131213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131213, "uuid": "71973a86-f88f-41f1-bda2-72d4ef7f2942", "comment": "Malware payload (Formbook)", "value": "fdb52da6cf766fb4f0c56d3dac749faa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131213, "uuid": "6819b53f-c16c-41b0-86ed-a47832b13e6d", "comment": "Malware payload (Formbook)", "value": "6504563c0b530d8886ebe893983491e046949b70117d41c9baff7e8503e202dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131213, "uuid": "1b944831-7c33-44c1-a5ae-c6abb5d9e526", "comment": "Malware payload (Formbook)", "value": "32c1e7f2ac0506025ceafd8465fb5be2c61590bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131213, "uuid": "2df53674-8e3b-4e11-8e69-9d6a36163c70", "comment": "Malware payload (Formbook)", "value": "228a0ed9828ddf891407f67a24fcadf5b5aae494c4c29a333015eed98f7616f99b6974781fb04a74d374f845463eb8e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131213, "uuid": "c68c45bf-0602-4d8a-aa8b-f7a1f91f7b36", "value": "T11005E06C33A235EEC95BE9B95D500D74EAB0296B331BC6479193549EDE0CA9FCF100A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131213, "uuid": "63c88d4c-0232-49c0-ae2c-f49082358250", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131213, "uuid": "5e266a33-95e4-4f6c-ac95-757420fbbfe2", "value": "12288:6ZyvbhaDnLMzIL2q+RTdOL8er5TXnrd2Bh5qj4lPucRd3nX88+c7vWbtNr9/2DIY:3OyqGUL8CTXSPuc7Xs7J/y2B/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686131213, "uuid": "b14ddefa-bbbd-4110-9688-4c95d3b26768", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686131213, "uuid": "10d4e0df-85d3-490f-8da4-b2379b3fb9d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131213, "uuid": "efc880f6-6c92-42b1-8788-8d415c978679", "value": "SVD002837727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6116c324-052a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686139007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139007, "uuid": "22555162-ad1e-48e5-b51e-0f62ed25b1d7", "comment": "Malware payload", "value": "1c3b2b03d64943a5d15ca78b01045208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139007, "uuid": "40e7ffdf-2a5c-40cd-a113-1ff391f943f6", "comment": "Malware payload", "value": "65ac3e80b5d7499316fa680cb138aa9e4038f0b107aec3371cf7d7c5c24fd6f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139007, "uuid": "e7e9ec9b-c03f-4f24-bc47-dae64ec96a8e", "comment": "Malware payload", "value": "cd7ac7fd54568c97f8c2e79c0f11d5895e4cc009", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139007, "uuid": "73e3bdd1-0792-499c-90f9-22ee1111a2ef", "comment": "Malware payload", "value": "3a17f4db043a74ce81f0f1ebbe6a0f80f41e04111ab820137660f278807ce82ff14e3ee15b3b56449cf8e1d7dd48fc22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139007, "uuid": "2dd97c13-ecc9-46e5-b45f-a890f15ed89d", "value": "T1E6E4DF09A3B84F11CAB55BFD0D63C5C507F95A29AC39D9304DC724CEA9B2F0E1984A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139007, "uuid": "1ad4ac23-5c48-403c-9db0-cba3cbbaba2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139007, "uuid": "bed27811-e1a0-4ddd-8dbe-80063bc92af7", "value": "12288:Y0M3Cwhh2Y4YY3PBeVBaOH1DZ5HSHeCd029n0Ha6JpMUqeh2ihzeO0xUtjNEMehb:YH3Cwhh23PBeV7gHHdL9n56Jpzqk2ihc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139007, "uuid": "455e3fcd-7438-4214-983b-06f1788cc26f", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139007, "uuid": "8362d43d-f617-43bb-91b1-590cc950a1dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139007, "uuid": "51b178e7-3722-4b88-b13f-eceb9b987fee", "value": "65ac3e80b5d7499316fa680cb138aa9e4038f0b107aec3371cf7d7c5c24fd6f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1f1f9c-0543-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686149628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149628, "uuid": "26797d09-5e30-4b57-bf4d-74d00cb8d40a", "comment": "Malware payload (AgentTesla)", "value": "9fcffa011884c89f90995a7f21402bf7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149628, "uuid": "d6d71075-ddfc-4a50-86bc-7cc84f0edf42", "comment": "Malware payload (AgentTesla)", "value": "65ca0cf06f609752a0a82f476294bdadf4a849aa8b466495146558a6cee427c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149628, "uuid": "cd2725d7-e717-432f-b5b5-5815747a9ac6", "comment": "Malware payload (AgentTesla)", "value": "ebd6c0e2fcb367efe68dd522654a733862e04985", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149628, "uuid": "4bd2fb72-5cf4-411f-9fdc-19bdf219f389", "comment": "Malware payload (AgentTesla)", "value": "092f97b53f461e3843647c3f96911f5fc2b2dc51014d48d5a58ee596d17a66689820060a96e309c2a9e4f93f0b0c0360", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149628, "uuid": "48760cbf-fda1-435a-987e-aeb0c13afd78", "value": "T109B4231AF06F0C1AD249EDACFF990082A1F4F74409FC8A7FE748690A35B925F6D95208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149628, "uuid": "c239570b-4881-41fe-b2bf-35835ef98076", "value": "12288:SPpnUKAmTsflOz6eJlY8F3WeJcJ2j0ODWAg2q:4lmlO28lY8dLpj0LB2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686149628, "uuid": "b2d7354c-56b1-439f-9eb6-d1f7c558672c", "value": 493935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686149628, "uuid": "c73d297b-0b14-4968-9bcf-ab8af6839afe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149628, "uuid": "a906148a-cbda-480e-9b9c-9f5b4f817dea", "value": "PAYMENT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75019bd6-052a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686139040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139040, "uuid": "74dcf87b-6499-4431-a1d3-289e0835174c", "comment": "Malware payload (Formbook)", "value": "fe8067b0d62f4983ca5bcb6c043ef425", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139040, "uuid": "056429f0-ecd9-4bee-bab6-5c303295ccfa", "comment": "Malware payload (Formbook)", "value": "675aac29b1264adca30ec51d229d745b92bc2a520156497f9b6d7dea4709e7ba", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139040, "uuid": "674e67e8-6ac7-4a52-9682-f970eb1d9be2", "comment": "Malware payload (Formbook)", "value": "811172536e04a0929f4ec651a70afc288dc406ef", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139040, "uuid": "651fc21b-9386-48b1-8a43-63ac1bafe620", "comment": "Malware payload (Formbook)", "value": "6eda198eaad5582b03fb4457cc2d08f7a407753fd4d1e98df7f60b9a7a38b4459f6e002aee75ce8f00508e9558cbb8e6", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139040, "uuid": "60fd0c34-ac1d-4bcc-850a-538ad078d6df", "value": "T17FB423BB8385DFD08C9D488505EAEDC976703FF2445EC2BC29BD11543228236BBB6E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139040, "uuid": "627363b7-66cc-44f4-b440-3b93b83e8e25", "value": "12288:s3pTOBTtNxSkZYCrBsvZKQM9cQPN0Zo5Tb/LPJsFZPycswVUKHx:KxQZpZNKIVN0ZUTb/L6FZySUKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139040, "uuid": "bda25c2b-70f9-4fff-b265-e4eb0fbd4a6b", "value": 529062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139040, "uuid": "7e803014-d3ab-4e5f-a92f-aceed98f44bf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139040, "uuid": "0ab51b1a-4e6d-4c7d-8e07-392da7fc0891", "value": "proforma invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816e1a45-054c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686153664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686153664, "uuid": "964b6c72-07f9-4925-8a8b-95f3f7e0004d", "comment": "Malware payload (AsyncRAT)", "value": "543d32361abc0a522400d41716bc3739", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686153664, "uuid": "9c3a71bc-ef2b-41c2-98b3-5e32316a80c4", "comment": "Malware payload (AsyncRAT)", "value": "67905601c2fc9f78274058e39de8c2714f46b40cfd29e5d5a06117fc7d07ab46", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686153664, "uuid": "14e5a6ac-de16-48f6-aa49-9dfc31ef0912", "comment": "Malware payload (AsyncRAT)", "value": "e0d4651d92c272e61b225067628c9b55549db26e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686153664, "uuid": "2131b0b8-4f68-47ed-ab85-ba858a0d5b83", "comment": "Malware payload (AsyncRAT)", "value": "60628be144c4c41971ef80a60946ec29143ea7d4b263323a0343430c8193363f61d83956ee5918cde4de4e26512737a9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686153664, "uuid": "05d0c851-99c4-4b48-ae50-6d979b5754d0", "value": "T15B232B003BE9C12BF2BE4F789DF26145867AF5633A02D68D1CC411DB5713BC69A126FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686153664, "uuid": "cb676b76-4f2a-4e66-81c0-6f9ed308a705", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686153664, "uuid": "6f74a38b-3221-4ca5-841c-7ea352eb75a3", "value": "768:bu0OVTBRlc6nWUbmelmo2qjZzjqfaKPIbejbTgX3iUxTL/vH8WUTiM1bBBDZrx:bu0OVTBnck2A5bSbMXSU1bKTVdrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686153664, "uuid": "848d8079-2747-467f-92c3-db2c71b39e67", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686153664, "uuid": "c269475d-519b-4813-9ace-eef25ca30b93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686153664, "uuid": "3d379ad6-369b-407f-85c9-6ba83ad5302e", "value": "bNqt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94734437-055a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686159709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159709, "uuid": "80b84f00-257d-4820-805f-4f8a376780ec", "comment": "Malware payload (AgentTesla)", "value": "a1c3e77b4a4e1ae19f714313c5a8ff89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159709, "uuid": "26a28391-b420-4e24-bf4a-4e91d409847c", "comment": "Malware payload (AgentTesla)", "value": "680a61a7bf8b1ced438bba64098482455b8a503e0a35315bf6c9490d3311e9b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159709, "uuid": "31c3ff1e-dda4-46e7-9510-c6b67bad91ed", "comment": "Malware payload (AgentTesla)", "value": "1ba21f986566e23b29831e00fc5a648d28f2065c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159709, "uuid": "acd5fdb1-7a28-4628-b1ae-6a089ed94311", "comment": "Malware payload (AgentTesla)", "value": "dee4f741131f68ef2d18d616155b9f8cc4d8e4e6d949dee882a1e1ed260df2196d9036f72f06f23ca6bf4ee2200e8ddb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159709, "uuid": "92ecf3d5-25ca-4e44-afd2-c75256be28e8", "value": "T1D015E060AAE8DACDD4250BF0E1D3D4F00B265D24E5EDEA570EDB2CDF31B6A44216253B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159709, "uuid": "27c9d0c5-0c34-4340-aa2a-b441ed1e34c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159709, "uuid": "b1127362-84f1-470a-99ad-8ac22517220a", "value": "12288:k2iNfUFotEvZ415CylQTYJ8aJ3yfC3hWcXPwH/NnYJR3Q+mIHJASbVd9poJZ:k1Bs0qZ4PzysVj3QmBJR3QARbVd9pof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686159709, "uuid": "7a37b696-5394-49b7-8bf2-993be4fd4318", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686159709, "uuid": "c49cd55e-eeb3-4f5c-b66c-efd1652f6bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159709, "uuid": "fd3d9066-eec7-4ebb-b7f4-cb6255dfb26b", "value": "680a61a7bf8b1ced438bba64098482455b8a503e0a35315bf6c9490d3311e9b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81525f5-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686128415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128415, "uuid": "77f82527-ed94-4f61-80cb-941d9fa4a958", "comment": "Malware payload (RedLineStealer)", "value": "a41b0dc8725c57331cb5eb9ecbce85fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128415, "uuid": "52be298c-c466-4eb8-b2f8-0bf7a4a3d00d", "comment": "Malware payload (RedLineStealer)", "value": "686f3a308b3c447b70ff507c31368caacbbad9d8251c6d26aff62d7efbe1ccfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128415, "uuid": "a3e5d6d6-acbd-4ddd-9b5d-91e6f8e9949b", "comment": "Malware payload (RedLineStealer)", "value": "42266ae4516a78d7c6eefab4b2b7bf672050c07c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128415, "uuid": "b7327032-fe96-4a27-ad89-83311fadf459", "comment": "Malware payload (RedLineStealer)", "value": "1abc7cccb5846820b8dc627039951de0ded0b001d5cb6bcc698ec682ef3b2cb48ebf9319944edd80b7e6f8652b57c8e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128415, "uuid": "87d6057f-edc1-4445-80b8-cc6ace56c40a", "value": "T17184B002E3E1A871E566467D4E2EC2F466AFF4617F64E7D727086A2F09F11E1C932342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128415, "uuid": "c1e514c4-e9c6-4ec6-a82a-fba9afd4b2ed", "value": "64e105a717e6a1cfeca9a1f4f5c8ed00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128415, "uuid": "db68fe1c-6278-4f2f-a46d-c0f33df9d468", "value": "6144:oczy+59zXVjhVOomLQ6nANGBp6FRkrYw:fLLrlOJL9nAN46FRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128415, "uuid": "275ac91b-2369-425c-9ab3-2c0d329dff1e", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128415, "uuid": "edc9f42a-6ef4-4f9e-b700-633016f51126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128415, "uuid": "4bae5b4a-261d-4cc2-955c-ede2ec93b0d6", "value": "a41b0dc8725c57331cb5eb9ecbce85fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89727596-0563-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686163556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163556, "uuid": "8eb27a60-f3d6-4250-8e85-e26b026bcd73", "comment": "Malware payload (RedLineStealer)", "value": "812bc472d29d186ee7a005089e1676fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163556, "uuid": "c6f7bc17-9928-448b-9981-94fbbfb8ba5e", "comment": "Malware payload (RedLineStealer)", "value": "69693a5a9cb088eb67882ef4eef22b4345f0f7dfe67d235a3239e6ed977f4da8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163556, "uuid": "0a6b208f-e4f7-41ba-a3be-8b9e9be01753", "comment": "Malware payload (RedLineStealer)", "value": "509503f4f36e602335a79568d5275328499aa4fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163556, "uuid": "6aa5f8cf-9420-46f0-884a-31ecd4776e79", "comment": "Malware payload (RedLineStealer)", "value": "642890c19dd805a5d6550a2a072b6a1fab7c360586c285de1f44032bc0252e37fd97cb571924e9f72a462f035c08ec5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163556, "uuid": "c133fb3e-cf1c-41d2-8501-721323bc8a40", "value": "T10FC40107E7E84033D9B52BB558F712830A367CA24878826B239269DF58F3590957276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163556, "uuid": "6485a53b-a70d-444a-b7ee-f44380a705da", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163556, "uuid": "a28b9aec-0e9a-4f21-a04f-48cf2056afbb", "value": "12288:3Mr8y90IOJ0KgFg4hy6It5erCTb6IOqEAJ73Ieam87lo:nyPOJNgThrIKCTbLZtlxX87C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163556, "uuid": "16007d18-f8f6-4cb5-822f-43762c73d42c", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163556, "uuid": "1830a9b3-01c2-466a-9791-97f25ce199d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163556, "uuid": "50780aa5-be49-4b6f-b1d1-38b7e5640671", "value": "812bc472d29d186ee7a005089e1676fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4812e36e-0543-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686149702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149702, "uuid": "55a1e93e-b25e-49bc-83ec-c8626e28dd7b", "comment": "Malware payload (AgentTesla)", "value": "6e3d1c1aa47027bf910cacb2bfa00d5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149702, "uuid": "c65da027-92bf-436e-92ee-44d2f3567af2", "comment": "Malware payload (AgentTesla)", "value": "697dc044dc820fd930417991c39750046e407182f1e1b4dabece4463023eef94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149702, "uuid": "eabec17a-fb2a-4ef3-a7dc-fa86e848210f", "comment": "Malware payload (AgentTesla)", "value": "85a851f978ec9b484211c75fa9532034549ea206", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149702, "uuid": "fefc4ffc-d4d4-4121-98ee-0392edf4e97c", "comment": "Malware payload (AgentTesla)", "value": "c4a4159b7cc00803f214d9cdc9e221b9c65d4fbf1a608b9cb342eefe81107e5750eeb7af3961eb6e5393395ee0ad0219", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149702, "uuid": "1611e86a-fed9-4594-8e00-06a7a8f60b47", "value": "T14AA4232D05E6ACBF96E33CF49B0C656B88CE3C03538CFED92A241AABBD245457194D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149702, "uuid": "717ce21a-bfe0-46f1-b640-c8f99f9a4bd5", "value": "12288:3UoZjDOF18x/6PQ8rAEt/rjd7t20RVHZ6xe:9e18xiPQwtPVZ6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686149702, "uuid": "6fa86613-14bd-4f90-a3a4-e7b27bbd08f9", "value": 460875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686149702, "uuid": "f6714308-874b-4dfb-92b0-a30063e42081", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149702, "uuid": "41c99152-1285-4110-8dd9-4472ec9f5c7e", "value": "PAYMENT ADVICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5b92c4-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686128422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128422, "uuid": "80736c8b-b164-4a67-99e3-99acb503439e", "comment": "Malware payload (RedLineStealer)", "value": "3f0e8a9d61be8b596b4be752965295ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128422, "uuid": "06758358-0598-46f2-b774-12966eadc379", "comment": "Malware payload (RedLineStealer)", "value": "69f24003a768ac6451b4bac285475486d27c39723f474e3b8a19c61ceb732838", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128422, "uuid": "2538d206-7e67-4094-b0bb-8211714b1795", "comment": "Malware payload (RedLineStealer)", "value": "23399af014c60bcd53af9591a6bb80bc09772139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128422, "uuid": "dc20f021-7585-4b4a-82ce-21070c4c80ac", "comment": "Malware payload (RedLineStealer)", "value": "2a41233f1d6e93b235de55e7f9a304a87a9ef97af61fd9217f1ae40a1aa1215d6cd09f51e217d492051d532d7015933d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128422, "uuid": "c786ebdc-d2a9-45f9-8384-47b853ae9908", "value": "T148357CC0B090C072D576153679EF95A94C286CD30F215AE76FC84AAE6A2CCDDEB383D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128422, "uuid": "85ce5e9e-3221-453a-b5e0-39cc0406cf54", "value": "cae5900a92ba6c4de6ecf85e5f8c7e5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128422, "uuid": "9c52ad67-76f4-4c59-b017-beb9895444aa", "value": "6144:Tuo1XQlPoSlw4524UcL/LHh5Z8Z0AOkGZKWklMdGwuss4tjS0G+zLT1YS:TXX4flh524UOyKKWklMdGOtjasBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128422, "uuid": "8eec90f6-9a72-4095-8ad2-bafa62b4b7a6", "value": 1113088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128422, "uuid": "81e90057-0ae2-4ab7-a7ef-2043e4200f68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128422, "uuid": "623e98c8-3ce0-422a-839c-13103704d18a", "value": "3f0e8a9d61be8b596b4be752965295ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aeecef7-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686128366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128366, "uuid": "0997bb35-1397-4a22-9977-ff08f6b6f763", "comment": "Malware payload (SnakeKeylogger)", "value": "295830947cfc8aa0980ddb245c526843", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128366, "uuid": "71d26e9f-0e3b-4b01-b54e-ccabb2bc10a7", "comment": "Malware payload (SnakeKeylogger)", "value": "6bd5f1893f962f7a87363e844adde28b9568de5acd944482195e789890400876", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128366, "uuid": "40820a44-0e9b-4305-8e1f-31b729fe4e5c", "comment": "Malware payload (SnakeKeylogger)", "value": "c15284f78610713eb4792ef66c649431cb93992a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128366, "uuid": "d785f83c-a3c6-4c07-b1a1-10fb6c1939cf", "comment": "Malware payload (SnakeKeylogger)", "value": "3423c10da0627266c3da5f322501eb589accc79b561bf6a5f9955c3ae20f0a6e213cf20b586fb89f1b2a4aeefb85d77d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128366, "uuid": "4cd3d123-0b91-49ce-a784-652900aca2aa", "value": "T1C2E33999766072DFC857C4768EA81C68EA60747B971FC203E06316AEDE0D99BCF150F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128366, "uuid": "cb6b22b9-9bd8-4767-a757-19a436ede49f", "value": "3072:twvJqsTGnZkYTb72b2woIWZBC9OcVuifeYdFHwJz6MRfJojx:Wv43n/TbkHkc4ifZdFHwJlRfJoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128366, "uuid": "fd5ded72-c510-42de-9828-b124364dcc02", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128366, "uuid": "8ffafce5-8c6d-4b9e-b4bf-886d596aca58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128366, "uuid": "967aa19b-8d6b-45cd-886b-45c193d469ae", "value": "295830947cfc8aa0980ddb245c526843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2406986-0527-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686137854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137854, "uuid": "31be2904-435f-4cc1-a99b-f122690c7e55", "comment": "Malware payload (AgentTesla)", "value": "bb3314ed4575139271ed69b742bbd5ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137854, "uuid": "6861929a-e280-4be2-8e0b-d63e77b0ee50", "comment": "Malware payload (AgentTesla)", "value": "6c5181c0a6838d1afcd5e9f3730c0559a1934dc775ed5b316ef2745d68f5bfa1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137854, "uuid": "dff17381-76d5-407c-9ad7-fabb64ca9206", "comment": "Malware payload (AgentTesla)", "value": "88e6f8541598a53b6374fcab5d90cddddeec14b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137854, "uuid": "541c3ba7-37af-4db3-b051-7266297435c7", "comment": "Malware payload (AgentTesla)", "value": "e696ad2016fb4f6e87957927b85ab57980b0ae0ea945cbee591d98273a7d6bb095778e2870d07361d0666a245f4bf4e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137854, "uuid": "8a3eb5d7-22fe-49b6-8900-2088b14a1b44", "value": "T105F4F10413FC40C1E6BAAB765D78305347B67A276874DE5DBF8A74892A30B816831B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137854, "uuid": "ba875542-c6b1-43f8-9329-10b2dda23abf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137854, "uuid": "0d831874-40ec-444c-8967-3cc255bb7db2", "value": "12288:RfeeXfZdfrXg+JwuKt/S/60iGTwWddZ1S3BNuE+ezCnmo:Xfw+Jwz/S/6C7Z1SdTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686137854, "uuid": "cc6a0e4f-322d-4433-bc4b-ad711d1ff296", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686137854, "uuid": "a6e79a31-eff1-41fa-9a48-80d4c8fa3f03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137854, "uuid": "72518c4c-cfd0-4043-8977-4643eb6359c1", "value": "6c5181c0a6838d1afcd5e9f3730c0559a1934dc775ed5b316ef2745d68f5bfa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d927df8-04e6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686109795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686109795, "uuid": "65603eb0-772b-44f7-bec0-431adbe28495", "comment": "Malware payload", "value": "3e7491ae19de8aee28aebc6c7ea10240", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686109795, "uuid": "4a2592f2-128a-4663-a413-4fa72b987720", "comment": "Malware payload", "value": "6ed3fa72bc5c9417218aac4f144a62b54e1ac31a234f4b6c8c8ef47cf1dfe038", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686109795, "uuid": "f70d7b23-72bb-4365-a861-d003899c53c4", "comment": "Malware payload", "value": "393dd6c448004967be4539eb484906d7ec5273d4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686109795, "uuid": "693f2177-1fcc-4da5-a062-542b51d775d4", "comment": "Malware payload", "value": "6fce1df290e2448ad30226a1e990eaf5e6f8fc79c33b864a0257071fac78cc0f8fb4e3ccc7f2c4812da9e941e87e3635", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686109795, "uuid": "22ed5486-f5cb-475d-a9df-592818b002f9", "value": "T141E4230FF70442E3F8681FBDEA6A730F9C31EED84EB861751174930ACE7A448255696E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686109795, "uuid": "2809b077-e32f-489c-8f90-232fbfcfdb80", "value": "12288:l4G2G6xZrHZwTqz5M0sDB5i+/wAeslrU80DOPvJsbhFRvVUstsi+VHFDUPpD:l6GOrpYinJbUnJsfRtUSsi+VlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686109795, "uuid": "ab962d5e-da17-4021-9a35-46fa01d5c4e3", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686109795, "uuid": "93612abb-1549-48be-b9c4-9ffd6cb5cfc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686109795, "uuid": "701b403c-2826-4b73-b0a6-f299da82d3e8", "value": "3e7491ae19de8aee28aebc6c7ea10240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c936651-055b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686160044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160044, "uuid": "130e741d-ecb0-4254-a89d-2ce218b7b70e", "comment": "Malware payload (SnakeKeylogger)", "value": "12784340ed9990c0022989c5a8cbf798", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160044, "uuid": "08012290-3eba-4289-82bb-718f4316a1e3", "comment": "Malware payload (SnakeKeylogger)", "value": "70fed4a73ff35a90f86f10ce9bdb2a9f3b98e1851a57592942cb6be45a581603", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160044, "uuid": "4c17370d-9cd4-446e-b6bd-77b931799772", "comment": "Malware payload (SnakeKeylogger)", "value": "b8b58c164411570e52952cf54650f064ef1ad326", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160044, "uuid": "99ea7448-7cdf-4d39-86eb-49965ac65ec9", "comment": "Malware payload (SnakeKeylogger)", "value": "d09fff60d366a50f8a2b984945469cf10eb22aa11fbf122e80526555ba2d6e7b4e41a5f9a71a7b9baece494c0aa46ef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160044, "uuid": "b570cea3-bebb-478e-ba25-3d6e05845998", "value": "T1FEC31A1D27F8D800E6FF997601B16212C775FD42152ACE0D0AD1F56A2E7DA908E1BFA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160044, "uuid": "06d345d5-dac0-415b-bd2f-a4fd2d150479", "value": "3072:hhryR6omnK6oZLtImNb1xu/FwBIbhDbY:Krtrb1cbRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686160044, "uuid": "786f8665-5710-4ab2-b939-e8fbca1168b5", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686160044, "uuid": "7749c800-384c-42c7-9b4f-cb09f4966c94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160044, "uuid": "0aec9cda-b7af-4c1f-aca9-0d35181fa8b8", "value": "70fed4a73ff35a90f86f10ce9bdb2a9f3b98e1851a57592942cb6be45a581603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d6fdc5-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128378, "uuid": "22d7771b-a496-4495-aa6f-03ca68f4ddc2", "comment": "Malware payload (Mirai)", "value": "b8dc1b7cfbdccd3765e97a008c1de88a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128378, "uuid": "b8d33821-734b-4e2b-9836-56ca75a8daff", "comment": "Malware payload (Mirai)", "value": "711bb895dbfee170cf79ca6d13997d2e75db3334a6af0ae39d367fe0b691297f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128378, "uuid": "9bfedbae-630c-4bc2-97f5-cbf6970f12e6", "comment": "Malware payload (Mirai)", "value": "0c112885e29eaafe575e3f5a0320813c3ece923a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128378, "uuid": "9a295e71-4f33-4b5f-8acd-33c44d3c6349", "comment": "Malware payload (Mirai)", "value": "4750c0f6e274da177242ccb74dfed8921e81045052f2866f75b39bdb361dd56e828e0afc6bef3d0bd8d45874ee23c8fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128378, "uuid": "a4de75a7-d4be-4f7e-adce-cb49f71dfb26", "value": "T194B31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128378, "uuid": "04d3cde3-e164-4a30-adf6-db7ea550d0e4", "value": "3072:pC/4rdZHsXsZwwR98Nk5mm/QcuLmHniPNb:pCwrvHwsZwY98Omm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128378, "uuid": "e81f81e8-6e39-48ad-8079-281f8b98bff3", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128378, "uuid": "50568734-a675-4b70-bdc6-224d5400b5db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128378, "uuid": "4392db51-4e94-4f61-bb97-4fc1299b00ae", "value": "b8dc1b7cfbdccd3765e97a008c1de88a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6336b709-0524-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PureCrypter)", "timestamp": 1686136433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136433, "uuid": "ea7dd6aa-6bd4-4c19-9bf4-8006d24741ef", "comment": "Malware payload (PureCrypter)", "value": "36bee0709882ae775b675bdf7ae19534", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136433, "uuid": "f938cbdb-a3bb-4f25-ad65-ab2decfb7d29", "comment": "Malware payload (PureCrypter)", "value": "716fe6597908d5a39164d4ab8a788c1cbeb87792b12f8ef010b376540f9e6381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136433, "uuid": "92b5e0c3-3b57-4b65-83f0-2e2e84eb2e16", "comment": "Malware payload (PureCrypter)", "value": "12c9c11eaf5f6a6579c391e1a90fc51a3708a1ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136433, "uuid": "53f0b8ab-c017-469b-a0b5-e1fc263551ff", "comment": "Malware payload (PureCrypter)", "value": "a83d4c25cab3c798ad81307941d863220aa6d2091cab3fa75508e388532448502e0b582e3b4e0d2c7bd6b72beb2341f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136433, "uuid": "7ff47ee0-33bb-4ff1-9fea-1cc0f17b0a7c", "value": "T16F63BD467B64C6A1F8540B31A8A387A05737FC2599F0D71B369DBD2F5F33292891238E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136433, "uuid": "cef2986b-a8e0-41fe-ae4f-3a8b8e7fe412", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136433, "uuid": "e730d313-ae70-416e-b679-41534c38f0e8", "value": "1536:+i56e5qz7f4Bu+jQn5lOtjzoACK+yw09HXdqkSZZZ3g99ibp:J5moBu+jQn5otjziK+ywMHX3Utbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686136433, "uuid": "f43d696d-1d79-43ca-b14a-7a7102f69380", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686136433, "uuid": "c7b071e3-886f-46f0-8001-818bc7fb8917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136433, "uuid": "38e13a0f-8c6a-4ec8-8269-7e1e06501536", "value": "716fe6597908d5a39164d4ab8a788c1cbeb87792b12f8ef010b376540f9e6381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1599fe8e-0537-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686144463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144463, "uuid": "457adff7-8997-43ac-9f40-88c68543e7ec", "comment": "Malware payload", "value": "6201e9c543e2b4841fcf6f0f73fe59bf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144463, "uuid": "039cf195-f3de-4ca8-ab47-06a9fb23705c", "comment": "Malware payload", "value": "7218e33145c02115c747739b07ff6bf260c69fb6de62dfb374caf03e265bf75f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144463, "uuid": "d7c0f923-ea96-49b9-8cd2-451c32c3c6af", "comment": "Malware payload", "value": "d3f5cf6fa96bb184ceba8f255d8e751198d49693", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144463, "uuid": "8d1341d1-f4de-413f-a472-0ba555d5fc5a", "comment": "Malware payload", "value": "81a3ba98f1817fb31193f875249b647f4a3943dad9a86646193f6478a47abc13622b9c07c56d0efe6fdbd41838a823d6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144463, "uuid": "c5b1cfac-335d-4d39-b666-8b7400fecca6", "value": "T141B2C0B0E602B918C46B0BBEE81D02F5F81D815BEB92E37D64847B9F8D45E93031E94D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144463, "uuid": "eaba65e3-e6a6-41c4-b140-fddb27962c62", "value": "384:EsfbFBVIjP4zvFt6BFIhlvVCA9lmY7NbNxt/ZtNNxksneQXTaEr5lkGmaDiu1Odm:vij4b1T9lhxllN2UjlHDiu+uzOTDjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686144463, "uuid": "ebb4d253-4ac2-4855-b146-2e399de945e8", "value": 25395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686144463, "uuid": "7a338ddb-0199-41ba-b343-489d18dce43b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144463, "uuid": "371e5bca-7a3c-4484-aac7-4d1117d60ecd", "value": "APEX TOWING LLC TX .docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb2595b-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128398, "uuid": "50d7950b-0874-43a1-a399-3ff07ba303a3", "comment": "Malware payload (Mirai)", "value": "ef2abba11e6a3ecc08f7c566b499831c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128398, "uuid": "ce36a8d2-ff13-465f-b274-9cf050dd787e", "comment": "Malware payload (Mirai)", "value": "724a7f4f6e2aa39ca96ce53292f899267e02abd452b331f249878bb8d5d02dc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128398, "uuid": "1a720657-7942-4a6c-89d0-73413e880063", "comment": "Malware payload (Mirai)", "value": "2fc7c4c3ef6a03199d6b491ecf642fa2fe0a7a58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128398, "uuid": "b3658593-1268-42fe-ba60-9b4c88833e97", "comment": "Malware payload (Mirai)", "value": "527a2773e0c229c6ef783e2204e78475c334b17350723fdc53d6d65a9ec89d71ea208dde7c320a251dcd2b19e9507fc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128398, "uuid": "7755711f-e62c-4b2b-b015-b7976a45c8b2", "value": "T1A6E38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128398, "uuid": "37e3bb1b-2260-4c52-be07-913fe6a0ca8e", "value": "3072:dgZc9h1jlnLA2PiXYeyCc2VNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZ2VWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128398, "uuid": "0734894f-9bd8-4008-a4bc-7872baa091ba", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128398, "uuid": "e9316160-e9a0-4126-8751-236282f768b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128398, "uuid": "3d880f40-05a3-4065-bd87-22b715006559", "value": "ef2abba11e6a3ecc08f7c566b499831c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3efb23f-052d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686140515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140515, "uuid": "dc262c9e-624f-49cf-a2e8-911607db29ac", "comment": "Malware payload (AgentTesla)", "value": "a93aca30ebce55710f47772f1bfba8ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140515, "uuid": "c277278a-7582-4d09-9fee-064aa6d8a750", "comment": "Malware payload (AgentTesla)", "value": "72ed92ecb1c88688f70e97585ecdad39e2e5524fdb6b9ce3331d92bbc361039b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140515, "uuid": "68de5549-881a-460b-a223-92b7acf44d97", "comment": "Malware payload (AgentTesla)", "value": "6af05c2845f54f2faf6e014ad1bec1f2d09f257d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140515, "uuid": "21bc6602-1a22-4f3f-b6ee-7c45c899ab20", "comment": "Malware payload (AgentTesla)", "value": "b5d302af2b9c359d6b0ee55df5ef07187132a42943e4dbfacfc5be1c1bc881bef0e6a6f7f1c40bacb2f23339f2dda0fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140515, "uuid": "799d165b-f0a4-4e8f-a473-dfbe0a0ea1f2", "value": "T1B2E433BEC5D4B480FF31EBEBA9E40844357492569C58F325AD4FD22A07582D786A23CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140515, "uuid": "df32b846-dd24-4f8a-902d-e04a631d6adf", "value": "12288:cwcpysjF0m4Wn9S/t5vTf4gbkJ2q8wc37MoaThtdeO0hlluCYNFpd4e1TBBSK:Hcpyrmdqv74gBq8wuTghj0hlKNFpdp1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140515, "uuid": "aa800144-cde0-4df1-b8f4-7ec54888a0ce", "value": 718455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140515, "uuid": "a83b2ab6-b2be-4ab9-b761-d21fc1e4e412", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140515, "uuid": "f8e85282-2ba8-4a8c-9d6a-85323b7bfa7a", "value": "BL NO. 609521283.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6490595e-0518-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686131281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131281, "uuid": "fb4cb810-f240-444f-a080-ba5b7e7ba5d2", "comment": "Malware payload (Loki)", "value": "09a3a511da8cebbb282ca95d6beb8e15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131281, "uuid": "f2ff79d7-8a6a-430e-9a3a-1567a40494de", "comment": "Malware payload (Loki)", "value": "7401a0994cadfc28e5997fb08b5f9e519422241b0edc10c40e0ec01b405b6aa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131281, "uuid": "9ce4cf8d-82c1-4273-a9f9-6cf8ac514ac4", "comment": "Malware payload (Loki)", "value": "ac336dd5ab2d7e4c1822ccb5680b7243a0825fdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131281, "uuid": "e50588eb-7ac0-4a72-8192-c603b270e69d", "comment": "Malware payload (Loki)", "value": "aa568a0f481eb3ddc93b85b66e87d3b2487400b4f76c0fad6cb7b3057b88901f0d5c709400da37850049806f84079fb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131281, "uuid": "65cf78f6-04ea-482e-ad28-8e610b99d8b2", "value": "T160E4016933A7604FCD6E7FBD18594B78C9F9AA463112C3839ED3648DED28F558A00363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131281, "uuid": "1dd44942-44c4-4cc5-bc7e-b3b7eb054f41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131281, "uuid": "43890e69-798d-4609-8701-5316c17de36f", "value": "12288:0d6L7PVpfQicbhaDnLMzIL2q+RTdOL8IaW/RBjGSIa4ldwkPQ5OWyyMjSpHaLrOS:yOyqGUL8c/RBjGTHlZP+byzjSdCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686131281, "uuid": "6b659f47-658b-46d6-9579-ef5bc8187f38", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686131281, "uuid": "06f9fdd2-2c47-47fe-9b12-a7792b9d9410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131281, "uuid": "de78aa6b-394a-4c8b-9527-63f14b0678b0", "value": "FedEx Receipt_AWB# 10235115676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4605b7-0518-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686131432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131432, "uuid": "9b60c0e8-d0db-42f2-9b4c-1f10c286d3a5", "comment": "Malware payload (Formbook)", "value": "964b2a25e71b45a830ce60cfe2950355", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131432, "uuid": "647e150b-97b2-465a-891c-3707dda1e3b4", "comment": "Malware payload (Formbook)", "value": "74c460852f392fbdd2ef8d83d9461371228d37fba88a6431fd205ee20bccf622", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131432, "uuid": "fe322f48-f22f-4532-a54c-f4b57e28f8ab", "comment": "Malware payload (Formbook)", "value": "fcf861d9af3942404b8fad9e0de9c44c44a64cd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131432, "uuid": "85af035d-e474-45bd-9333-903e11836705", "comment": "Malware payload (Formbook)", "value": "554f00a31052cc137c5bec5a0418acb6702d6b9fd8bb8b04f3876cb225239937f3afa54319bcd66aad53fc5f9b62272d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131432, "uuid": "8e2e436a-8ecf-4d86-93d9-a7899b1d85d2", "value": "T1D9547B5226984A5FC8A3DB3D73C34711BF79FD0823E39E3A7A72302458766C73259986", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131432, "uuid": "33162a30-2e2c-4694-94a2-49544593cc6c", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131432, "uuid": "51262f17-0433-40e9-9848-baeb88c8d495", "value": "6144:Jz2DrT2tG5FmFmZiFiiIiZnnnnnnnnnnnnnnP9SiOJHkJekAZm72N71h:TtGunnnnnnnnnnnnnnlvAZm7C7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686131432, "uuid": "3adf1010-2b29-406a-91b1-4adae41acdf9", "value": 291168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686131432, "uuid": "6558e804-8955-409e-8429-ac47ad90433c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131432, "uuid": "d612094b-ce18-43a0-82c7-ad805eaa58b1", "value": "NEW_ORDER89028902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e637e5f-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686128372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128372, "uuid": "c068a3ea-cac1-4575-b9ee-a717fca54998", "comment": "Malware payload (RemcosRAT)", "value": "01248782c871923cce056480ce946ab7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128372, "uuid": "cab18601-5f0f-4975-93b0-85f4e498cf1e", "comment": "Malware payload (RemcosRAT)", "value": "74c7371f4ee7b52bb7c9c79610027e6e927e3bfca8ef841407e1610f72f11aa2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128372, "uuid": "aae7d3ad-3734-4557-a965-fea1a9d9be18", "comment": "Malware payload (RemcosRAT)", "value": "1ab7d6d88086610157025914b3d652af66318b01", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128372, "uuid": "ed250482-b1de-4fc9-87c8-3ab198d64640", "comment": "Malware payload (RemcosRAT)", "value": "4f7344f6e0d58b6c029c6b9f360f624cc27471ceecc011d2f1010b869d07e411f4f19de80e2ad556df0922c4d387211f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128372, "uuid": "d412d60b-62ec-433f-81da-f8b1ed0f431a", "value": "T159C4F0AD76543AEFC857D8B19AA85C64FB20707B970B8243D42716AC8E0C9DBCF511F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128372, "uuid": "5838b4a4-1e09-45f4-8a97-7d83a5ffb7ce", "value": "12288:WGcYmvZZpBI5AaE7SN2NQnHwE78rcad4Yx8yyeSNIp9Sdcl+YY:WNYujqdE7SN2KnHwO8xXx8yyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128372, "uuid": "5a343d84-0272-4855-bfe8-dcb01e162c45", "value": 544832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128372, "uuid": "f7158b0b-1b07-48dc-a478-13df0e15bb80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128372, "uuid": "8dc8c47d-bfdf-4706-a7c1-9304641f1bd3", "value": "01248782c871923cce056480ce946ab7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5c4e9b-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128392, "uuid": "155d8104-2318-476f-b64c-beb0957bac93", "comment": "Malware payload (Mirai)", "value": "2f29bc64765f14c3445945ff75e5d725", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128392, "uuid": "999fc46b-833e-4a37-80cc-106b96044a53", "comment": "Malware payload (Mirai)", "value": "74e3e22d994050bdca577bcbf707a905a8ee3dffdad24da63b401b266d280d2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128392, "uuid": "d444727c-9ac3-40e4-b0a0-3758060c9e57", "comment": "Malware payload (Mirai)", "value": "975fb7c5dd69dc4ccd34483cf90099b306321da0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128392, "uuid": "bad488d3-35ea-4076-9a03-27c3f8640822", "comment": "Malware payload (Mirai)", "value": "0a46209344f9cdec9f0be26634066be87662498981cd03664253f985a24ed71640fbfee4f5cb433e45dec92ef77d6013", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128392, "uuid": "a874647c-b4de-439f-89f5-21b4262d8188", "value": "T100C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128392, "uuid": "490f39eb-3733-48ab-b1c3-61f2758c5270", "value": "3072:4jDy/+mh1vtbPIKa6bpcUPium7/L7QsvmGfIiNb:mOJ1vxfa6bywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128392, "uuid": "34add45c-8516-4b7d-8c04-5496cac7006c", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128392, "uuid": "2f5154f1-321e-4c91-a233-7be20ff0e9f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128392, "uuid": "bd5a8794-0646-40ef-8db2-b766d12c99a2", "value": "2f29bc64765f14c3445945ff75e5d725", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c790dcb3-055a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686159794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159794, "uuid": "a8c7baac-5dbc-47e3-aef1-99a940065442", "comment": "Malware payload (AgentTesla)", "value": "b06ae1e6eeceff98d9996b7672219b4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159794, "uuid": "15f18aea-0ad0-402a-98d7-ffabdce32623", "comment": "Malware payload (AgentTesla)", "value": "774acfc7dde64a61752bacbab9f4dc9702dc52a90ee4915b18178c39cbe55e85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159794, "uuid": "85a3ce2d-eedb-4d37-ab1b-0da00a8f4b90", "comment": "Malware payload (AgentTesla)", "value": "14a5e0901d86ce08420c4895218de9d9bded680f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159794, "uuid": "2b4e54a3-86f1-4621-8ee4-b76184cef57c", "comment": "Malware payload (AgentTesla)", "value": "1f3a964705cb7db3e043af69845c01fdb41424c59f191b6e0d630ad3ef0789eca9fc182ce7a4a411c8ccb3bd4884b276", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159794, "uuid": "a80fd1c8-14e9-408c-921d-fa6c7173f986", "value": "T14E15DF60A6F8CADDC4240BF0A1D2D0F007266D29E5EDEA560EDB2CDF31BAA44715753B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159794, "uuid": "a630c8b8-455f-4ea1-bda5-2f5b8ca28638", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159794, "uuid": "c6cc4b5e-f4ec-45cf-8585-35e6f5a31d47", "value": "24576:p1Bs0qZ4zlRdHZm7jNTP73VRe4P+JuleeTf7:pDs0qZW7ZmFRRvPXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686159794, "uuid": "f0cb4b78-4d5b-4b84-8df6-657d5c89eb16", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686159794, "uuid": "18c6f817-dca0-42f4-adb9-2510655c1ecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159794, "uuid": "f9184f57-b75c-4116-9902-f8af57e96de9", "value": "774acfc7dde64a61752bacbab9f4dc9702dc52a90ee4915b18178c39cbe55e85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350cf3df-0555-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686157401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157401, "uuid": "9c08068a-7ba5-4d39-87f3-0b2488944275", "comment": "Malware payload (AgentTesla)", "value": "0e23f6a471c0f39414af71b7686b2c67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157401, "uuid": "1d142a77-b9d8-44a4-a71f-bfa976a53cae", "comment": "Malware payload (AgentTesla)", "value": "779a609fb967044a625ac9771921cdbcd4f07991f407014a1576e092826f11ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157401, "uuid": "a30daee8-c581-4d60-9cb9-de16d2ad2a6f", "comment": "Malware payload (AgentTesla)", "value": "a90d94279f98ec0c36239d907e502a9875d6cdce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157401, "uuid": "95e45207-d11a-4483-acc5-98cdfed7aed5", "comment": "Malware payload (AgentTesla)", "value": "a08c7ac55c6fcf9054c3a6f0d9a914e644c941d64144eb7bebb440637f55c43d146ac38e74baf81612e5d777b9576b19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157401, "uuid": "d9864080-b281-4869-ad40-658fdd5400ce", "value": "T198045AF986C95D15C73E4174F4B1D1492BB29146821BE39E0EB2DCF63E4A7C3722E8A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157401, "uuid": "40a91288-800e-41d2-936a-d6565a8164bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157401, "uuid": "a8ec2e86-a689-4544-9490-dca773abf781", "value": "3072:AMAPTaigq3ohKxW5k4i2yuN/xadpMNSLx0R9Rhv2ExjOEup6:AMAGoU5kn8adUOxcB2jD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686157401, "uuid": "96ff897d-5d7e-4f35-b0d0-0573c6cd7750", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686157401, "uuid": "44b90600-b378-47b2-a8ae-7d534da86aa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157401, "uuid": "bad0f2d0-6d8a-4c92-bb90-a216568d2d18", "value": "779a609fb967044a625ac9771921cdbcd4f07991f407014a1576e092826f11ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2174f5b-0567-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686165342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165342, "uuid": "e66684d9-7b91-4850-938c-39cec0f3a5e0", "comment": "Malware payload", "value": "f503da8eee4e7cd822239110b488b08b", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165342, "uuid": "a38f9395-f2cb-41a4-8e04-ba37c5d4e8bc", "comment": "Malware payload", "value": "7874d15ca173ee419b69c1ac2cae4eb6f158a8c1285b9bff7e59af840bed251e", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165342, "uuid": "c48f65b8-ad69-4467-baef-d48d45a47a1b", "comment": "Malware payload", "value": "f122b5169aaf28a0906b16255cb0e4490dcfd62e", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165342, "uuid": "c49b10d3-f31f-4d3b-975b-b39a440a52cf", "comment": "Malware payload", "value": "c2b41dc5bed5ddc4e53f289f59f9e99e4f7b43c0ddf1f9091f8f5df053527f226916995a4d1738323c4e92fe2976b1d5", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165342, "uuid": "b75eca33-2a9b-4d20-a394-a1ea96033716", "value": "T1DE626D62F7D5D637CBAD93356DA312841B34C306BC57EB9A6CA9D00D0E533F819C2A61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165342, "uuid": "ebea8f15-ea6d-45da-9d49-968525ddabd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165342, "uuid": "5e6dabb0-fe2e-423d-b1fd-e0d07547ef24", "value": "384:N6P1J3MxbGglqBcpnHp//UeUB7Eb2eqJT:N6dkQBcLSB7Eb21t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686165342, "uuid": "4771e3d0-14ce-4580-9761-e4beb6b1d5e5", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686165342, "uuid": "11cb22a1-2e57-4fef-a109-8cdaf47d0c23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165342, "uuid": "3e4f8ac9-1e89-40b9-b45f-2b838774d96c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d848d1-0529-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686138481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138481, "uuid": "a7e6fb58-597a-4e79-a6f3-6b6caee8334c", "comment": "Malware payload (AgentTesla)", "value": "e8c5a7c720c402e09c6fef9743d34819", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138481, "uuid": "e67b6019-e849-4865-ac9a-3772c22a111b", "comment": "Malware payload (AgentTesla)", "value": "78a7bc3695f30a244507c25f77b3a7cd9483f89545bdeafcae57856280a1f5f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138481, "uuid": "a0d096be-e768-4e82-85af-a27b9aac10bf", "comment": "Malware payload (AgentTesla)", "value": "8078a4fdd82f4c060354a12e1482a0db30c5b79c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138481, "uuid": "64281fd4-4580-477c-a670-79c5bd8dd4f4", "comment": "Malware payload (AgentTesla)", "value": "f43fc267635512e1cb5a424904aa58e8156b5e78b351c1d9737e6e2c7ff38876d884ff953934ecc4801d10b06508256c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138481, "uuid": "63b2dcbf-f43a-4b13-825d-23313cf0fdae", "value": "T18D1533391B2C0152A39D14C5693EF1FBB46E1AF87D7DA084E5ADAB3B1682C5E0D070B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138481, "uuid": "e8dca198-74a6-47b6-b31b-e75ed6297659", "value": "24576:XZeitH3gR//DwWmnxfgox8Kjhsdqz2Q/QuYxcD5H/i:JbtHSmgO8K9p2Q/8wfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686138481, "uuid": "f50353c9-086f-4a14-be60-204a48640bdd", "value": 921826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686138481, "uuid": "dc95e0f0-de3f-4465-b61e-5cbc0e70faff", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138481, "uuid": "aa2701e4-d0df-4f80-bc08-e5f45ba9a539", "value": "Certificates Of Analaysis.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a293e4-051a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686132322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132322, "uuid": "4389c3e9-aa3a-42c7-b277-275a1912a77f", "comment": "Malware payload (RedLineStealer)", "value": "7e808da197cb294707a5ad9d65386a44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132322, "uuid": "9051c6aa-45bf-4648-a960-38f8b0db95aa", "comment": "Malware payload (RedLineStealer)", "value": "78e79436b598b1afe0d6e69aab0a671afb9706836e2b93d35a04548dbf504440", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132322, "uuid": "7810599e-fe15-4b15-8a72-018f24da4246", "comment": "Malware payload (RedLineStealer)", "value": "699ce6566eb772774b285dc39e1fa1a242f2910f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132322, "uuid": "52bf6102-d6a3-4f33-9789-08c401d043f6", "comment": "Malware payload (RedLineStealer)", "value": "1d359ae9a67d71bce89141dfec4629e7eb9e8d1ba1c425779fc0544c5a14586cbb3a74e38456ef535ac21027785b8306", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132322, "uuid": "12c17862-41eb-4917-b76b-27b89daa3772", "value": "T1D3C41253A6E44073D9B51B708CF706C31B3ABCE1997993BB1781AE9E48B2250793173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132322, "uuid": "eadef6a5-f534-4610-bc84-3c5c4c505716", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132322, "uuid": "3a6df929-7f83-4a91-9f4a-f8447a27e6c6", "value": "12288:2MrYy90MQ3WeMa934D+59BeCQvRy/b/gNP9b0r:ayg3WeM+JQ6b/gNlbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132322, "uuid": "cca522eb-5535-474d-b2ab-76de66bfbaf5", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132322, "uuid": "1dff1377-6b18-4475-a260-1e068ce8ad19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132322, "uuid": "b1e7ac06-f677-4cb5-9c87-2a076760c819", "value": "7e808da197cb294707a5ad9d65386a44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2369f5a8-0526-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PureCrypter)", "timestamp": 1686137185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137185, "uuid": "734b0009-fd75-474b-bacc-cedca18a0356", "comment": "Malware payload (PureCrypter)", "value": "7047255746c2c38b8e722e2092f9fc29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137185, "uuid": "a3a69673-cddf-4701-84be-757224f343dc", "comment": "Malware payload (PureCrypter)", "value": "7917a5a12d3b11626dbed58bf379966c8a8a5b0a9566c6ec1faad2a06c8f9fa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137185, "uuid": "4dacedd5-bd42-4610-bf8d-6b9920ad0faf", "comment": "Malware payload (PureCrypter)", "value": "7a01363c930a228d3b28e9165118e07fd49a76f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137185, "uuid": "574b6eee-ddea-4536-83f7-fb2546e0e3f5", "comment": "Malware payload (PureCrypter)", "value": "5bc5db05ad9b5713994955b45cf44b92273749b1162635e3446201f12b182b01fc2c8f733edd313b4c3f1f9208598c92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137185, "uuid": "c482a7dd-aa30-4947-b59c-8baf2afece70", "value": "T13463AD01BB64C290DAA84730686347305737FD16A8F0DB6B7BADB56F9F33252990638D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137185, "uuid": "3e445f7c-a802-43c9-9e5f-2c3c2b525508", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137185, "uuid": "b04f1777-cf4e-4411-8c64-c92576a810be", "value": "1536:y4CIBPjln5lOtjzoACK+yw09HX/qkSZZZ3gRyibF:nCIBPjln5otjziK+ywMHXtUCbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686137185, "uuid": "6e9d88ca-a840-4aab-a616-609c5bd3ab68", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686137185, "uuid": "6d2c1c75-cbfe-4906-b9ee-a5b0c4bd1933", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137185, "uuid": "09c862cc-2154-4b5d-8c81-1d7444cc2917", "value": "7917a5a12d3b11626dbed58bf379966c8a8a5b0a9566c6ec1faad2a06c8f9fa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9950f6-052e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686140615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140615, "uuid": "7dc4935d-1e22-40cd-be90-05f0f6b7dcd6", "comment": "Malware payload (AgentTesla)", "value": "e9915fd213d610ea6de7120c6440f88c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140615, "uuid": "069f2841-c865-473a-b9d8-63fd5f046c49", "comment": "Malware payload (AgentTesla)", "value": "7ab6272027a5c082c715396006cf65efbc6f021d0011cdcf5c8954a902887637", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140615, "uuid": "15274948-d383-4120-9504-7db97a073018", "comment": "Malware payload (AgentTesla)", "value": "0d6714153c9ff5ef906ef2339d5719e1c00e0256", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140615, "uuid": "d346d564-4100-478d-8f57-5c64c16007b3", "comment": "Malware payload (AgentTesla)", "value": "8c072e28977ce75b10ed7861fb4929426a33b1fa49e1ac97f8ff35cbb6835758a1b4777bfeeba26466321f851d4f25b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140615, "uuid": "611e1764-2b41-45bf-b4a9-b0af478123ff", "value": "T1F69423C90112416E3D79FD51A6397BA56E80A291A2F9EFF6C9437104CA158AF3ECF40F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140615, "uuid": "4d787c17-cafd-4485-be78-243bc21cb374", "value": "12288:Xk9nUPbzwyeXLwl7m2NmkYGWC7IaoXjyy9Ct:kUPwSm2ImxoXjyy9Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140615, "uuid": "eba8a834-a802-40ff-b28d-e2289172ffbe", "value": 431381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140615, "uuid": "0c490a3c-f6b2-4ffa-a1f9-b4b634f40980", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140615, "uuid": "bf9c72a8-04ed-40fa-bc6c-03880f3ce5de", "value": "Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589112a3-0532-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686142428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686142428, "uuid": "9793751d-a6df-4d23-bcda-62665ce68a05", "comment": "Malware payload (AgentTesla)", "value": "6234301cb8a673260ee503af151fa803", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686142428, "uuid": "29efebe1-9b5b-4369-a69e-ac1424acc25b", "comment": "Malware payload (AgentTesla)", "value": "7add9381843f7ae2d83df13d66708892a2d8464fd87d036d80b23ce187e82845", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686142428, "uuid": "6a4b5963-3f20-4671-9827-880bc3aebda7", "comment": "Malware payload (AgentTesla)", "value": "7bdfe1600edd94825404e34632b2e13195779f55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686142428, "uuid": "9d1d70b4-b991-4c49-bf71-8dea0a1bea50", "comment": "Malware payload (AgentTesla)", "value": "88c1047a2eeaf5926cbe0f61d1219bdc1c358c1fce269a8768b00e2e8a18fac6dc990848070c426308310b2fbaf381e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686142428, "uuid": "a553da03-c55a-4378-8e49-971a5b77906f", "value": "T11004239E40B933A8D0C566D6F6FE1E7DE7CC0DDBC91792120EC11FAC8B928B028D5912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686142428, "uuid": "d82fa564-5455-4073-943b-c2981568c6bc", "value": "3072:Lgvv0IlGMtkg4ZT9N4xNB/Ujjb/p51H7x3dX1AT7SVhO2d:UvDGhFTNeXoHZxtXOmhO2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686142428, "uuid": "ee5d933d-a24c-4e0c-b5eb-89e3505310a8", "value": 178604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686142428, "uuid": "a315a1e4-bd56-4fb2-a67b-f3ace3209212", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686142428, "uuid": "972ff99c-3f51-4097-9018-1e7a3bf868b9", "value": "MT GAS FREEWAY Q88.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae76d9a8-0524-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686136559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136559, "uuid": "74e36848-0f1c-441b-b150-9af02599d732", "comment": "Malware payload (SnakeKeylogger)", "value": "7cd9a2079805e748cd83ecd2ff140fa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136559, "uuid": "7b2a4448-d7c4-40e2-970c-0b933be5341f", "comment": "Malware payload (SnakeKeylogger)", "value": "7b0c02cb66adf1c524768386d28ab90d71ae19ebf80d4be969935be762d0bb22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136559, "uuid": "b513f62c-abd3-4d94-999c-bbc2d3403429", "comment": "Malware payload (SnakeKeylogger)", "value": "6d83b9e546a15d0555bf679e355fa3c74c2acc1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136559, "uuid": "0845194f-0f8f-464d-a567-56cd9ae0c004", "comment": "Malware payload (SnakeKeylogger)", "value": "c4015bb90c65b1e03dfcde0e6b08b46cb4dc3072417e07a4b4d189ab7a45d5bcdd0ee996b516297935a94c4a63767ee0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136559, "uuid": "c2b667d3-29de-47d5-b178-26f0fa9e2cc8", "value": "T1B9C3081D6BF8D800E5FF9A7701B26112C775FC42192ACE0D46D2F5191A7DAA08E1BFA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136559, "uuid": "c7922f7b-7556-488f-af63-32651f0a2c75", "value": "1536:ISDrcZc2gUhBw+Q3690+vBUFrlYYwRkRUDFnpBHa2QMFZy7lwDTLyb/cZzjkpiOq:ISDrcW1C036iwRKwDnybUBOwBIbhDbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686136559, "uuid": "9e010f2a-8a1e-444c-b9cd-f55bbac508ee", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686136559, "uuid": "1187062d-ddeb-459e-b4d5-74c1f4e04edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136559, "uuid": "4f0d03de-7dd4-4e17-b5f3-8ce4b46824dd", "value": "7b0c02cb66adf1c524768386d28ab90d71ae19ebf80d4be969935be762d0bb22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d810bd-0562-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686163232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163232, "uuid": "d0b889d4-7909-4496-8aef-fd3fab767aa0", "comment": "Malware payload (Amadey)", "value": "6e45e5f52c333c13c50bf92febcb6aa9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163232, "uuid": "21cfbcd5-5ab6-4a22-bed1-5b4c064540e7", "comment": "Malware payload (Amadey)", "value": "7b12249bd4288cf34ca6dc5a0c100d2082da6c215296af919e3cd68504249132", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163232, "uuid": "7c795a5f-24a6-400c-97ba-f1b58d4553bd", "comment": "Malware payload (Amadey)", "value": "8955e18bcacb6ee38a740c3d46587d94d3bd8170", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163232, "uuid": "34853f5c-0c18-43d6-8f08-15f662ae9ce3", "comment": "Malware payload (Amadey)", "value": "9272bf741ca06f03c0829e18770a37977a2da7b18c05a3a080ae6c12445dbbed829c059547ca9ba46d8598a9b30cc60b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163232, "uuid": "71ed065c-93ae-45b2-bcb5-c0d9fb261d78", "value": "T1660523E1E7E88136DCF41B7028F312970637BC604E69C35B678428599CB36E8A63476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163232, "uuid": "97ba5fd8-b9ea-4939-81a6-092bd17bee48", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163232, "uuid": "78548ff0-90f1-4041-84b9-6b4451a70b5f", "value": "12288:vMrfy90SmKwGX4pG0JtbQx+wUh0eyqgMeLivrFG2l9otMzNCZDZX4jyo:oydmKwGsGu1vNuqBpV4U0NX4jyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163232, "uuid": "0450d8d5-18db-4077-8cc9-4b99afa33d4b", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163232, "uuid": "3c92e694-a451-4833-a482-a75007731b68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163232, "uuid": "569ae34c-e4df-4f49-bff9-2f07eb3fa63a", "value": "6e45e5f52c333c13c50bf92febcb6aa9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936f699e-0539-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686145533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145533, "uuid": "3c66f3fb-8502-4b2d-b135-84a48531c025", "comment": "Malware payload (RedLineStealer)", "value": "7dcf315a91c893c71dfa8a8ee61a29e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145533, "uuid": "abdd463d-f0fa-42c7-9f38-8d48b1713669", "comment": "Malware payload (RedLineStealer)", "value": "7c0bb648d1a1a0a280e31513517db887f8ff710b1404ed471637f44fe5a561af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145533, "uuid": "c90fb226-ced3-410f-b299-074f2a8e45cd", "comment": "Malware payload (RedLineStealer)", "value": "e13bf5ac51dd94558dfeffa6c19c932785b83dc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145533, "uuid": "bda77194-5084-4bd7-861b-400b1b31e22b", "comment": "Malware payload (RedLineStealer)", "value": "c5b0ac9f12eeb30caf5797e4324beb2a083fdca0b791ef2f870bc6291288cea53d424cd12982755110a9dc5516af2ac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145533, "uuid": "25a703aa-8b1b-445c-8a68-4fdf90c6383c", "value": "T1FCF41223F7D55572D9722B701CFA06D31B35BCB24E28931E2740AD991CB3AC4A93276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145533, "uuid": "895faace-b560-4546-bca6-53abba2f2a30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145533, "uuid": "05c385e2-55d0-44fd-adb7-c9b2bb28deac", "value": "12288:jMrzy902nDatmn9Bnk5pWRE67881DMTNoJiEkfcqnPiLSAuYB:kyHnD4knNL7881WNoJE0qnPiLnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686145533, "uuid": "92e226f7-d67f-48c9-a971-d1f49c07d802", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686145533, "uuid": "0cd06960-bdb4-4272-b392-984edd18aec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145533, "uuid": "6ec3b220-2110-495e-b6ad-ee5f0bc27e2c", "value": "7c0bb648d1a1a0a280e31513517db887f8ff710b1404e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5eb48f-0518-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686131400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131400, "uuid": "8bfd42b4-447a-425d-aef0-0ef6da8f6014", "comment": "Malware payload (AgentTesla)", "value": "f2c87ae1a1b637a769359c675e86df2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131400, "uuid": "8c3fd1c4-b00a-4f36-9cd4-fe0fadf50d30", "comment": "Malware payload (AgentTesla)", "value": "7ca4331b53cb649259648314c7e8eb267cfba6d16fdbc58273fd1005584f4b91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131400, "uuid": "b93b4038-d783-4d25-a6c4-2fdb2fdb4f1f", "comment": "Malware payload (AgentTesla)", "value": "72820b0302894426cd1da8699884dd377c33a41a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131400, "uuid": "bb184999-c09a-4817-b97c-f20e0e6d79e3", "comment": "Malware payload (AgentTesla)", "value": "0e8064677ab4dc9d5f25cb12b2188693fe0b880a0b4a5e44e4146ff52c531e2eb442cac7fb01a9e969b93587dd6d467b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131400, "uuid": "4dce7608-6a49-4763-8357-9a076dda3454", "value": "T13184230127E4C896C593077A6CB94333ABA6D5226875466F7730AF4F3E32312ED1A763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131400, "uuid": "9c76b8d9-d72b-4e90-9a67-94467f54b872", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131400, "uuid": "e6c57349-6863-4467-9fe5-8bdd4973a082", "value": "6144:vYa6brVYqBncWWaW6PG7gCniLnK0m7nn8K6chV+2C4II/Nuin95Pl5TAw0F5X/n/:vYJRYqBncTd7gCirK0m7nnthV+ByNbd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686131400, "uuid": "00720c09-9cc4-415e-8679-855877ace9a0", "value": 388377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686131400, "uuid": "941e00dc-6df4-4aba-af73-fc65c45e80da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131400, "uuid": "0a7ad042-34de-4dff-8499-c54aa3ab892e", "value": "Payment for MAWB NO 297-8450-7231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60acb20e-052a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686139006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139006, "uuid": "fd8aac8c-8cce-4c6a-976b-17b79f1be443", "comment": "Malware payload (Formbook)", "value": "b4d05d86df6af54452027e0e5a1539cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139006, "uuid": "87fa1463-973a-4cb7-8cbc-be00d0d5df0c", "comment": "Malware payload (Formbook)", "value": "7ea834dea804921e3ae405125d386dd37a5e8fbb5c435090beec025f5c56ac31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139006, "uuid": "600c0138-41c2-4c5f-bc8d-c3acc1838e73", "comment": "Malware payload (Formbook)", "value": "c784e49a797e8797576776b4b4b7ee65431c7e57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139006, "uuid": "0490c5b6-a8ce-4669-a8d1-8ef7aed6118c", "comment": "Malware payload (Formbook)", "value": "2df931eb7e2c75b16328d25b25d75dad334bac0c4f90b276851985f546f80c8ea311673b1e8633b1d6f74aafc436de57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139006, "uuid": "7944859b-fb19-4ea1-9ae8-9b9f3e247650", "value": "T1580561BD1D03A1EB91BFE62A90DC1D1FFF21B986FE96B90864C20387759224E76C514C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139006, "uuid": "da196dfa-6efd-49a9-9fce-291101229771", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139006, "uuid": "2349ebec-19d5-4b28-af2e-9575cbe3bb16", "value": "12288:gVGTnFsVowSws0LCClUBO/wL3NWpc5Jim8OncOcQowHqGA6:rsVowS8OO/4FJcQtKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139006, "uuid": "62a28d8f-df5f-467d-8290-1e31b2a6628c", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139006, "uuid": "ba3e525b-0a00-4cd2-b12f-f8360400f27a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139006, "uuid": "859eb6f9-5e10-4990-99b5-222fef75f4b7", "value": "Revised BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b1a83b-0558-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686158939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158939, "uuid": "85e23bef-88e1-401b-977b-7375d4718e02", "comment": "Malware payload (AgentTesla)", "value": "35828c9576c16e8e167ebe2737d9e571", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158939, "uuid": "81066785-5279-4307-8327-bd0be4995bbc", "comment": "Malware payload (AgentTesla)", "value": "7eda17f4ece8dfa6232f0bb6bb8b4c106820881f1dd1f4fe2b60dc4ed79929ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158939, "uuid": "c41d5f35-ff27-4a7a-9837-500cb257562d", "comment": "Malware payload (AgentTesla)", "value": "7db315b4d16e5593f68afcfa016200d96410b3da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158939, "uuid": "1319c19f-502b-40bd-be94-0bfc93793b5c", "comment": "Malware payload (AgentTesla)", "value": "5e43799bb0a991582798663ba08386881aa9cfdcf6a20b74da712b4515c7d447031a098478f77a23476de7622b2d1c67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158939, "uuid": "c328ce45-45c6-40b4-8f5a-3d82997d7401", "value": "T188E24C5AE79F12B58F810276671F0E88AA7DB22EF35054B1386C437433D9C394676ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158939, "uuid": "62fdf332-a1a3-4917-a238-dbdf9bb3fc9b", "value": "768:zFx0XaIsnPRIa4fwJMstTWkIuev+27h4Kt6aLo73DgGs9T:zf0Xvx3EMsoHuCd7h7D0bsGsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686158939, "uuid": "c5a29422-648a-40b2-862e-27d8087fc6f0", "value": 32849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686158939, "uuid": "6f797bf2-473b-47e1-a02c-b71936d00610", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158939, "uuid": "6d688404-3645-430a-9386-b7cf87d0ddef", "value": "SecuriteInfo.com.Trojan.GenericKDZ.93675.22542.20745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b682533c-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128412, "uuid": "12246062-5ad6-4628-b701-823090f10aac", "comment": "Malware payload (Mirai)", "value": "2ecdf240e323449bab6361efabe96180", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128412, "uuid": "ee9dbf4d-549c-4c61-9e96-b62471c32f70", "comment": "Malware payload (Mirai)", "value": "7f216b7046ea5fffee15fc7545ba9e283533d12e4717de55d23007c19c32ab82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128412, "uuid": "8e8e04a0-a85f-4fce-8462-35086989fbc6", "comment": "Malware payload (Mirai)", "value": "d350dc6eb81847bbe797621701644e98fa282da0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128412, "uuid": "874f6007-0821-497a-b4c9-65b5aac0e26e", "comment": "Malware payload (Mirai)", "value": "8f5885f343e2f8063e19077a7b8523b0b8c5eca7952a62d736694c3aac00be91b872c3f6a2af2100d1f3127f33b969ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128412, "uuid": "d288e74d-e275-48b3-b9a4-dea370b101e3", "value": "T114634B51BC819613C9D5237BFA1E018D372617A8D2EF321BCD25AF2037CA96B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128412, "uuid": "6c19e61c-df9d-45d7-b1ac-a13c2abf3120", "value": "1536:k0efyB2+2rCD0cNslT3wcJT/tTXUCWUqz/PE02s2NxBvmv:k0e6X2riP4TudUaP5231e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128412, "uuid": "8f0a2a49-a1a7-405f-9359-19ebf6736f95", "value": 70968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128412, "uuid": "901e9ed9-6f78-4332-ad9f-0ce459419cf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128412, "uuid": "357e6171-d9ef-4b5b-810c-027d24c56ea1", "value": "2ecdf240e323449bab6361efabe96180", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2e9510-055b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686159940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159940, "uuid": "4893b864-d67c-49a9-b52d-fa64ff9ac2a5", "comment": "Malware payload (AgentTesla)", "value": "f44b56b8582e8c9f53da253624ed2ad3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159940, "uuid": "5a3156f9-ae11-4d34-9285-081707405873", "comment": "Malware payload (AgentTesla)", "value": "7fee535a13ea80e7870cf52e06ff6b5f38f9074a2672f8cd7bc8e222174c109a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159940, "uuid": "cabb75ea-2ebf-4b38-8814-9425259c3bef", "comment": "Malware payload (AgentTesla)", "value": "e30cd03cc1c098f4cb183ac1e7de35cded8f4ef7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159940, "uuid": "f3aced93-2251-4836-9cb6-d9500af1d169", "comment": "Malware payload (AgentTesla)", "value": "909be68ef0ec5ca6153cb24d4ce6344cb7e72c22555c8972831f8cedb2a0027c8caa0876ffa81e28e6d6ae7d7ebb75e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159940, "uuid": "7736685f-6b36-409d-8be4-6889b7e63ddc", "value": "T1D4F3393CD1F959D1D32D4D78D5B41148CAB2A172821BE75D4DA0ACFA3B87783322ECA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159940, "uuid": "68c40af2-55c5-42f3-a6e6-06741d2af8e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159940, "uuid": "a607d4c8-6c43-4812-953a-f9cbe32c8385", "value": "3072:qlPJvuIihARhA5DbxQSemDl1x1Z5YqRgcwZxWSe1XCx4:qlPJvuIif/Q6rtuZkSKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686159940, "uuid": "e5a332e4-54a0-4b72-b719-d393b9b710d6", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686159940, "uuid": "68f9e973-b23c-4f39-9342-b4c6ecf90ce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159940, "uuid": "81fd4761-bffb-42b5-ba48-9ba16adb2390", "value": "7fee535a13ea80e7870cf52e06ff6b5f38f9074a2672f8cd7bc8e222174c109a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ca483a-0518-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686131253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131253, "uuid": "7380d3e2-2757-42b0-ac32-440b726c419e", "comment": "Malware payload (AgentTesla)", "value": "03c016b860d353a948485829d6de8ce1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131253, "uuid": "cd9083ca-3faa-4ce7-8713-2b0f37ca3c09", "comment": "Malware payload (AgentTesla)", "value": "806d84d7beb73d21f10339e37cc8cad779ab270fb80b79258268aa78fe85f9b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131253, "uuid": "21dd15bf-335d-49a4-a7e4-fbe303694949", "comment": "Malware payload (AgentTesla)", "value": "81269f6b880bf19187a284a563c2bd425adda7b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131253, "uuid": "0b257ac0-6aaf-4bff-ad85-72c3568c1625", "comment": "Malware payload (AgentTesla)", "value": "a9843b8fd9362fc0d750eb5ada70df0a13e377fed11752e78875956e8a1db1454e96e2f5fd9b69ee04667c17dcd6f6d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131253, "uuid": "0a7d861d-783a-4097-bd95-2e779af3ec15", "value": "T1B1F4025833F7205FCD6A3FBD0D8606B8C9FAAA063522C2874EDB748DDD58F858A40657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131253, "uuid": "4c5b7e64-8ef2-4075-a5db-77916d685cc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131253, "uuid": "1d49b957-4d31-413e-b44c-3be5d185fe66", "value": "12288:zd6L7PV5f6ihbhaDnLMzIL2q+RTdOL85T3P2eCpiKUDjL11uhfLzFaX4uIMELNeb:EOyqGUL857Ow11udfFaoGY9zE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686131253, "uuid": "4c29e498-d284-4987-bff6-e8f9ce346bbf", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686131253, "uuid": "25b1f311-c1bc-42c9-be7f-ffc60547974c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131253, "uuid": "666e3b54-c007-413d-8d70-e76478786f62", "value": "RFQ_7100000000000231344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5806c209-0542-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686149299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149299, "uuid": "d1f291fa-f697-4c2a-8a3e-503b10e90640", "comment": "Malware payload", "value": "799cc23332fcc0c1f269964ee6b5f743", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149299, "uuid": "f8f8c3d0-7afc-498f-a4e1-010675ba4aa2", "comment": "Malware payload", "value": "80e53958df78b0386ac91b142a6a0541240921c3b475fc27359205e212bad319", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149299, "uuid": "58a2d900-f7ea-410b-9613-7ad15522bb86", "comment": "Malware payload", "value": "2c85ba794aafcd0e7295e2892cb9870fd1a2bb53", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149299, "uuid": "e4a4af2a-4a81-4d74-a33d-edecf92c2f83", "comment": "Malware payload", "value": "ff6d3e6fc9ca8f829cfa9d831b1783c82be631fd83c6d1cc3359d1fceb3041703d0dfaab93516135e47a572c38aedead", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149299, "uuid": "a81747c8-21da-4bde-a859-49425a924103", "value": "T10B562311B9C34535C5EE82B40AEAFB6E34772D24437240AB66C85BDF2FE36901673987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149299, "uuid": "40ffe536-2e98-41ac-a440-d7030fffe88e", "value": "98304:qYCNLdlgT6w53AS4YK79dmw+d8+gOsdEExDbK6XHKxsUZwuEHPkznAUIrtMHA:MNgNQRR79dCt0r/3KxsWSPkUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686149299, "uuid": "8b16b706-555b-4bf7-a739-048a7c54f219", "value": 5969920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686149299, "uuid": "af885a8a-79b5-4020-b071-4f0bf7e4b765", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149299, "uuid": "9a6126a6-be82-4fb0-acf8-7919e184c68e", "value": "nopagadafacturaSii.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbdea68c-052d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686140501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140501, "uuid": "1f09f993-edfa-403a-9377-32dbe68f6bf4", "comment": "Malware payload (AgentTesla)", "value": "d8f961bb4257565724c3d849139617e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140501, "uuid": "94fd8589-7e48-472b-a3b5-f57cf6dd4eed", "comment": "Malware payload (AgentTesla)", "value": "80e5a57fbd2b8ab25047b246ad66d35befb3c266e40989abd84fc4f49a72e8fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140501, "uuid": "968f6d39-0867-43cc-befe-04def88cf67c", "comment": "Malware payload (AgentTesla)", "value": "b4fd8268581b1a3a2e42a80897336a3a8c7e8fcc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140501, "uuid": "d7d24e9b-8845-48d7-bd91-48a3ef86ad28", "comment": "Malware payload (AgentTesla)", "value": "977ee06e58dbda15e31066d3aae9ddc2b774386dcc64e0d14d3a0fba82a9c57a6088ce35adc0915b711ff156127f85ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140501, "uuid": "cd9e23e6-a8aa-48ef-8b7d-480492abf593", "value": "T1BCF3276892C94CD1C32D80B8D4B00278DAB2E1675617E75D5DE198FA3FF67C3322E866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140501, "uuid": "0740de9b-9ca4-4931-a5a7-e6f671fc3c8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140501, "uuid": "013e2145-8366-4d58-ba6d-6187a820de5c", "value": "3072:sWvgVuQs0bkjKOh2KYivLi43r1orKh99/lbcnnnP3fS1qoe:sW4VuQsrhIk73s29/lbcnPvS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140501, "uuid": "3d9f442f-e411-464a-80b5-ebb8d0a9cca9", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140501, "uuid": "894d18ce-ef20-4456-91fe-e4549287f0c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140501, "uuid": "0274f9b3-cb41-4b9b-b153-64ca817511ea", "value": "80e5a57fbd2b8ab25047b246ad66d35befb3c266e40989abd84fc4f49a72e8fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883ab631-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686130053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130053, "uuid": "00c8d352-cea7-43fb-a1a3-8ec528732f4e", "comment": "Malware payload (AgentTesla)", "value": "89b3a3650105f363fa99624f7c122b7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130053, "uuid": "9e663ed3-a4d8-4c12-a3e7-6917f13a9363", "comment": "Malware payload (AgentTesla)", "value": "816dcc8bb5070ed2db687bdb064a383c946c8183f5e0c089f2453653be8a3086", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130053, "uuid": "2e3d1a34-7423-47ee-9e5e-5aa259a0de11", "comment": "Malware payload (AgentTesla)", "value": "896232e9d46e96fb725027380cc56cc73ae3ace9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130053, "uuid": "0b101cea-21d4-4cd7-9c81-0868bbd6e85c", "comment": "Malware payload (AgentTesla)", "value": "2d79a3c6cea834f50c0222e2b300b9408e46982ae0d127dc406d1fbc5e49098cd8e07c4f072a76035a6b8b20cf22b313", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130053, "uuid": "df90d00d-449d-4e98-be41-cca71b81e3f0", "value": "T175F4122C23EB481FC94B3FBC09005276C7EDA552B813D6976FE3AEA8DC567514D8608E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130053, "uuid": "6c2599da-1644-4cbd-8c35-5cfecfc896f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130053, "uuid": "b846b6c6-4338-4b69-a723-9bf4c6dcd4df", "value": "12288:60+J/M+Jhewx/NscEQ+vgXK1HsaP2XigKw/HDrnTfehVwWRkAUqT6c2sKoRjpt6s:M/thewlqB6p8W/jjTf6V/Ul9sK0t6LoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130053, "uuid": "07ab4314-17b1-46e6-8b6f-4c0c8b492edf", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130053, "uuid": "4aad95bf-c900-4260-9227-2893e9c3392c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130053, "uuid": "aa4353d8-013e-4b0a-bbb2-3bdb8bd5393b", "value": "Order # CCI-1260584.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a0efeb-0550-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686155568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686155568, "uuid": "60503a7c-22ef-42a8-9c54-149cd42b7d71", "comment": "Malware payload", "value": "756108f2bc398421be5def1b92e0c471", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686155568, "uuid": "86e149d8-4caf-4bd9-8d7f-f98ecaaa65a2", "comment": "Malware payload", "value": "81d0f5a0e99bc1f96d20b5aa4e8168cc0e50d58af04fa0bf52625a9cf7731fa2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686155568, "uuid": "4043ce59-cc97-4d38-9689-ac45b6de485f", "comment": "Malware payload", "value": "e683bd471975acce9cb59bfcadad89cbe8cf62a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686155568, "uuid": "5211cdf0-ca82-4f13-a713-0f9ef7a52a6f", "comment": "Malware payload", "value": "6f7a236fbab81715dc2e2dc425f5e79c49ea2e251e0ccb192e9a54bddad31ae022bbdaa874bdbce31de360776d1d3233", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686155568, "uuid": "6f257f5c-8147-49c7-afb6-7f1e5ca1d06a", "value": "T10FA38D1276DCC2B5E41A35704C60EDB56AFAB938377F009BF79916692E233D042B271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686155568, "uuid": "158ded54-7fba-489b-a906-3c3e0e26a766", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686155568, "uuid": "d42229d2-66c6-4cab-8d80-0cff1b8b40d5", "value": "1536:vp6kFya9c7Ok/YNQVB0gB75eGFESDjyXX9di2YTHLYjzDm:hVBQ3d1ESDjyHxYTHcj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686155568, "uuid": "40775fe5-67fe-4c84-933a-91631db00629", "value": 103355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686155568, "uuid": "7b7a44c8-8c5f-4041-bad4-35a0a4b5d221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686155568, "uuid": "3491e1b6-a4e2-4710-b367-15ee9068a07c", "value": "756108f2bc398421be5def1b92e0c471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a97257-04ee-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686113221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686113221, "uuid": "5cfab748-e126-472a-ba7f-2f06636ec39c", "comment": "Malware payload (RemcosRAT)", "value": "d34424d4ff9030116dedad2314fabbcf", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686113221, "uuid": "a4edddde-1949-40a8-a868-cae1a530c1eb", "comment": "Malware payload (RemcosRAT)", "value": "828c067539368aee17656ddb7d1c95f9567d7f2bd80b876cabbeed104556f98b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686113221, "uuid": "24c09b39-78c5-4230-a003-76fe2bf56b11", "comment": "Malware payload (RemcosRAT)", "value": "e8f114e73f8f856483d652344b4ba9334e5b0a14", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686113221, "uuid": "72643d1a-b1d6-4b96-a6fc-c0ab380f8ff2", "comment": "Malware payload (RemcosRAT)", "value": "641b2573c1b0d6802f725d3af299684c165c246a4b2be365e9ad437dc2f162c88fe9536d4d2d975e854072e8a9842fc8", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686113221, "uuid": "8d48e6cb-3f09-4fa0-bf68-b6003fd857ea", "value": "T175C22B965B8C4C61E269E8BB874DA00E59BCF63630C245C5BDDDE2703B3D54E0B6B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686113221, "uuid": "2664188f-5fc3-4cbe-9995-3bc6b44aeb43", "value": "384:6XbGESBab/Y3lb3JBe8o6enzwWC1orexFp2L+3+FEgTrNuHbMU+DUf/wMY/K2Qeg:ofSBx3DenzwWWoafmi/+r4HbrRb2Q75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686113221, "uuid": "72cec9dd-5d27-458f-a016-669c41c6c672", "value": 27817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686113221, "uuid": "1099d695-7a1b-41fc-bb04-eec4848548a1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686113221, "uuid": "e11d19ad-f9b4-492e-b71b-d74ebee8aaf6", "value": "d34424d4ff9030116dedad2314fabbcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144980c9-052b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686139307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139307, "uuid": "3bdb0969-2313-49cf-b52e-e0398da29fdc", "comment": "Malware payload (AgentTesla)", "value": "b984d2d4c647f0c1e94c3199fc59e49c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139307, "uuid": "fcd77d74-7f16-4c0c-8bb0-e574d749a28e", "comment": "Malware payload (AgentTesla)", "value": "831bd1e3f15dce0f7d24067a888f9b393987652ee75ee74ce97a4dea509649ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139307, "uuid": "3437073f-5c1e-4a71-828c-c9a64e6a0ae5", "comment": "Malware payload (AgentTesla)", "value": "4d8e906169521bb68406e6e3d47916c3084703b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139307, "uuid": "0cd2abcd-7203-4a35-a9b9-1beb70c202ce", "comment": "Malware payload (AgentTesla)", "value": "0f5e794c79b68f4031a18c3537588a388d35bc27c2812872be99fd8fcdb665e548ed63480362a08f84b0ed6613aa6118", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139307, "uuid": "bbd8b5fd-e30e-4c53-bdb4-116e6e0e1ae4", "value": "T1F7E42322447D96853B8FB782EC74FB1139713C21D2411C548B6978B08A38EFF9E9639E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139307, "uuid": "1ddee3e5-cc3d-4785-8cc9-f536b760373d", "value": "12288:j1fDRg3eyXDqhGXkapK7IgmRVBJRJqD16Pz7YWrJFtAih7uInD21oj2m:Z2fmh+kaSuRVB9qBYznJFGitxD242m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139307, "uuid": "cd1175ae-f360-4b0b-9398-30e3ccabc814", "value": 698490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139307, "uuid": "4a508875-646a-472c-a442-5705de963fe6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139307, "uuid": "24cb3cd7-42a6-4547-b87c-03285c12f52c", "value": "June Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16eb926-04da-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686104808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686104808, "uuid": "e7e3adc8-748e-4a93-b68b-81e6809d0cf8", "comment": "Malware payload (Mirai)", "value": "d361a46fea973adfc6a18ec4f16b5cd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686104808, "uuid": "d6d4d954-acf9-40bb-a0f2-860981f3c99f", "comment": "Malware payload (Mirai)", "value": "8507fd051ea6e312973a65ad0e58ce9f70fe004c9ab530d4ab58fe29a2b48673", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686104808, "uuid": "eb6aa60b-c85b-4dd8-9530-a46fe406925f", "comment": "Malware payload (Mirai)", "value": "c3caf02d7e4b974f442dff455e0841497fe39daa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686104808, "uuid": "d4bc9d7b-148f-43ad-a222-bb0863c09e1b", "comment": "Malware payload (Mirai)", "value": "2ee51e1a05f898d4389552524b27e4fb3b7f7ee36679441826c2dbceadfaa00477edc649fd06ed6fe99f52ec333a258e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686104808, "uuid": "c1fbb29e-ff2b-421d-8f15-76d9a2eeafcc", "value": "T12423F16F16AB26E5E92385FB071617E018768BA34A57AC86EB60F514CC0313A5E33F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686104808, "uuid": "ac78c77e-6298-4856-87fc-d09cb36d77ee", "value": "768:juVDGsfSFHbDtH6FFNo8tHvyhXhwq8s8UOkX77UtV7AS3vyyAio5nK73j3JgGlzY:QGoM7D585vyhXJTAiEnzQBO3BVqYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686104808, "uuid": "9b211620-be8a-4201-8821-5da53da2ece3", "value": 46192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686104808, "uuid": "097457b4-69e9-49e1-ba08-38d9b3663f14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686104808, "uuid": "3635a890-c1ae-4714-8f2a-cab855725c58", "value": "SecuriteInfo.com.Linux.Siggen.9999.13182.15361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7701ca1e-0518-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686131312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131312, "uuid": "ec099c0e-bc89-4f5c-9a92-4a19475d1f01", "comment": "Malware payload (AgentTesla)", "value": "c6a74fbf100cfd67ea4fa6da9b819093", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131312, "uuid": "ad91f6ca-fa89-445d-89e0-26b77d318782", "comment": "Malware payload (AgentTesla)", "value": "85b3c9f10a8f1e3aee3d393260f82c7dcf8d23dcd899117f0394f6a9f0fdc7fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131312, "uuid": "e5fd9b70-30c6-48b7-8a5f-c26fffc2fad9", "comment": "Malware payload (AgentTesla)", "value": "9432af1405493a9c03c2fbe5627befafbfefcd86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131312, "uuid": "61ab5629-4d79-4154-98cb-c705ba909413", "comment": "Malware payload (AgentTesla)", "value": "05d089cc52f6d565f09b557aa865a1ac00223022512b0d767c8596a624efdd93733809a968fd5776f439605ff9cf718b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131312, "uuid": "ebecd03a-ad2d-49d5-ad04-80b60f9f4d02", "value": "T1F3F4026933E3610ECE5EBFBC1C5506B9C6F8AA063502D2878EE3745DEC68F468A41753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131312, "uuid": "7fb0de4b-a96e-41a6-aebd-2658ccab1991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131312, "uuid": "1ac5f9c1-93a2-4b24-8bed-2b2cf19bba27", "value": "12288:vd6L7PV3ffiobhaDnLMzIL2q+RTdOL8PPTCrLcLUVnQh5pGnSxxcVhpXcwJbbxCo:gOyqGUL8H2cLFQA4pXcwDCX8fhUW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686131312, "uuid": "ae45ebcb-d755-421b-bead-98ae43cbe2a8", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686131312, "uuid": "2785a854-bf9c-41c7-951c-091cb9a3630e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131312, "uuid": "dd1ae923-5a43-45d2-b65d-3c020c9fb627", "value": "Product Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c9080c-0556-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686158161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158161, "uuid": "20df32ab-8ff5-4e06-944d-699aea38c8e4", "comment": "Malware payload (RedLineStealer)", "value": "25506f7466ff06978399af6d89358de5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158161, "uuid": "a9d83cf3-4582-4dd1-9a41-ca46ee269219", "comment": "Malware payload (RedLineStealer)", "value": "8919f74dbd93aa0b7189a897367b3ed6fc2ac5332fd81bfbfa43f3b901056c72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158161, "uuid": "79c04c81-d3ba-41e6-b9d7-9f2a7eba3496", "comment": "Malware payload (RedLineStealer)", "value": "532f9ce1f2bca1c5624dc7a279da321d2ede67e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158161, "uuid": "49f20dfb-44f2-4af8-85ae-a2e49b63c106", "comment": "Malware payload (RedLineStealer)", "value": "9f50eaca498265b78c43fc442037ebaecf552e00f651aee2795cb0ad08e79f3fbf034404c584a4dc5ca67a52c832af94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158161, "uuid": "b6f8957e-c294-41ce-b8e2-0274cd62224d", "value": "T1BDC41213EBED9422C9F517701AFB02830B32BCA50A74979B33846A6A1DF35D4A17537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158161, "uuid": "d29b9414-737e-47e2-9a32-8324b40fe8e1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158161, "uuid": "fc4aa0a3-0170-4a62-92df-db0490612d33", "value": "12288:ZMrSy90Ttg1XigqBFbnODfryRAUoH/CxDdqU:zyAqYfyDfr0AUoaxDdqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686158161, "uuid": "54d4685b-2897-44b9-9371-7cb30274c375", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686158161, "uuid": "a38ff107-9faf-49cd-97cb-1047de8c7223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158161, "uuid": "c3b1e054-d012-4b80-ae28-5eb6efccf33c", "value": "25506f7466ff06978399af6d89358de5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48766bc-0542-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686149535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149535, "uuid": "bd161b99-86ca-43d1-9eba-f7dd9c05590b", "comment": "Malware payload (Quakbot)", "value": "72701c40bcbe7e9bc275b690558d2ec2", "object_relation": "md5", "Tag": [ { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149535, "uuid": "326b2205-d517-4085-9a43-5e297266caa3", "comment": "Malware payload (Quakbot)", "value": "896b84840277c7445aeab6ed6bcac9e246546c46fa45697902130c3a714c228b", "object_relation": "sha256", "Tag": [ { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149535, "uuid": "ca3aa346-b4c9-4026-8c78-e27f1dd39b70", "comment": "Malware payload (Quakbot)", "value": "0532673d7349144ba1248f585b1a56f92306f265", "object_relation": "sha1", "Tag": [ { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149535, "uuid": "229ebd93-e8b3-4da4-b514-a645b92ff32d", "comment": "Malware payload (Quakbot)", "value": "e95734c036b9e0a3668b2380fc46e3d0349600fae2bb47e9394dcac249c08bc5e12a3c0bd272ed856cb92951d614f694", "object_relation": "sha3-384", "Tag": [ { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149535, "uuid": "cdc6cac1-254d-4224-92e9-538e8d10dbae", "value": "T146E2F1A5748EB3BD1815DF8D9A0B35E0F87314EBE5910AA368B0B51477CE60F3C76051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149535, "uuid": "0240045f-2961-4082-9893-a18959376204", "value": "768:yPjZ4pJY9S48gc8VH8NplHoBQRzIn2ROigQ:fk8kHERzhgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686149535, "uuid": "2b3457db-d88d-478f-8998-86c94af77648", "value": 31799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686149535, "uuid": "05ebcd18-6468-4c49-8f19-602602f1d80b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149535, "uuid": "d01648f4-3372-4451-95f1-4639507b9e8b", "value": "Calculation-of-costs-647746213.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb8a978-051c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686132879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132879, "uuid": "c6000b2a-4103-463a-84e5-d8860e491338", "comment": "Malware payload (Mirai)", "value": "a8179b629219cb0c82bcb34a6f767aca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132879, "uuid": "e1d9f74d-a71c-43d3-9a11-52280ef7a413", "comment": "Malware payload (Mirai)", "value": "89c89aa79abe3e33838d5ed1ca32bc29d735fd53080ba7e50deb6d065b9f72df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132879, "uuid": "71e4da25-e106-4880-b6ba-ea3a73e50f5f", "comment": "Malware payload (Mirai)", "value": "aafbfc394b064eb602d155e5eb2017977bfce664", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132879, "uuid": "782c5442-b46a-4618-abaa-dae1c6d3fa25", "comment": "Malware payload (Mirai)", "value": "a995dad1109348cd94e1920ea9d0ab76334037dc89079d98877240f4be2faa0e8fe8bba5afba2c2544772425faf761a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132879, "uuid": "c9a97203-bc9e-4137-a4a7-0c9f87b5d490", "value": "T1EC82DF3061AB34E8CBE14430EAEECEC697160BF9D0FC36D217586B78C94210661FC2CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132879, "uuid": "1c9ba484-c078-4334-ad4d-a113beb57e76", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaUzhymdGUop5h5l2:6GV0P6+kom0tVAoNvm+to1Ys3Uoznl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132879, "uuid": "4301a6bb-8fa7-4422-89a6-603e46810a9f", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132879, "uuid": "b7ba983d-cf74-40ba-86e8-06711514a031", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132879, "uuid": "e29d69f1-feb3-4a1a-8a67-6853f36b07dd", "value": "a8179b629219cb0c82bcb34a6f767aca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b7920f-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128381, "uuid": "9e1bee00-8d78-46ed-9947-e7da12c8e6eb", "comment": "Malware payload (Mirai)", "value": "b027bc4cbb58629e2ab3acaa7223ebdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128381, "uuid": "fd440f33-ea0d-4847-9885-1a99c5c70f93", "comment": "Malware payload (Mirai)", "value": "8b7a1a2adf928bce580760b54decc71a18728092acb46774da94449848cd5132", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128381, "uuid": "17414d56-20d7-4e9e-ad69-86a5ba163415", "comment": "Malware payload (Mirai)", "value": "033a8334f437b2bfd295930280d3f2cd6165f3e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128381, "uuid": "e64f6d3d-baed-4ab6-ac35-c0d56ec01dbb", "comment": "Malware payload (Mirai)", "value": "6d00e0dc771ac07d44604b156bd813035acf8071f8af6eb705853e3fed36434cbd9ad6535e9c6d4bea5b2d220b2076ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128381, "uuid": "5fefab02-9784-495e-9f2a-0b8a7727dc77", "value": "T178E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128381, "uuid": "9930499b-dcd5-4ee7-9437-cb279bd38b0b", "value": "3072:JW6dm9tS1aRGQdK76t/zCXI5mrThPaLEnvPrNb:c6IG+LComrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128381, "uuid": "a58a7922-c7a3-4762-8ec4-4a4c7410c739", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128381, "uuid": "a437d66a-5941-4d9b-8dc3-0e4bd688c8ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128381, "uuid": "7d5634d5-176f-46d1-b97d-404bfd64d7d6", "value": "b027bc4cbb58629e2ab3acaa7223ebdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca642b6c-0562-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686163235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163235, "uuid": "9dbfe6a7-b037-4b28-af2d-99c4ab44c246", "comment": "Malware payload (RedLineStealer)", "value": "7c776465e44a0c05fb8606da816d1b8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163235, "uuid": "b42baa0f-7c8a-40e0-afd2-e2cd705c88e0", "comment": "Malware payload (RedLineStealer)", "value": "8bc6658867ec4e3133cba25be87efa7e14eb0ff58ecc5259f08f4b4987203cbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163235, "uuid": "a639e549-b88b-4099-a7c4-32ad528e168c", "comment": "Malware payload (RedLineStealer)", "value": "fc650e636642c08ce9264f1af989285421e94069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163235, "uuid": "fc03e6ed-9a0c-408e-bb79-69fbefdecdc6", "comment": "Malware payload (RedLineStealer)", "value": "67a7bc191ba18430a22b688bca66d6b38da43fe93727bdbb275e611cc3a74b21d5babfccdcbe834f094f52b0334ec0d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163235, "uuid": "9f0f0cc4-262d-4fcb-9ce4-6fb52f5acb53", "value": "T1A0446B09E4AF52D2FE467175217D905AF4BF80F313BFC02ECF5A3AD21C572A096A211A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163235, "uuid": "83bcd196-009e-4e65-9630-8cb1f44ffd2e", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163235, "uuid": "8625646a-4756-4a88-a9ed-f8addaa4b801", "value": "3072:Hhg7X1JzemRyHFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2yQHcj/:Bg71JyFaQ7W05AEezbMPZFzAy2yA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163235, "uuid": "3958dace-0152-4102-8f06-6725de086a55", "value": 268228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163235, "uuid": "5b0fa990-1cf1-4eeb-9132-d3754e3ab627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163235, "uuid": "c9613271-17a1-4031-bd51-493175de706e", "value": "7c776465e44a0c05fb8606da816d1b8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea2d181-0524-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686136318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136318, "uuid": "98e23fbd-2b7f-4fd2-ada4-1e165b879aea", "comment": "Malware payload (SnakeKeylogger)", "value": "baf76800195b2f1c7842c3ea11a302ff", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136318, "uuid": "d11f32fc-fa22-4505-a514-7028a9d08ab8", "comment": "Malware payload (SnakeKeylogger)", "value": "8ca30cbd78f63de9f1c874a92df53731e1b279d61bdb70e883714499eee3fe42", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136318, "uuid": "61414902-49d6-4c1f-8d50-bdd8fcca7f8f", "comment": "Malware payload (SnakeKeylogger)", "value": "997dda0cd4c4050cfcf445ecb7417e51db2a2a1a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136318, "uuid": "b25e7958-d126-4980-9169-babb5531d234", "comment": "Malware payload (SnakeKeylogger)", "value": "a08b34ab87c4237ff674f98431b6b720c6e49039c7e8b7ce2a39a52c1d51b5951f9c8b70de2c002ea0c4390b858ddb04", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136318, "uuid": "ecc133ab-ce33-47a0-840e-4f14baba464a", "value": "T1D71533B24E58134B834BC46557E50DCE3A82924CE3E95E23A6D4237CFF9E0992E0E747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136318, "uuid": "b8ee2ca5-13a0-463f-b6c7-7280e808a39a", "value": "24576:mj5KfvVj55LCZrl1sWjDGjRf7B6KvMWUE333hCHt46j:cKf915LClsf7B6P52EHt4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686136318, "uuid": "a1241a87-b47a-48bf-9697-e56ccf54ef50", "value": 922869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686136318, "uuid": "dc2a6b56-2d2c-4bba-82da-805e00e96946", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136318, "uuid": "31fdb6fc-b217-4377-9524-6e6800c0ad88", "value": "PRE-ALERT SKLZ2112352.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c256a27c-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686128432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128432, "uuid": "b293584a-9e83-4c72-9c39-a3c7f7fa39b4", "comment": "Malware payload (CoinMiner)", "value": "2cf24e55ad1aad958e73c67878952c68", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128432, "uuid": "80d39539-a389-419d-930b-767d4e02af46", "comment": "Malware payload (CoinMiner)", "value": "8ef5c190b1b13bb8fdf5c06fbd8cec9bb68e9aea39d5eacd0dcc011bc6e726ee", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128432, "uuid": "04744497-5ea0-4c9c-96b7-aaa5ad26b5a9", "comment": "Malware payload (CoinMiner)", "value": "7a56f7906fdd057e9162956b7b8a91e3871fa34b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128432, "uuid": "3658e709-690d-4dd2-b905-b810fad53a21", "comment": "Malware payload (CoinMiner)", "value": "3f6c4ece0daa112c2fa52ae98507eb6c81834e3b5cf57531a8b8e0c087180f6f105bb04f1935648aaba13800ed3e4b60", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128432, "uuid": "66041773-7e82-4730-8613-5f39e8ceb905", "value": "T1B326F13312C3FCEB9BE22E54C6422A540CCC68F3932D7298BD5505FA65F4844DBAA9F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128432, "uuid": "a265b81e-2f37-4087-8987-c00d5a5a844f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128432, "uuid": "55336303-dd6b-451b-83e4-72d340a3f285", "value": "49152:0c+pzcyKL0jEVOlhflRZP1+mhz3UFOMcCEuJVIYqRSn:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128432, "uuid": "d59c398e-08e7-442e-b60d-9f275a2b18fb", "value": 4795392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128432, "uuid": "4c532133-4e29-4b92-a5de-cedfc2e7673b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128432, "uuid": "9032c778-a46c-4604-9686-541c681fbf9d", "value": "2cf24e55ad1aad958e73c67878952c68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6709f6-052d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686140398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140398, "uuid": "7bf6d16f-e906-4dad-bc75-28d8ff7fd7ab", "comment": "Malware payload (AgentTesla)", "value": "d968e6844283d3ab39f87324efc55fe4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140398, "uuid": "fe253d9e-8b90-4752-8579-f3f638f55b91", "comment": "Malware payload (AgentTesla)", "value": "8f4a4002934b09591e8b6f95a9ec20ff0ae4ddc48dd869bd76fc9d9f9c59f72e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140398, "uuid": "d9a2a4a3-712b-4b33-822d-ef6b5f3d3d26", "comment": "Malware payload (AgentTesla)", "value": "c12db994aa1c313bdc89a37d9aaad0c21c6019a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140398, "uuid": "a4e628e0-4e0c-4af9-8e23-0c4eee2a3179", "comment": "Malware payload (AgentTesla)", "value": "a0d79e6b54fc715500d031ab0b8b6ee75a87ef88c3365f30f4c2c762e6f372599d4d389f2d6c8975e73a780ffecedf87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140398, "uuid": "33815fd8-5932-49e2-a397-5d16e0b9afa4", "value": "T137F45F3D4AA6C9EBC0BBC3F49BCC4A5BF97CD833B4549A2B44960742624164EA1C71DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140398, "uuid": "ebc46c56-60f6-4f95-863b-c573aa34e0fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140398, "uuid": "04c7f819-6c44-4ce6-a9cc-87338f60cc8c", "value": "12288:HKfPSljSjhQUMuVGBI8yCiOuwxoeN537HO:HcQTUMGGBcCiO/tO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140398, "uuid": "37429244-2fb9-48e2-8140-56f48145c97f", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140398, "uuid": "fca02324-9ce3-49aa-8435-06737c6389df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140398, "uuid": "488cfa77-cbe0-426b-8433-9eda206223de", "value": "8f4a4002934b09591e8b6f95a9ec20ff0ae4ddc48dd869bd76fc9d9f9c59f72e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ac7ec0-051f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686134422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686134422, "uuid": "520e83c3-b93f-4b47-9cfc-38013eef97fc", "comment": "Malware payload (RedLineStealer)", "value": "591c36e996983ac12e1228f81e0164c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686134422, "uuid": "9e7665fc-f412-4c85-b902-90d3604bb35b", "comment": "Malware payload (RedLineStealer)", "value": "9168609a613120bcbd692b009ff359ecb65544547532ec030267608f9587c215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686134422, "uuid": "d8b75c7d-3cdd-4144-a9d1-8fb8f34dfd24", "comment": "Malware payload (RedLineStealer)", "value": "5f1fd2bd86a62e1173a34426dbf77bc0d92d2868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686134422, "uuid": "dd1509ad-34d5-4aec-a930-9fffd97eda97", "comment": "Malware payload (RedLineStealer)", "value": "1e6b07a231f1e906505d2842334249830fe3e9aa61705f102eb9e8af9871fbaeb52f8545d2b1f4328f892efd1663bc25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686134422, "uuid": "d41cd249-95a8-4853-989c-25fd08fc670c", "value": "T19D052387BBE48136E8B52B3048F343C30B36BD9159389B17334689AA5DB36D0A47975F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686134422, "uuid": "baa7400e-7e50-4b8b-afc3-44433014e8a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686134422, "uuid": "0bd5d409-55b0-4c07-91d2-2362545b87ac", "value": "24576:Sy/FATgwHiOLhTK8wYmOuKjHSIWYtquHiZrps/fn:5N8LJnmOnHSAquCZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686134422, "uuid": "d9abd793-334e-4192-b7ae-78a6369b3972", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686134422, "uuid": "d8f12d0c-7703-4154-b6ae-9b53a98b9390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686134422, "uuid": "d05e81bb-c5f9-4c9f-8316-4aee57fb6e15", "value": "591c36e996983ac12e1228f81e0164c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9080f695-0554-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686157125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157125, "uuid": "4ee182cd-ed5d-40b9-887b-3e5ae7df4f7b", "comment": "Malware payload (AgentTesla)", "value": "b6b1a1ec4a942a3c6daab1ea6fd8953c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157125, "uuid": "7ca21a0d-68cf-4cde-9563-0ef70965b375", "comment": "Malware payload (AgentTesla)", "value": "91b85bc8af5080a6900fac25e232068764808aa3f3bf3b2eb23666ab3a7935e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157125, "uuid": "4687de16-36ca-4759-a1a0-e5736bc2dbf7", "comment": "Malware payload (AgentTesla)", "value": "61d8d6d42a8ff073e85b45acaa28b925a6b14c26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157125, "uuid": "8afde7bd-80ab-4220-98a1-8b495a59f4e4", "comment": "Malware payload (AgentTesla)", "value": "b21200cf039e782f2881fcdd20c642d1676ce19cbcd8c19ccf6904cad1742d5f60ee7033140391085ff02102b6d0b39b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157125, "uuid": "05d40694-6b0e-4c57-98e2-40f99aa0819e", "value": "T12DF329ECD2C95D11E32D4174E4B311480BBEA9429B17E65D1DE0A8F63AB77E3322EC61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157125, "uuid": "ce30ebfc-7ed3-41b1-916e-5058db7eb721", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157125, "uuid": "110995d4-e48e-4d63-bfe6-e272c16f6568", "value": "3072:j7k55nrZ1oOWVg7nD4PRnUoiwFW0+Wm4swgHev:c5NXoOWVgbkBUgFW0+Wlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686157125, "uuid": "9b119fad-6248-4ab0-940e-88e8fccbaf7d", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686157125, "uuid": "83696a1f-6734-4a19-b9f1-9d48aa6d0ec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157125, "uuid": "8aa74e6f-11dc-4ffa-95dd-2d89e1c06c2e", "value": "91b85bc8af5080a6900fac25e232068764808aa3f3bf3b2eb23666ab3a7935e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd0f2d9-0535-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686143729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143729, "uuid": "84822613-4717-4095-a699-4fa9eb85ab3e", "comment": "Malware payload (Loki)", "value": "c32ebe58adc734406f4608fdbe7c9026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143729, "uuid": "24d16f61-1d2f-4224-9dd7-d3ac05e0b3c3", "comment": "Malware payload (Loki)", "value": "936b0a2add95132c07e4bc7ab3864171e397b5917bf193f7ff99484c2058816c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143729, "uuid": "5beaef5b-a877-43fa-87aa-09153a35aeda", "comment": "Malware payload (Loki)", "value": "a1ef6fb3ddc91d42d6eb356aaef0e283787a94d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143729, "uuid": "2d8c20b3-49d9-4b5e-9505-a9a917150341", "comment": "Malware payload (Loki)", "value": "2c6b3d32d095ae1e581047775b23b25eda0b6242815f070ecf667788e1feed4d0f065a246fe3bbb3e951a7cd6c8a18e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143729, "uuid": "8471a669-7623-4630-abbf-74fb9568e8e6", "value": "T1C3F4E08862FAAF1BC4BA6BFD0410107183F5469B313FE69B4DD274DEAE64F450A44E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143729, "uuid": "5de64ac4-a238-4f7e-902c-3d76a329cbe5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143729, "uuid": "a2f633f0-1e22-4483-be0f-641e093f3373", "value": "12288:DUlRuW3haDnLMzIL2q+RTdOL8CK9Qw5T7lQPWJva+B+V2tfTwL8e+Bd:DUlRuUOyqGUL8r9D5flQeJrB7ta8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686143729, "uuid": "ee96a906-b22a-49bc-b930-966ea971ca9c", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686143729, "uuid": "f5cd5684-9e2c-4bbc-9117-c54a22322717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143729, "uuid": "862cc896-dd77-4ffe-9006-d9071b2bb421", "value": "c32ebe58adc734406f4608fdbe7c9026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d75215-0545-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686150633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686150633, "uuid": "f2d7c002-ff4f-4a90-be6f-41f90782391a", "comment": "Malware payload (RedLineStealer)", "value": "9a617cf3d1ce2faae486771898d2ee8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686150633, "uuid": "133924d2-1f8e-44bb-a797-eabd93305e73", "comment": "Malware payload (RedLineStealer)", "value": "936b3057b9032e762cc5ce3e53e01f7e23358694fc01cef25f19261c020c2ab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686150633, "uuid": "a908d4c4-3273-4d81-bffe-a0dca7005811", "comment": "Malware payload (RedLineStealer)", "value": "6992bb7deff8a34e4d680b26bace64a6f3cfbfbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686150633, "uuid": "957d36d6-2ecf-468d-b257-d7c4aaf5532f", "comment": "Malware payload (RedLineStealer)", "value": "521f44e98bfa1b77b9f8616cd7743b94a229c94324c5e64eb4e078f9cc8fc61b55e0fe2b076fd5ec769412ca24168d17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686150633, "uuid": "6a3a0dc8-a7eb-4c14-b025-26a54a09c757", "value": "T1CEC41241A7EC8477D8F22BB219FB02D307357CA29DB4836B37565DAA1CB2580A432777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686150633, "uuid": "c9720a72-4c71-4212-9085-91fb7a017322", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686150633, "uuid": "07004a45-0a30-41e6-a121-063d0fdd050b", "value": "12288:wMrwy90/0ab4zP6cVuqOJQBw+jDb3o3GtFZdFEWQTHZ+:QydebvJEXDbYqdFEWQF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686150633, "uuid": "e3af24c2-1152-46c1-98df-e6af3b6a0c88", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686150633, "uuid": "3bdde54f-3d8c-4d99-bf71-ed5e9fb59873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686150633, "uuid": "06d156d7-5a73-4a36-bba8-60eeb99081a9", "value": "9a617cf3d1ce2faae486771898d2ee8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334477ca-0557-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686158257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158257, "uuid": "16876768-ba22-4dac-9093-1b13731692ed", "comment": "Malware payload", "value": "005d884f3769fbd87038045ab0f2e650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158257, "uuid": "6e3f5848-ef8b-48e1-a3c0-8df982af7474", "comment": "Malware payload", "value": "936bf5d3717a714beece0bffeddbbfbb9962554be8502c068f3b01544540fa5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158257, "uuid": "c662b47b-38ce-45c4-9821-15bd34c7cb52", "comment": "Malware payload", "value": "f0162bc544e095e00a946b8ee5e28172ada4ebf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158257, "uuid": "05c11498-5503-49f3-85db-6dd22e1d82a9", "comment": "Malware payload", "value": "89a77b8c0803e47f639abc7706d33da132750f097bdd908b0b25fdaf6432b833b68a5556a09757009e9716e24ac6f58e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158257, "uuid": "aa1a58b9-c3af-4a41-a507-db2c0942cd2b", "value": "T1C984E08D3B25926BE4160BB09E5FCFB143B6FEB17A11C20519E43BCF2B33B19454991A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158257, "uuid": "c57f6357-8df4-4829-8517-92971ab4f556", "value": "6144:BdqfJcJln4sL+6NMRKO2rMN/MIGGQ+yan:6YhrMpxGGQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686158257, "uuid": "0c06e72c-e81b-47b0-a7fd-0f050e9ed4c4", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686158257, "uuid": "098b12b8-fb41-4852-9edd-c0f7e22b1133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158257, "uuid": "1f13be6b-796d-4c5e-b2dd-1605e5f3fce1", "value": "936bf5d3717a714beece0bffeddbbfbb9962554be8502c068f3b01544540fa5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5fc813-0540-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1686148315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148315, "uuid": "477d0fef-5418-45ea-a5cc-f11832ae2080", "comment": "Malware payload (LgoogLoader)", "value": "98984b2f1578a3cafc6fea81fe57b2a7", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148315, "uuid": "e105c2ba-96ae-42b4-a2c4-625905a03e97", "comment": "Malware payload (LgoogLoader)", "value": "9574b45455bb27349128ee7a86c1141edf3244f0600137456868b77dcfa0cf17", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148315, "uuid": "1e15c24b-ee58-4dc8-ab62-69c58decb3b6", "comment": "Malware payload (LgoogLoader)", "value": "1d9c89ca224ecf9279394e4a78f483287f6dbbc1", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148315, "uuid": "cbce036f-5a37-4bfa-a0cb-ec17c55b35bd", "comment": "Malware payload (LgoogLoader)", "value": "740f0d76f25160783a76883ae1bd5c889da952aaf18d7751929ffbb4b6379046893bae3dcd223874e35d664f88ea57eb", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148315, "uuid": "6ec80433-85ad-45e9-a325-23c8e73758af", "value": "T122823C2173A8C356E1FF4B76A8B211801737B7B77453CB1E15D8706A1E63BC08A52BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148315, "uuid": "02385d93-d43f-4392-9e38-f285a9839a13", "value": "384:LATZSCDIwbD715gl1NAEu9QLvBB/KtNCa21wwhGhH3Uz+rWkM5y7wWZ7wW0:gbDB5ANAevvUFl3UU7ZZ7Z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686148315, "uuid": "6e2a6e99-c8fa-4b6b-bd17-d407c1d1c2b4", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686148315, "uuid": "f023c0f0-902a-4358-b3a0-384510001484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148315, "uuid": "8128a2e2-a518-483d-b184-2fe15a246a24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938ff71a-0580-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686176028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176028, "uuid": "af11e3f4-ea08-440b-8415-b8ab7071c895", "comment": "Malware payload", "value": "9ec53fc91d28e9065489ba193b5a95e1", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176028, "uuid": "ad339e84-0c7a-4419-af89-fa3dda4bb691", "comment": "Malware payload", "value": "9660bf7c71fbf39c58e017dddeddb7a726b1b26103a9bd9da991169fdb878c4a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176028, "uuid": "1fb8b505-3f3b-4896-bb21-1f061b977319", "comment": "Malware payload", "value": "d692091e647d8023756e6b35a3f6cb9ca07886bf", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176028, "uuid": "39e25b11-849a-4451-8b35-c8acab8db4bf", "comment": "Malware payload", "value": "1b30b8208ccb2147bbb68212064b547d42c714c2c83975975e1ecf8a4220da68069e126fdb2e7570fc998cce9b6bf6a4", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686176028, "uuid": "7a01e920-7b83-41b3-88b1-1733fd423289", "value": "T1518533FBA51CB44E98D3291D74882A47B534F3DD695312AAC787408EF8E44FB8EB6C50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686176028, "uuid": "5a72500f-32e9-450c-aa2e-84bc11d975de", "value": "49152:DvDv8nPwIpSekFJ0MRQo94dzu0teccovx18:DonNpI2zo94dzu0teccoxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686176028, "uuid": "ae57067e-d4bf-40bf-a303-cc9ce257f109", "value": 1874174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686176028, "uuid": "b0e36c70-578c-4515-9adf-09590b722ce5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686176028, "uuid": "ffc5ad72-0df8-438a-b647-6cc7a3d08e0d", "value": "Adobe Premiere Pro.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2908b9-0538-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686144929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144929, "uuid": "c463a9ca-1035-44d5-855f-e24305fae492", "comment": "Malware payload (RedLineStealer)", "value": "735c53e9eb46b4d912922b86e950bed7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144929, "uuid": "8a6fc32d-995d-47a6-a1b4-6aee6532e40d", "comment": "Malware payload (RedLineStealer)", "value": "9670890a1930b234b6c02bb394d0f2a3582655a9b14007b67446ce6151e12586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144929, "uuid": "48ec6522-d5a4-469a-94fb-19fa995bb324", "comment": "Malware payload (RedLineStealer)", "value": "347c358ef931bca28830a322e2db5944c231d803", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144929, "uuid": "5e2cea97-9a82-456d-99b5-3bb63b7b58bd", "comment": "Malware payload (RedLineStealer)", "value": "05dbf9a34770214e5f88580e9d45433ebae59618b4f124c05397f93bcb1c56a97698433d00496261c37fc8f838938b32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144929, "uuid": "3dcb68b4-d63e-4987-b153-cf2fda630c9b", "value": "T1C0446B09E4EF42D2FE463175216D905AF5BF80F323BFC02ECF5A3AD61C572A096A115A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144929, "uuid": "02980db0-d118-4443-9f70-1086b98d57d6", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144929, "uuid": "1572c5b4-546d-4c04-91e0-f27802771989", "value": "3072:Ox/qx1OuyRyXFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2SUHcj/:a/qx1aEFaQ7W05AEezbMPZFzAy2Sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686144929, "uuid": "4bcb1785-43c7-430d-aa87-023842e9a333", "value": 268950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686144929, "uuid": "027326bd-89da-4a9c-8b33-2cc1adf785cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144929, "uuid": "04be6bff-c302-4307-a3e6-80d242bcafdb", "value": "735c53e9eb46b4d912922b86e950bed7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0c4ad8-053a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686145741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145741, "uuid": "eb1e4a0c-2c4e-436a-a660-66eb58276d01", "comment": "Malware payload (Amadey)", "value": "6d4e908bb2d7163756d528504822fc5d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145741, "uuid": "ec27e26a-d34f-4080-910f-970adb483d85", "comment": "Malware payload (Amadey)", "value": "96d9c5386dd5a16a75211e05f2f6b937f78fe6613f42438e65f8bd927bae3ea8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145741, "uuid": "f1e83c8b-80f5-4565-bfdf-2816c125076a", "comment": "Malware payload (Amadey)", "value": "d95ee3cb703325de0f095595ea7bd7a8e191efce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145741, "uuid": "54e792e8-c270-45d4-a9fe-e05621537aff", "comment": "Malware payload (Amadey)", "value": "c4b6a60228132c6462dfae9b1730335fe034476b093ec9cf5d83dec3c18ef58df3b1f54beef8da3af8023f8a336cda18", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145741, "uuid": "0e6e90e9-5480-4291-aa1a-c5bafcf67b21", "value": "T173C41292ABDC4173DDB0277068F603930B3ABCA16D7852573B45AD5A4CB3281B536B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145741, "uuid": "bbb4da61-03f6-47e3-92b4-c8ee996c0a07", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145741, "uuid": "b201e2ec-0de4-4499-b63e-2e54366c86dc", "value": "12288:NMrYy90S1H8pPP70Q9/P2myMz49dZv1Ii94KsjSVo:FyspPP7/9HuTv1I8jsGVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686145741, "uuid": "a311ec2e-474d-4107-8820-f9720e25327d", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686145741, "uuid": "7900d365-e19f-4384-8a19-552aaba02371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145741, "uuid": "49464bd3-6402-4bf2-9738-dc2b128807bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f1459d-052b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686139525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139525, "uuid": "e47eb955-687c-42c1-b63d-33563a4468ee", "comment": "Malware payload (RedLineStealer)", "value": "1779e19fc0ddba352dfffb59f34991c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139525, "uuid": "b5e7fd03-40ca-4ca9-8830-cf1cf5f6a1d9", "comment": "Malware payload (RedLineStealer)", "value": "97c7319f607e2c4d212e6fb10027a5d69dd1bd6bebc231a3c4e2794987627c17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139525, "uuid": "f09cdbf1-2e76-4ca1-b8da-fd408bb71c21", "comment": "Malware payload (RedLineStealer)", "value": "cece1909048b8f31a8075767e525dc760ce48815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139525, "uuid": "7758a152-319e-4284-8ff1-460bc0709aea", "comment": "Malware payload (RedLineStealer)", "value": "b4c224dd9dea662eb721d91b56a6a48fc69205c6836ffa3b7caaee9d86b7609018681d36855c0b93d9c747d5d52f470e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139525, "uuid": "cb0663d2-369d-4169-ac0a-ee9a5fd3f833", "value": "T1D3446B09E4AF52D2FE467176217D905AF4BF80F317BFC02ECF5A3AD21C572A096A111A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139525, "uuid": "0cf3c29b-9bfd-4b34-800e-5c4e8b02e1a4", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139525, "uuid": "bec554e8-86a6-4457-99a9-347d7cb4a478", "value": "3072:Hhg7H811+9RyHFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2yQHcj/:Bgr81FFaQ7W05AEezbMPZFzAy2yA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139525, "uuid": "11393b0d-fa0f-4339-8467-dd39fe78b52f", "value": 268261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139525, "uuid": "058bbf90-8889-423c-8643-0575b9a5e494", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139525, "uuid": "70a61d7e-90b0-4f52-ab99-1e9f13d0d647", "value": "97c7319f607e2c4d212e6fb10027a5d69dd1bd6bebc23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd6baf7-0529-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686138624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138624, "uuid": "d304d864-43b6-4458-986b-d60101fd31f3", "comment": "Malware payload (Amadey)", "value": "ed1d992a097e1b24841a91d3ec793ff2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138624, "uuid": "91b444a5-c48d-4d57-be7e-6203d314d09f", "comment": "Malware payload (Amadey)", "value": "97e4bada64e2d85c561f64547f17845ecd6c8c3e214717eca8db5a3d5f215a92", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138624, "uuid": "00588fa6-7548-45bf-817d-06cc46f601c9", "comment": "Malware payload (Amadey)", "value": "d2808adfd04d280c15d188ac3417b98bd85a8fa6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138624, "uuid": "6d4c838c-b207-48d0-aa6c-1db87b04d53f", "comment": "Malware payload (Amadey)", "value": "28ae36594bbb24b9ac89c43c3e06c78f06cfa896cf631bdce859911d9a58984af6d1b78317767a4d75e2e6083430d0bf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138624, "uuid": "92752e74-e271-4117-a709-3f0862845104", "value": "T161C40106A3D4C0B2E8B55BB244F713830F36FD92A968975B2345A91E0CB3685F936377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138624, "uuid": "da314c5f-32aa-4cc3-ae79-ff018e8cbe2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138624, "uuid": "e9f5bc54-ee6a-4500-bf78-1b90a57045b6", "value": "12288:dMrKy90Db/wFBWwGhk41GslloP7FpFtQD/+e1qDYaZ/523UVplveVc:HyEbyBGhZ1Gs/+7RtQ7r2Yi523GjeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686138624, "uuid": "b0c9e38c-9f83-493d-86b4-4aa6d1e76131", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686138624, "uuid": "f39ac754-57a7-43bb-92c7-52d20701357a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138624, "uuid": "7f9d3dd6-78e0-4eca-8366-ed36a753a1fc", "value": "ed1d992a097e1b24841a91d3ec793ff2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11775a7b-051c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686132860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132860, "uuid": "f9b409f9-530e-4097-924b-315976964a8e", "comment": "Malware payload (Mirai)", "value": "f1371acd3566ead0d1e36224fa1b875c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132860, "uuid": "b2729d1b-ccb3-4183-9d1b-46ed6f629d4b", "comment": "Malware payload (Mirai)", "value": "985ee277520b852fa1dd9253deaad3f7d2e2f28f4a2f7bdcf2cb975883a992a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132860, "uuid": "c566af3a-b71b-4a58-b63d-04467932a252", "comment": "Malware payload (Mirai)", "value": "e2320912fec52691094caa773d8864e7d646e637", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132860, "uuid": "4a460605-2559-445e-9c94-92d5537bb990", "comment": "Malware payload (Mirai)", "value": "20e12062dab4d2f16e22771b3adb18e21a7e9bdc0a529cccd2cc8ed6730e67a5573a1c59be9c70596082fbb03396cf55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132860, "uuid": "8ad0eb48-292c-4912-a955-adb81c436ed0", "value": "T176A2E019BF28868FC836297551E9E5D21393FC61F2DDCC096940C12FF5A33AA2874F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132860, "uuid": "243c84e1-5faf-45c4-948c-5642311f8b24", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTf:O98o08kxofBE+ZkXaITbp2F2TWul0c5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132860, "uuid": "56d4c41d-a3bd-4653-9938-eab8674d7f46", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132860, "uuid": "7aefbc7b-1e0f-4bd0-a71a-96bfae1657ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132860, "uuid": "537f44cb-c096-449f-9d9e-b779783e3253", "value": "f1371acd3566ead0d1e36224fa1b875c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28e9ca4-0550-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686155572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686155572, "uuid": "ade825aa-661a-4cfd-aa62-8798a79d9afd", "comment": "Malware payload", "value": "88ba054543d5833f333978a22c3a5e8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686155572, "uuid": "6f63303c-ca57-4cc7-a2c9-65b930e9d385", "comment": "Malware payload", "value": "98b544cb9a160813bd7758ca417c4d458625a75f2fcbbc148c6fbd9bd7221cbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686155572, "uuid": "62d8eebe-4ec8-4ba6-a640-b65d4bc8f9dd", "comment": "Malware payload", "value": "54abd51df2d34f790be9c12ea27a273c23adc1f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686155572, "uuid": "ab1178f5-0c42-4d50-a993-6d0deaa17f9e", "comment": "Malware payload", "value": "40d1e1ee8dd5ba708da55c438ffac7dc618df20ffda56829e59990116a30a22bb4d2fc2707ee54a749872670ba5cd1c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686155572, "uuid": "97356834-84ba-4884-b259-7fe463375ec2", "value": "T12EA38D1276DCC2B5E41A35704C60EDB66AF9B979377F009BF78906692E233D042B271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686155572, "uuid": "1ae069a0-c48d-494c-8f40-ef795acda53e", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686155572, "uuid": "c882a552-89b6-4ab2-b0cc-f69f4c18b9b2", "value": "1536:Mp6kFya9c7Ok/YNQUgB75eGFXgizjyXX9di2YTHLYjzDm:UVBQ91wizjyHxYTHcj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686155572, "uuid": "cd8e9422-52bb-4189-85fb-24f968a0ed9e", "value": 103370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686155572, "uuid": "7857b393-186d-4516-abff-26ffccc543fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686155572, "uuid": "fb7bfdf1-c863-4c36-a221-19abf7abcfe8", "value": "88ba054543d5833f333978a22c3a5e8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcfc13d-0518-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686131488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131488, "uuid": "2da5e7a5-0293-4fa4-924e-698b2926a664", "comment": "Malware payload", "value": "8cb3f7cf43a9561c000757735a2d9ade", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131488, "uuid": "5aed0ba0-5105-423b-b4dc-20aaaeaac4a8", "comment": "Malware payload", "value": "98c4c96bfb102c1e99df83753885eaee4bdd301c3a66f1cf22205b1151e3135b", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131488, "uuid": "bc205960-2b7e-4ac7-86ce-8e65af1c90d7", "comment": "Malware payload", "value": "bd798d560ca3878657cbca958b0eef45436ad1ac", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131488, "uuid": "cbd11e4e-f41a-4a53-9310-0d7e2b6963f4", "comment": "Malware payload", "value": "d762f4e8bc28fee4c4319b6e7ad16af18ef1e5eafe99e2852f7148bf0dc9c7488e626dff3c542fe5a7d3594e6d761537", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131488, "uuid": "60f043bc-4fb2-4ec9-898a-56ab9f28a856", "value": "T175D022AE031FC2B0E799A4110260BC80A80A3DCB88EAEA5623C0DD8CBC540C69A9C2D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131488, "uuid": "56018de0-1e9d-495e-8156-3a060089c510", "value": "3:J25YdimVV3Cid2mqRAbABGQZGQsG4vnKLxtdggFtdOLHK0hpBKvQT0rKEgGGwW9C:J254vV3rERYFeJ1nd3zkrpshf3Isn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686131488, "uuid": "f80ac049-f52d-4e41-aeac-77a759f7b436", "value": 198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686131488, "uuid": "744baf2c-b6d7-465a-8886-1677fb7aea8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131488, "uuid": "b87bfc7f-4449-4b6e-a7b2-50877c7f7bc6", "value": "FACTURA_PDF_XML_114147.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05ab259-0517-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1686131006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131006, "uuid": "de14fd4b-bcbf-4edd-820a-ff729e23d6ee", "comment": "Malware payload (ModiLoader)", "value": "77c4ba4bbe552f3b305cfa950462fba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131006, "uuid": "7a4693af-375e-4b2b-94bd-d1292a782daa", "comment": "Malware payload (ModiLoader)", "value": "98cd6aa9cedc5d3274cd73ff6e1cb7cfa382bdb96e3380b6dcc92fa052c54fa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131006, "uuid": "3f600675-cfa0-41ff-a8c5-df5fb13105ec", "comment": "Malware payload (ModiLoader)", "value": "944781779ae51b4dfba78974d042e89b5d38d53a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131006, "uuid": "91058587-5c8d-42ca-b690-88e917e7660d", "comment": "Malware payload (ModiLoader)", "value": "49a4dcf2c8adf89931929a0ef6fcd3c7ef26e96b20243b0c7fbe50ee7a7dff0c24709068810b1a50bca0a07d8f6e23a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131006, "uuid": "e5d034a0-5095-46ed-b9d5-8d650f271fbc", "value": "T1C515CF22F6F15873DB6627399C2F6671D829BD101B1C987A6AD4BF0C2F7824878211F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131006, "uuid": "21abbc87-7abf-458c-8253-bd0d3cf23fc7", "value": "56b9ee34a3c873bea4afe3c0ca147de8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131006, "uuid": "6fb89f2b-322e-40ca-8572-48895889ce5a", "value": "12288:l/AeU0+lRGAb9ROvbNuMmUn/LR4q8M+nqwtv07P1O9noM5:lIBljROVrn9J8M+nqwh07Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686131006, "uuid": "900e6e9d-8115-4237-aebf-ebb1ada578ac", "value": 926208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686131006, "uuid": "19ba2af3-b16e-4508-8d5a-0a70bc91b1e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131006, "uuid": "df4e7a71-990b-4ffd-882d-47510bf02ed7", "value": "Dqypwywtvzlvos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f74313-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686130046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130046, "uuid": "ddaaaf8e-0a82-4208-9cd9-dfd83c2d303b", "comment": "Malware payload (GuLoader)", "value": "0d2e4274ae8de3593012191dd99d5e1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130046, "uuid": "2ee58d7d-c511-44c7-a7b9-f7d405705bae", "comment": "Malware payload (GuLoader)", "value": "9938e72cccb668d8c7523419d5eee1fc84b18e77f5e7a1413e1ad9196e30d192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130046, "uuid": "1f75ec0d-d49a-452f-84fb-e6fe52442a9d", "comment": "Malware payload (GuLoader)", "value": "6a80537971b62e2a9f66eebd5d4e23dc71c282bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130046, "uuid": "d9f69a02-0ed5-4fbb-8978-349e374a93a6", "comment": "Malware payload (GuLoader)", "value": "5b5f1a375d57425d600fdbb928c63dd5659f9d93334bdd188c73cd11238f0ae4334fe24122faed4a7975f87c02c9b368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130046, "uuid": "6d89b11f-40ef-4ee0-a242-41abcba53ba9", "value": "T16B741242F3E0C957C89905B80C3AE67B65765D28E5A0CB0B4725BD2B3E73243352F59E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130046, "uuid": "e947f1d5-26c4-4e28-9fdf-af20ac32b16e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130046, "uuid": "70e75368-a7fa-4e46-be52-b52f2fca2f74", "value": "6144:OQ606xHPOp6WkNXYv/thvEu/5ZBeeja1UN12CiNI2/vMssTyCRLbz8KHvtdOTOl+:o2QWOXYHtXRZBxwu/1RlTyaPz8m+6R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130046, "uuid": "96232e86-1f5f-4e92-9374-77fee25dafc4", "value": 354315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130046, "uuid": "3058db44-8015-41b0-a40e-e3fabadb9d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130046, "uuid": "b1e1ee57-90c3-42e1-8b97-cd7221df55e8", "value": "INVOICE.213223421.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870e5023-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1686130051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130051, "uuid": "d6428762-7c96-4601-9b33-3ac6e20b6ec4", "comment": "Malware payload (AZORult)", "value": "e6a09e4713d0c784e49df60c2e5c8a04", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130051, "uuid": "80e32ab3-a850-4354-bfd0-fab7d2dd20bd", "comment": "Malware payload (AZORult)", "value": "998d28a2c59b92b100d6f8aab0e688fd70b18426b6c05e6b95bf9cbaa71b1f1a", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130051, "uuid": "925baf34-192f-4c98-a702-1df1214e7f18", "comment": "Malware payload (AZORult)", "value": "d06686c683db6f07699a1689591cd412fd0c58e3", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130051, "uuid": "c13cc9f3-3f2c-4b4e-86ed-b48b5edc2f7e", "comment": "Malware payload (AZORult)", "value": "bda0721bc2a7fd727b1758c8e6fda6843f39f636e4e79829f652057603824afeb269027642ad11e7cde125734b2044dd", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130051, "uuid": "4f65b736-5070-4fe6-8893-ce62eeebe9c6", "value": "T110C4230827B8E463D8B31E761863BA1B6D367D302E56971B0758375E3F32386B92E095", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130051, "uuid": "0e089e87-f2ab-40f6-a8eb-bdc00b3ea0a9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130051, "uuid": "f740177d-511f-430a-a7e4-c809eefadfa3", "value": "12288:hKxSm8n8DEm5AYX3CkTWP+X1apyAMwTf5omVVN7EI:c88Qm6MCky2X1aPlVVJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130051, "uuid": "a5b675a0-2d28-43b2-a856-b3626c2371bc", "value": 567048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130051, "uuid": "c2271976-e842-474c-8290-c184a37d6293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130051, "uuid": "1f7020f2-9ed2-4d26-b340-49236ac559f2", "value": "No. PR216696.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ace393-04ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686112679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686112679, "uuid": "67b99ed5-b8f0-4f85-9586-761486def591", "comment": "Malware payload (RemcosRAT)", "value": "33108fe9d2b46a295190763ebb4083f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686112679, "uuid": "02188811-4abe-42c2-8dc7-e384b7e50e57", "comment": "Malware payload (RemcosRAT)", "value": "99e559cde8a3871a1c1d045ff0f141d01aeff386c2798c127fdacdff6b193f17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686112679, "uuid": "33d21f1e-d7ec-4ff9-a6ea-c13eb68c5472", "comment": "Malware payload (RemcosRAT)", "value": "28926c7fd4b1271230a0cfcf2d193ef7cd08e17d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686112679, "uuid": "10b0ec50-9161-4db3-8627-87b52b20b9f4", "comment": "Malware payload (RemcosRAT)", "value": "7df95d9b76fe3bda71c974583c78390704987cb50dd28c0c38c495b03a3559d706f3d9baff3901ecc9826d36bab23755", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686112679, "uuid": "dd95b320-e183-4f09-b2e8-bf508adc322e", "value": "T16015F161DE14B6E9D0BD033844B1842E42F2BE7C0189CB0A6DF7769B3673996B7270D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686112679, "uuid": "62cbf267-378f-4447-b4e1-24a039fa686a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686112679, "uuid": "24207888-58c4-41a2-8f0e-fd702f15c65d", "value": "12288:1epHyX2+Q6gmk12kka/ZzT9+CnHYNTQErfawt5IPzKi0:1epJHDskkKpT9hGZrfHtUzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686112679, "uuid": "d740230d-0ead-4543-806e-17dee308ac50", "value": 920064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686112679, "uuid": "fc4408b3-e358-44df-95f3-c41b3e82e575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686112679, "uuid": "ef5816db-c991-4b25-8e9a-253d4f901b29", "value": "33108fe9d2b46a295190763ebb4083f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ee3fd2-0563-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686163546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163546, "uuid": "059277b9-aafb-435a-ada9-45fa44d882c5", "comment": "Malware payload (Amadey)", "value": "00e3cac747c42e219206371899de602e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163546, "uuid": "283daa8b-56f5-4fe3-b349-f3b25fbad688", "comment": "Malware payload (Amadey)", "value": "9b4109bdca72c95b887b10d90e4162e50786fe38856f0133f2fddad35c15bcf5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163546, "uuid": "03f9de0d-3847-4279-aa89-dee05275f2f8", "comment": "Malware payload (Amadey)", "value": "6b48d78dbb16b3ae7d8ab3becbdbea3ac0a4f744", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163546, "uuid": "7e486634-ab25-4ec9-ad5f-added3559886", "comment": "Malware payload (Amadey)", "value": "e3b38776e2882d54d710bdfd2ad0f970020524f47ec2716dda05edcba0e2bb7782d3be8fa12fcab12a269f5a75a453c1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163546, "uuid": "ae35962d-e5c1-4625-af06-3e755f76cfe6", "value": "T160F41242ABD84122D97217F048F60BC31A367D60CA74A77F3689A51E0DB3B89D47673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163546, "uuid": "0796fd22-661c-4b55-a331-7b5266dd63d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163546, "uuid": "988dadf0-6677-4886-a37e-a357e3654197", "value": "12288:fMr1y90FDqDf1iz0T8Ljuj0+/tj2J8xnoH4wppaZGZE3zVFIuq5AIxixlLb4Q:6ynfEzVjmlqHNppaZGZERuuOqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163546, "uuid": "bf3d73c8-41bd-4c3d-9c90-c40cb4b326d5", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163546, "uuid": "a67e7e9e-46d4-46ce-b17f-c3f942b7827d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163546, "uuid": "d508f101-9222-438e-8b01-3446dbd98185", "value": "00e3cac747c42e219206371899de602e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4af497f-0585-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686178258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686178258, "uuid": "2e94a2c1-7f1a-46a6-945e-639231f64ebc", "comment": "Malware payload (RedLineStealer)", "value": "031be39ea1517e4e23c723382149d76a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686178258, "uuid": "4524c5dc-1749-42be-b4c4-15e4f78ba13b", "comment": "Malware payload (RedLineStealer)", "value": "9cdd1ff2fd5e75f71bf55170e2232f912db81d2803383b465b378446aad94eb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686178258, "uuid": "7f24ac9c-501e-461a-a917-ae18073dff24", "comment": "Malware payload (RedLineStealer)", "value": "678db219f3ab27b6b690bcefc70b0e549c2bc7c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686178258, "uuid": "50d9b8d7-23be-4e18-b38d-1d3c551b77c4", "comment": "Malware payload (RedLineStealer)", "value": "67c1c1f07a9bcdc8ca9030e47129b0fc503f150e6986df9dcb8adf4dc26796d202ef693100445259ec06e5c843ae9948", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686178258, "uuid": "cb163aa4-5221-4ae3-a216-d15dce727a45", "value": "T14DA35D3067AC9F19EAFD1B75B4B2012043F0E08A9091FB4A4DC154E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686178258, "uuid": "e6fbcfc2-aee0-4846-ba89-d25ae65ce416", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686178258, "uuid": "ce1bb9ea-0344-477b-b9e4-37a7e5ba7184", "value": "1536:5qsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed283tmulgS6p8l:XEwiYj+zi0ZbYe1g0ujyzdG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686178258, "uuid": "364cfdae-4ec2-48c5-aba3-d3598d663aca", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686178258, "uuid": "73a72978-eb84-408c-a361-d981ae518fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686178258, "uuid": "129da15b-15c1-4936-bf38-fb5364c126bf", "value": "031be39ea1517e4e23c723382149d76a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8c1dfd-053a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686145735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145735, "uuid": "c999db9e-ac96-4a2a-a732-e80f48362c30", "comment": "Malware payload (GuLoader)", "value": "a413d04a39c86bd0b4ca116227d20a30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145735, "uuid": "84112339-20d6-4766-8249-9d5229f5a9d6", "comment": "Malware payload (GuLoader)", "value": "9d5019cef8a6bc52d94e6b4becf6249f2d202ac90204bbf508f9e62454f2f2fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145735, "uuid": "5949163d-e5ce-44e5-b79a-234d3e30087d", "comment": "Malware payload (GuLoader)", "value": "0d88f2cca0aae58c31add82851c42fa1702cd4cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145735, "uuid": "86920d2e-3ff4-4abe-b7e7-7cb76ec82ee9", "comment": "Malware payload (GuLoader)", "value": "4cf0b4a67477d9c00bcb82f6d44fd54c415f29a20afb7468c38008b18d8b111f891c1ef66cb50e2a779705438ab4a60c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145735, "uuid": "50c660be-6e92-42d1-a101-d3abed6cc200", "value": "T1025412833AF49097F89905700ABFBDB8B7BEBE1A4694290E73927F587933241571134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145735, "uuid": "583e6486-769d-43cb-bb5c-bd989fe8ebe5", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145735, "uuid": "4fa850b1-e3b2-435f-9bd3-e56aeb4c0c2c", "value": "6144:36dmbMKjUztT0dAxqLjd07V8y/6+8DXDQ9NA6igSOyxRVMvM:h4AUzt0dAxq/ky+8nGig3yxRuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686145735, "uuid": "58ecc14f-2e34-4fd2-87e1-2f2b81817520", "value": 292152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686145735, "uuid": "f4881eae-81f3-455c-931c-7568d9208929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145735, "uuid": "ed31bf57-4582-44d3-b300-47e15d919b2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620753ba-0542-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686149316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149316, "uuid": "23fa92d2-6389-4b48-90a3-dd45f844bf22", "comment": "Malware payload (AgentTesla)", "value": "e34adef9af9102860d0275d450cb09b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149316, "uuid": "1cda0b39-40df-4032-86f9-249d2bc4e4a0", "comment": "Malware payload (AgentTesla)", "value": "9d99e92f740dd7c27105df1172ae3787f3b540d846385f61d302550c372391ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149316, "uuid": "fa12f99f-4233-4bb2-a4e5-1c2a4a04863f", "comment": "Malware payload (AgentTesla)", "value": "6e8b33bb03624893f3e330665ab72a4f3d3c6628", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149316, "uuid": "36decddd-d0ac-446e-a511-c0e280a5648d", "comment": "Malware payload (AgentTesla)", "value": "b4c23fee8082f2789063e2cb9535695c01fc55c803e9cf4d78ea36c52e4a7ce38dde7059a3ceca16ed2ec474a0acb04b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149316, "uuid": "cefdb0db-d70e-4627-b0e4-4f85a965ca46", "value": "T14FC423E3ADE2753D677AC7307B79BF802490D58C52E1D4294C18E623E93F849906E2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149316, "uuid": "00bdfaf4-fa6a-4a68-8271-6946df07c8fc", "value": "6144:6YcE/GFFPK09KKyeBrmkcLASB//ojFwOIVnrlLdto3r3CPve270GdQ/t639rjGCL:DNUPK0QFenQ//sFaBLSyHxVNnlA31zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686149316, "uuid": "93719375-afa3-4b20-84fb-26ee50a638c0", "value": 589992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686149316, "uuid": "2eb2e919-0228-4f36-97a1-3e3298acab38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149316, "uuid": "f1a88f3b-7045-4ab2-a417-114ac9d7c365", "value": "Order FC22068032478332.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ab019c-055b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686160013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160013, "uuid": "c3a09dc5-7915-4a8a-9896-d4418d13e66c", "comment": "Malware payload (AgentTesla)", "value": "5cd5fbc9eb0e11de5d6a915826d29b24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160013, "uuid": "85ce7219-3527-4804-943c-9557d84d69ad", "comment": "Malware payload (AgentTesla)", "value": "9e7d1abe2f5fdce4a9a6ee0119efe08c5ccad3a27a1728471e13a32ce7574057", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160013, "uuid": "95121ef8-04de-49bd-be0e-c94a1553c75f", "comment": "Malware payload (AgentTesla)", "value": "1a14a674e3a97742fa8bd20798dc58fb69c14004", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160013, "uuid": "d250e3b9-b5fd-4eed-8571-2c5dcacca8b0", "comment": "Malware payload (AgentTesla)", "value": "81d4af876d29b88611402e14d69c72bcb290a6d8426a14b1033a129639414437fd8111c09126f778810cbd148e5bd7e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160013, "uuid": "5bf2caf9-7324-4200-b3b9-90cff42fedc3", "value": "T19815CF60A6E9D6CDD8240BF0A1D2D4F017265C28E5EDDA570EDB2CDF30BAE84316653B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160013, "uuid": "e882c4e8-02e1-42e0-a6ce-75268e43699b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160013, "uuid": "223b20e9-705a-40e8-959c-b04b75fc8f36", "value": "12288:w2iNfUFotEvZ41fak5pnASBR4lFhspqPwHCZnei6ad5+vDGXycj2C2+O0:w1Bs0qZ4VlnAST4lbwHHi6ad2KvC50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686160013, "uuid": "ff313bd9-07bb-437c-9015-a6f7762a3da6", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686160013, "uuid": "1939a40b-ab12-45c6-85f5-206206b907b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160013, "uuid": "60057f65-e1b2-4458-896e-1ef8c792b526", "value": "9e7d1abe2f5fdce4a9a6ee0119efe08c5ccad3a27a1728471e13a32ce7574057", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccaa0089-0562-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686163239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163239, "uuid": "e07b5387-5f50-4369-8b83-efcffc3a87fc", "comment": "Malware payload (Amadey)", "value": "47d2db323172639af7fdb7095a89f83b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163239, "uuid": "3bd1b62d-f00b-4418-a98f-1c0e7ee7af85", "comment": "Malware payload (Amadey)", "value": "9faca33e220f9b75c3d7df6f750927ceb738d5ae349b41d22f1a30f15954d9b6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163239, "uuid": "03e90d2e-4d8b-4ff0-93ed-eeb164fcd857", "comment": "Malware payload (Amadey)", "value": "42a2e7872eb0f1aee760f3f055f9d45794efd5af", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163239, "uuid": "dd022b25-24ca-40f0-9944-3895254a24b4", "comment": "Malware payload (Amadey)", "value": "5ee419c181e8560199c9a6f9ffc79267a9ce277f6505d37320a0746d29a75341dbaa4f62e28a316c2c98a8eef2c4a210", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163239, "uuid": "a54453c0-6f68-4cb7-b8ab-2da2a7c4c18d", "value": "T172052392A7EA9233DDA417B018F743930B397C739D2983AF2682AE060D736D55472737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163239, "uuid": "e19d2cd7-762c-4a17-be48-8e5eddcdfd73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163239, "uuid": "701b6410-5303-4cf7-b6e1-d134bd72d7b4", "value": "24576:cyEu6jokV1w5W2D3c7NH+OeqxDqNjHgn:LB6sS1D2DAxF/uN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163239, "uuid": "e4d6f7d6-f7a6-499e-b62a-67991489f89d", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163239, "uuid": "8688ccad-87a8-4201-b9f0-d991c97c118f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163239, "uuid": "821cea22-e974-45ed-97fc-b625d73ed3f5", "value": "47d2db323172639af7fdb7095a89f83b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cfb12f-052e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1686140732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140732, "uuid": "202e7b8b-6f12-4e0b-8709-5f3c07758af0", "comment": "Malware payload (NetSupport)", "value": "172674fe689378dae5d2782b143aa61b", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140732, "uuid": "d47109c3-d580-4379-9daa-6e1cf6d338d1", "comment": "Malware payload (NetSupport)", "value": "9ffb17c268ec29073d10fc21ecd89edc4505718fe254515b2a7175fb7fb5a9bc", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140732, "uuid": "dbb6a494-b6cc-4de2-b957-905d1ee5f5be", "comment": "Malware payload (NetSupport)", "value": "6b11c36b663eb675e0dff58b8486fcd452cf7dd8", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140732, "uuid": "f1382f9d-9ac3-47ce-9b3a-f7aba22cd647", "comment": "Malware payload (NetSupport)", "value": "25aa18692607e9076e6847aaf807e4c45c7e0e04f46b8b9467805f6e96cb32558eae05be5d2fa77bbdf85b0f25e3f6bf", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140732, "uuid": "2c087459-c9c8-4062-809e-811e6131f908", "value": "T11B22BF7EC7CA61BA4C96CC1595957F18078CE99CA52BA92FE2D401BD76C18837498382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140732, "uuid": "5e5f9334-8dd8-4ae9-a6d0-7163f0377099", "value": "192:yZBiR+MuggQxTnVcxFaG7hRVx6yRWfrY2hdQVDWtqtOC5iPnkWN/2Nlw46FiAWyX:uBUOUjVc/7hhDRWfJwFD8EKl46sM1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140732, "uuid": "38f1572a-34b4-4375-992c-394ba2a987a6", "value": 10839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140732, "uuid": "0675302a-03bc-46bb-82a2-4e78ed79eaec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140732, "uuid": "8ec8bb25-6ca5-47f3-9ea3-83cb12a611fb", "value": "TRX602602.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c95d9b7-0518-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686131188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131188, "uuid": "64924b76-4e5a-4a0d-8ee8-9be854f7170a", "comment": "Malware payload (AgentTesla)", "value": "48a059e7b479157b8e2dabe1a12564da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131188, "uuid": "acedf1bd-3302-4e9c-99fd-aa11b2595cbf", "comment": "Malware payload (AgentTesla)", "value": "a0787c1c94372a5db2c8eb50b3e33ad43fbfc8f8cfe87872a549ee251bd1e766", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131188, "uuid": "a381f1e1-f5dd-4159-bf9a-03addacd709c", "comment": "Malware payload (AgentTesla)", "value": "eccd7ad61e8cc81acaf92c7cff86ed7ba24513e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131188, "uuid": "e5ddb2ef-8104-45b3-ad63-cd0599168a80", "comment": "Malware payload (AgentTesla)", "value": "9af6bc8fd099390da07fbe0e68be24b58ceab0f4f281fb5b934809fdd67ed3d017c48035d0b8744606623b539f72cba7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131188, "uuid": "cb45d16f-6e1a-4f7d-a87e-069e10103f73", "value": "T1A6F4026823F3141ECD5D7FBD1C4946B8CAF9A6463522D3938EE6748DEC68F458A003A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131188, "uuid": "d7497792-f42d-49af-a819-e39f59a535ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131188, "uuid": "df36c1b1-9906-4a0a-924e-d48e65fc3ec5", "value": "12288:pd6L7PVkfliIbhaDnLMzIL2q+RTdOL8T67jjYVLNnd9AjJhlEoKQZLp7iABLDY2n:rOyqGUL8T67jsVLvWNhlEoDZ9mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686131188, "uuid": "3ffa4362-0f0d-4489-a7f8-741dfa829f40", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686131188, "uuid": "2ee7f598-821a-40cb-804b-6f98f3bfa53e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131188, "uuid": "dfc3336e-e114-41d7-ad93-e40463455b21", "value": "OriginalCopy2023001982_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df30e357-0517-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686131058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131058, "uuid": "9e0f8a13-8885-4384-a4ea-590a3454ffd2", "comment": "Malware payload (AsyncRAT)", "value": "f01a50aec86ae6ece648dede1f6dfe0b", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131058, "uuid": "361dcc09-6141-42c6-8350-c6c56d772826", "comment": "Malware payload (AsyncRAT)", "value": "a1158bb27506c07d1c7b8967d5acb78bf4918f3df265a46a65dcaba4d4e78f6e", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131058, "uuid": "dd215dd8-c911-4f91-b994-f056b7c92a18", "comment": "Malware payload (AsyncRAT)", "value": "cc81ef9d19b6ade789a42661b89b0ff835e15cfb", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131058, "uuid": "83dc4115-14df-4599-bc92-c058522eb3e6", "comment": "Malware payload (AsyncRAT)", "value": "1496ff55d672604403bb69177d848632d60dee5cc3b51cbff374cb500d0e4518bd04638feac6ca38f96e277403396717", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131058, "uuid": "dadbae12-3ccb-4958-8136-f9886433c99a", "value": "T19CC423C915C46DDD48288F4DC27D0ADA1F4337CDE346ED968638E52366E1A2D39BBE80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131058, "uuid": "3ecea798-910a-4c05-a446-c3a0ada831f0", "value": "12288:SHV+AAOdKgOGrECXaVL0fSspiqgZLSchlcwiupx8Sotj+yEGWsE3gE:8+AAyOGpq2hiqgF3h3iu/8SYKGWgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686131058, "uuid": "b407ab29-e8ee-4694-b7e6-15fa0160efbc", "value": 551581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686131058, "uuid": "84734b29-a78f-457b-b694-d1f073e76866", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131058, "uuid": "34a891f1-7a93-40d6-beff-d7c09766a340", "value": "SVD002837727.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000e1904-052a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686138844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138844, "uuid": "6a56783c-e020-4c84-9570-95752dfbec74", "comment": "Malware payload (AgentTesla)", "value": "2778a74be7089ac067738624c4e31537", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138844, "uuid": "d7c3d742-48ed-406b-90b3-43e8ec9878e6", "comment": "Malware payload (AgentTesla)", "value": "a17f5b2ba04c514be3691a58b0f7b24e127b126993a933fa97d7f7de8d7c864b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138844, "uuid": "851140ed-7b71-4c51-b943-bf58b039e973", "comment": "Malware payload (AgentTesla)", "value": "8d14433fde8afef416231f8a764ae8bbef7816e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138844, "uuid": "7fc6d877-35ba-462b-bcbd-9005f11a36df", "comment": "Malware payload (AgentTesla)", "value": "6778eadcd50335196d885342f71a3378360f664bac131a366db27af2e4ef6ca615ed5f1d62320bc805d38c831f1c55f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138844, "uuid": "bbe384d6-e073-4b83-8255-a2fc9263de93", "value": "T11B34D05277974A25C94F4675C0D7122003B2E3472733DA8A2ECB87995F1A3E76E8D3CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138844, "uuid": "891be293-1ac4-479a-84db-1a1b955eb7bb", "value": "6144:A9laR6X0K7AyQ1JP8a3N/x6DC0qO6hvIt88Li/6XRn4:CaRaANH9/Eu0JEn8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686138844, "uuid": "555c9ac9-c7c3-41fc-af4d-9c3f8e803c5a", "value": 250952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686138844, "uuid": "7a9b57b7-9125-4fcc-8bbf-277cc9be2785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138844, "uuid": "3e03c5e9-a62a-411f-91a8-91f678194960", "value": "a17f5b2ba04c514be3691a58b0f7b24e127b126993a933fa97d7f7de8d7c864b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b452c9e9-0526-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686137428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137428, "uuid": "ceea2856-322e-4014-b852-21a3cf1a4cb9", "comment": "Malware payload (SnakeKeylogger)", "value": "5b0a16cc56e658b47133070d5ea2581e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137428, "uuid": "fdda6055-ce8b-4ed0-8c94-8a3d736cc10e", "comment": "Malware payload (SnakeKeylogger)", "value": "a1be5df8a8e93866e76f9c64a4e4964dfea4d77b3acc89d7a8d08c152ace7f24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137428, "uuid": "ede61de9-d21b-4665-a00a-eda17cb5ac87", "comment": "Malware payload (SnakeKeylogger)", "value": "6fe1dff34d691949cd6182d07638463f1b28e972", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137428, "uuid": "89daf246-3f88-4fd2-a7c2-ea60d40a2262", "comment": "Malware payload (SnakeKeylogger)", "value": "984ddd7323f12f958f164df1ee6bad04427a57533d4bc4e3ea3785ff85bc436eae659167432c37d58acf39ba32162107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137428, "uuid": "1af8af88-1e89-4876-b5f1-7869119f90ff", "value": "T122C4D16AC2B48F01CA5C4AFE5C93C6C206F499757D25E9311F8728CDAEA3A3F64441ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137428, "uuid": "6a382adb-7516-48f7-9df3-7e76ee38d012", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137428, "uuid": "cd1d9f18-9539-427f-8861-7efbac62bc33", "value": "12288:ldAwhh2Y4YWMxcttBus0DDXITsa2sJ+NNv4ANX8gF:Ywhh2Q+jBg0TsOJGB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686137428, "uuid": "c9b305d9-7f16-44a0-8c69-f0d2a0692907", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686137428, "uuid": "dba3dfb4-e901-4a1c-b2bc-42f0392d1950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137428, "uuid": "21b00c79-f60c-4ae5-aeb4-97378d36733c", "value": "a1be5df8a8e93866e76f9c64a4e4964dfea4d77b3acc89d7a8d08c152ace7f24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204e4e87-051c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686132885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132885, "uuid": "e4ee249d-08d0-4dfb-9ba1-1e5148757b8b", "comment": "Malware payload (Mirai)", "value": "7f52efabf1f001f3c651dcd36582a51e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132885, "uuid": "dfcee577-80f6-4a9e-ac33-3e601c697660", "comment": "Malware payload (Mirai)", "value": "a1e2c38fa7f587ccfce4886be5c3486e08493267a02293a99f479caa1aaf5f7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132885, "uuid": "0ac71455-eb21-4f3d-add8-d0c6397cb543", "comment": "Malware payload (Mirai)", "value": "fa85589786257259df04b62343786e965a580139", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132885, "uuid": "f1e668d0-0f96-49f8-ac0f-2c3ed89e48aa", "comment": "Malware payload (Mirai)", "value": "69c10e6b35eb41965a4119c6cb665ce0dce41e1110b2a97fef238ca522731a9e535e11ec08af74b463ab8492a953476f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132885, "uuid": "2c238a2e-cca3-4b81-9ca8-bb3156174add", "value": "T1B6330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132885, "uuid": "f7e0199c-916a-4df9-8254-a70deec5c14b", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oG/:r/hqaJMDg9eqK806MHdkfQX6HuC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132885, "uuid": "43d91887-99c0-4ef4-9309-1094df36747f", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132885, "uuid": "67cd37ca-f2d8-4fa7-bf62-36a823ddf1b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132885, "uuid": "048664ab-bb2f-426f-9ec2-1725304de80e", "value": "7f52efabf1f001f3c651dcd36582a51e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56fa27db-0529-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686138560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138560, "uuid": "f9c3a37c-e6ac-4ab9-96b8-a20613058406", "comment": "Malware payload (Formbook)", "value": "4c9d490c41c872311332c0cbc2a999e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138560, "uuid": "a24794cb-0f00-4d47-a84b-d1a180c08a1b", "comment": "Malware payload (Formbook)", "value": "a1f8e5efca3676dae1b403d30644419c8a737028327a97f0adcbb09d18cc21ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138560, "uuid": "c432812b-a1f6-4e34-8128-356785f5a993", "comment": "Malware payload (Formbook)", "value": "8e5e136ccb4865f6c66fb596b0fb10338e77d04b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138560, "uuid": "bda8d273-71c9-4e02-ade5-bde30cf6f440", "comment": "Malware payload (Formbook)", "value": "eae5dca530a070b4e076583bf590e39eee7a502f98cecf641d4420fd38a27815e35fd6bcf0c5dc29ed1246de6ad2b6c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138560, "uuid": "a3164570-d90b-4bd4-bd50-57e346f67337", "value": "T1A405239BD831357AC8A97AB273432D704F2C5EF4888637370591EB79323548AEEF9491", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138560, "uuid": "2d3316fe-0118-4ba1-9832-37de22e0d2bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138560, "uuid": "3f98fb55-eb9f-4483-a920-44a36be01bcf", "value": "24576:dhrWy28X0DhRPKGmZaSfIjWwCyHdgtVjBv0I+:nWy2Y01NKG0aE+CyGvjBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686138560, "uuid": "29e86065-89b2-4ec4-872e-f0308135c2ac", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686138560, "uuid": "a0e5765e-f87e-4bbf-8aea-5b0294a21cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138560, "uuid": "27c378d0-c8de-4e64-ac2a-43043466d010", "value": "a1f8e5efca3676dae1b403d30644419c8a737028327a97f0adcbb09d18cc21ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efb447d-0580-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686175886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175886, "uuid": "c9e3d03e-d9fe-4ccd-a3d3-e68d799ae7ef", "comment": "Malware payload", "value": "98c0f75d71374367bdeb0e0d71588e7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175886, "uuid": "0c9e5913-d668-4030-be3c-aba08a67b1ca", "comment": "Malware payload", "value": "a2030ce8c3794461b8bce0a2538f154dfa6c7121c1f9ad65a3c4e2362bb442ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175886, "uuid": "c318351d-7974-4eb2-a52f-52102d11d19f", "comment": "Malware payload", "value": "1ab49da2ba507d43e292a5687b5c3e27a60d3d79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686175886, "uuid": "b296ba50-9841-4081-b897-2a1f93b0eb6b", "comment": "Malware payload", "value": "e73d4be1ec239943f5c96ef19eced77b41a134682dccb5f1fd6ac54972ebfcb9ac9c86bd108578f8bca55824908d5867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686175886, "uuid": "6a1bd9d8-33e2-4785-84d7-1a14e6c85d9c", "value": "T12C04C458364B697EC96F887D9C604CE0677CACA61246AB078C8EF0E43D3A7D19F151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686175886, "uuid": "95608f5a-27ff-4707-8475-1ba60f30e75a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686175886, "uuid": "e16bcd76-6e1b-438a-9f05-62908413645a", "value": "1536:HJr5jvD36sv0W7THexhrHKCRM6s8WLwE6sxNKFYQPzbucttZZrj0GkRH8e8ho:HJr9v5+OCqV8dE6sxNp+ft/rjE8e8ho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686175886, "uuid": "7563739c-9e15-4c0b-bbc5-b5ffdd531e2e", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686175886, "uuid": "2110566d-da47-4add-8fb7-e052366edbd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686175886, "uuid": "56d23780-7617-4971-80d6-8adf4385a9c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c393cc3-0518-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686131375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131375, "uuid": "e6c9592f-3cf8-4487-a382-4b174fd35c47", "comment": "Malware payload (SnakeKeylogger)", "value": "6a6816bc6f0c4e9da9f8b5ed0863eed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131375, "uuid": "8b0c6632-f874-453e-80bc-32bd89af6214", "comment": "Malware payload (SnakeKeylogger)", "value": "a278b60ab0bd9823527c0d86509a3a5f31f107e4f8e70761cd62395e27738a0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131375, "uuid": "120309e8-2d3d-4db4-acba-cc543d94d36a", "comment": "Malware payload (SnakeKeylogger)", "value": "56d2c76029c5d2036a697f2b9f1e5f9564f7c2ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131375, "uuid": "f92bb8c8-6de7-4329-8394-17519050be38", "comment": "Malware payload (SnakeKeylogger)", "value": "8ae4f9cb6cd1f9b68abed237e82fa4af70ccbfbd419df13645a7e58430e793e0e467667df3a8a57eb0e2905db3a9a44b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131375, "uuid": "456a5aea-c0c2-467f-a039-2ff2a798ebe3", "value": "T1AEF4122C46FB065DD9AA3FBC0C6002B7DAEC6A85B02BD1675F77AC1DCD12B150ED41A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131375, "uuid": "4408ad7f-a535-4d67-a2e4-b996c7c95396", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131375, "uuid": "8231bf3f-216d-49b8-89f0-247d181a2dde", "value": "12288:rKewx/NscEQ+vgXK1Hsa+cmKo1W5qlp1HoADehqfx7b5w4JC2Off03i0mMRry8B+:eewlqB6p5pKosquA0a7C4JCan9y8Ae5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686131375, "uuid": "1e0b5779-53b2-4f21-aad9-a1f32a43fb4c", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686131375, "uuid": "6b305a4a-b8da-48d0-8b69-dd0617aa4cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131375, "uuid": "55363153-6574-4853-91ed-49498947e803", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee58c80-051a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686132024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132024, "uuid": "8cffe796-4a69-45de-b992-a68cc8ed97c3", "comment": "Malware payload (RedLineStealer)", "value": "e47566c003653039f7c66bd25564b6b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132024, "uuid": "1ce54537-d7c4-4a3d-9dac-e085aaf7e201", "comment": "Malware payload (RedLineStealer)", "value": "a33e64d39a6337895ba9eb715a51ad3ddef9ef042b49cb5bc405effd99141a3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132024, "uuid": "f5211ae7-c07b-42c4-859d-adb11ae3f23c", "comment": "Malware payload (RedLineStealer)", "value": "eabf5e521f8b56f7a3ee491a88acf532cf01114a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132024, "uuid": "d07a4a1b-2f83-4378-a37b-3ceae265200a", "comment": "Malware payload (RedLineStealer)", "value": "d758c19629f373c828fe3f002ec1a31738fd80ddb0b9f84cc430c9da8ebc2ee7f84ac176da622fba81a1645ebaf2cebe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132024, "uuid": "231818b6-79f8-43e1-b889-47d1a590c736", "value": "T1B2F41243E6D84077D4F51B719CF603830A7ABD904D30827B2A8A5E4F8DB2995B97473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132024, "uuid": "dc7ef366-7505-4e9c-8488-c1464e0299c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132024, "uuid": "21d7f71c-f4cd-409f-aeee-c801c52088b0", "value": "12288:SMryy90KFOzrP74LB4TOosBlSpT2vaYI9E5aRgQtazAUAPSKI57UalqE9+nr:8yb6P4BKxsBkizIG5aRgQYzAZI57UaYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132024, "uuid": "16ab9eb2-31fc-4245-bcb8-f1e717798779", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132024, "uuid": "f42af282-6dea-4df3-a631-f076a700cdf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132024, "uuid": "b19f9082-0767-4dab-a425-3090bc1ff0e7", "value": "e47566c003653039f7c66bd25564b6b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2435f63b-051c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686132891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132891, "uuid": "da5ea450-9aab-491a-be7a-f5c0df661992", "comment": "Malware payload (Mirai)", "value": "ca0e44e49a778e7fe905c7097c4edbcc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132891, "uuid": "cba86a85-7e6b-4601-9862-c2871a90d73a", "comment": "Malware payload (Mirai)", "value": "a36aafe9d71d1ccb0ba8319d604b84ff88fbf2f2211182c108b2d613e40d3a8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132891, "uuid": "c5762edf-beb9-44f5-ac19-ab6ffcbc3cec", "comment": "Malware payload (Mirai)", "value": "64e7f7e16bbee356a8307ce6a58d009ed49f3cd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132891, "uuid": "3cafb725-d0f9-4f31-972e-816545b6c009", "comment": "Malware payload (Mirai)", "value": "3bb80374e4711974608a2bfecde67807d9570d2c8fffb78bcd3ce1f8267a541ffab51659c009396ad66e7f3b854cbc36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132891, "uuid": "131e2eba-3d39-47eb-91cc-a2651a5e5918", "value": "T19EB2C0CC51943088CA8D7C7C178D4A664F6CA1D0B6ED9F26E354CD9873BAA8B3859079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132891, "uuid": "3ac4b3ee-e570-435f-8184-9abc1e406c06", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpFZqSWvE:4QlS07FUXqIYSXQKqu7qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132891, "uuid": "c5d53286-a7da-4355-92c5-4229c51fe79d", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132891, "uuid": "4a995030-cd9a-4341-abc5-a73a25da5e7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132891, "uuid": "ff93b831-868b-42f0-a9a6-c12a1d30d977", "value": "ca0e44e49a778e7fe905c7097c4edbcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeceb644-0549-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686152559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686152559, "uuid": "ab232a71-43c6-43b5-a7c3-1ed16fd8589e", "comment": "Malware payload", "value": "2c5880fd1405487ff3bb9c03fde2b671", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686152559, "uuid": "844c2340-f3cb-493c-8823-ffd50161d494", "comment": "Malware payload", "value": "a387529289f01378ad79a948e7989817510c8d0b5de04921f65d21309ddb8a3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686152559, "uuid": "8fa4ec14-0c55-4013-80c0-ae1782333ac0", "comment": "Malware payload", "value": "562e4bc8618c9af1efdd1186b7e0675e87b17a06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686152559, "uuid": "0826bb25-12b9-4d48-8785-61d0a4ea6627", "comment": "Malware payload", "value": "54277d7668ffe60666be33fbbabd35c240801a11ca4a55d07fed3b4e70d095ca673653a6c2279db54847f4a59b6d9c72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686152559, "uuid": "87e37b81-2f9a-48a8-8468-6668fc4827db", "value": "T16DA38D1276DCC2B5E41A35704C60EDB66AFAB979377F009BF78506692E233D042B271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686152559, "uuid": "05b86f00-6af3-4809-8b61-a0c0c7c4a6f4", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686152559, "uuid": "4f2cb910-f37b-45b4-903a-be3b24229626", "value": "1536:Ip6kFya9c7Ok/YNQuIG6jgB75eGF7V3QjyXX9di2YTHLYjzDm:QVBQBK17V3QjyHxYTHcj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686152559, "uuid": "fadd6ca2-dbe6-4295-8fca-7445927049f6", "value": 103361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686152559, "uuid": "233040d5-86fe-4fed-b168-53dfad484f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686152559, "uuid": "18ecb4c3-3ca4-49b9-bcfe-2d35e7ce0db5", "value": "2c5880fd1405487ff3bb9c03fde2b671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ec1f46-0537-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686144435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144435, "uuid": "1dabbf51-62b0-4874-a206-cedf5e769345", "comment": "Malware payload", "value": "208b218f3fcf9a716ae9b81295c9c34a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144435, "uuid": "1f2ff8b2-c95e-402c-ae92-00691acd04c3", "comment": "Malware payload", "value": "a38a1062bc1ee948b6520e20d3dcbf9625142ca86ae5c662c4d36fd8cb2b0be9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144435, "uuid": "5f3fb442-df61-4db0-b08a-51f8f592b8df", "comment": "Malware payload", "value": "acfb459168302e80d0c3437e2576340e5493758b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144435, "uuid": "4b686e1e-9aa5-4916-8907-cfa490a5f37e", "comment": "Malware payload", "value": "af4b7540bdcf245aaebb2d14c6c634819844d4a491ed322c18719ff2f7f417f17419ca5c3c3681c5e0ffc7c404d04966", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144435, "uuid": "0313247b-4810-4e41-bd06-601fb747b45c", "value": "T1B0B2C039D902F818C4B746BF942D19F4F854C21EEAC3D3AF68817BE988E45A3075E60D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144435, "uuid": "09868a71-b962-482d-98b3-31cb34de2bd5", "value": "384:EUWe7DvuhUopJMY7NbNxt/ZtNNpMbpq7w2bx/QyeEr5lkGmaDiu1OdjL0lwKA:nWe7DevDjxllNp3wHynlHDiu+TKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686144435, "uuid": "60327605-1871-45ba-862b-6ee53f716e66", "value": 25431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686144435, "uuid": "b5cd39de-0c9e-4354-803c-9740d9d2a040", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144435, "uuid": "b831aca7-25a1-4e68-8a41-6e2d337f2186", "value": "TOUGH CUT CONCRETE SERVICE INC IL.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0011f7c0-0545-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686150440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686150440, "uuid": "9c9e88e1-3a2e-49e3-bba0-7f86c16b97c9", "comment": "Malware payload (njrat)", "value": "d4b127a7d4e2609d86747eadf6fd00ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686150440, "uuid": "f5c5b69d-d57b-46ed-bf52-ba98229b911d", "comment": "Malware payload (njrat)", "value": "a4565de8728f2196a30e7337c45d94b0b7f8dfca1bd610f5bd0d597e483d1b37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686150440, "uuid": "496fe77d-ac13-4da7-9ea1-9b5562bcd63e", "comment": "Malware payload (njrat)", "value": "88754fa2fa044a1bcac7ad1ede8c8cfa533bbdab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686150440, "uuid": "1232f9a6-5918-40d0-b97c-e5eb714d6d5b", "comment": "Malware payload (njrat)", "value": "16e386d7c0f8aa857effe94eb962539e3cd2acfbe1da59b3968d8a14bed05d2391a7d85bcd5a3cdc5b6d75c4564ec764", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686150440, "uuid": "ad0197eb-6ff0-4f20-b4cb-fb6216c7c400", "value": "T111733A4877F54A12E1BF0DB5897292221B36FC035926F76D09D174AA5FB36C08A09FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686150440, "uuid": "d1649c89-5dc5-412b-8148-2319468acc5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686150440, "uuid": "7c6484b8-f34b-4658-be19-bbf0a6c9f0cb", "value": "1536:Gh9z+dBLX+DpPS5wpOk3JCK6pFo4j/6fOpd/9nEh9TGaJMR:UWqQwpOk5CK6MO/9ESaJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686150440, "uuid": "b5badede-0b00-4135-87f3-57ec915feac6", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686150440, "uuid": "a423d0c4-f56c-47ed-8936-c7704115dc98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686150440, "uuid": "5a965fd0-ac0d-45b2-9ed8-c6e7cd107c8b", "value": "bNqu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1a375d-04d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686100986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100986, "uuid": "8664c374-9a3f-4b6a-866d-ddcf8e3382d6", "comment": "Malware payload (RedLineStealer)", "value": "27e9b5732508e0adc713c837087d7b9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100986, "uuid": "60878ea9-657c-4ccf-9b16-e8b3940a8076", "comment": "Malware payload (RedLineStealer)", "value": "a4ca908c1bf7144d47a4f0e0487be53e68f08a5a5fce15321ba3ae4a0155b543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100986, "uuid": "0ac5205f-f058-43ec-80fe-9e4d87f9188b", "comment": "Malware payload (RedLineStealer)", "value": "f9f1da5e0e08444104fc40ec6c1bf87537ec09e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100986, "uuid": "a1211e37-7cd5-45ae-9b2b-97491b732fdf", "comment": "Malware payload (RedLineStealer)", "value": "641a0e2bac2f0c9c311931c5816bde065875de1591a19edf41ced4027a6cb882cf632eeb02e8a3de7944b597388483ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100986, "uuid": "78b27612-7db6-463a-9f8e-c048c22b9f85", "value": "T110052342FACC9062DDF667B058F317838735BCB19868C7573701A96A2D722D8E670367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100986, "uuid": "d811c631-8135-40ff-acf1-91251b532c37", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100986, "uuid": "c4e9cf8f-d927-4e7e-9165-81cd2b5185ff", "value": "12288:bMrky90CORXPZrXUk+Kcv+yuTx+uvSOehsME74Y7Z0Jo+cNEVlj+gwJGwL2dFYhT:Py+PZ4ksg+rE74YgcNEnSgw8PFYhHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686100986, "uuid": "34fbe3e2-ffb7-4fb3-90ba-34b8a2669a2c", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686100986, "uuid": "8e17c73c-bfc1-40de-9cc7-425f898e188a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100986, "uuid": "69ad086a-c836-4e96-8317-c58dd4767c50", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eed7893-04d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686100724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100724, "uuid": "1c64b235-b043-4eb1-912d-44e8a5168a90", "comment": "Malware payload (RedLineStealer)", "value": "a9e24708edff0275d3d61abed4af2f16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100724, "uuid": "e7f1602b-92b7-4218-a80d-200a3fca2f88", "comment": "Malware payload (RedLineStealer)", "value": "a4fa3675a5bb1ff4d55d4901226d7be7aafe780eb70d5bdb459de32d4bf77c21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100724, "uuid": "790b907b-dcfe-4abe-8e6f-737868b93f02", "comment": "Malware payload (RedLineStealer)", "value": "4d03d2c24454b0bac95f73109b71ea3603a833b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100724, "uuid": "73352afb-f502-455e-8646-4539d8c73145", "comment": "Malware payload (RedLineStealer)", "value": "dabb09c6a405f2737d1ef41d0f380209a4ff4db830521e4defb42c5a1c0fca9802b11f12635ac0069235f03bcd401ae4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100724, "uuid": "bbdb887d-139a-4572-b1f9-2b85ddc9fbda", "value": "T106C41243F6E85032E9F027B058F302C30A357CB19DB1A77A2386AA9E5D72785D871767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100724, "uuid": "4490c178-f600-452f-abe9-9218a3621e30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100724, "uuid": "ee23de42-3efc-43bf-8373-41ebd40d5cca", "value": "12288:/MrUy90lZ+DHJDFx+fbcmMd6TdD9Urw+sLsTaSce3SbrPms:PyhDpqjdDX+sgcTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686100724, "uuid": "68c902d2-2153-4ac3-a0f1-37fc0a2be30d", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686100724, "uuid": "de80180e-ada7-4451-9fcd-73f4a35ed13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100724, "uuid": "cbf6015e-40a8-4dac-b4a1-1ef60a215757", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e967d743-051c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686133222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686133222, "uuid": "b03a4906-e635-4c53-8e61-e5194006ce13", "comment": "Malware payload (RedLineStealer)", "value": "dd64d6d27db5d5de191fda027b7c95ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686133222, "uuid": "4161a855-0cdf-4bbe-abfa-9363d50cd369", "comment": "Malware payload (RedLineStealer)", "value": "a6c266c00b6cdf60d4eeb80c0f0efdbf6a97b21cebcd0ba9a0981d7e99533faa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686133222, "uuid": "e44142c5-9fbb-4b4c-a011-64c25cc964a9", "comment": "Malware payload (RedLineStealer)", "value": "a00377e28c6dbf990d8222af7d249701e1a99c0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686133222, "uuid": "e079b4a0-61f5-4b52-ab63-fd8a382ab195", "comment": "Malware payload (RedLineStealer)", "value": "2d9af6ff51204264af9b152f63a73f33cb4e56399333db7935d31a513f6b6d96b792ecf795ebff7835f17f83bc905322", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686133222, "uuid": "48d4d96a-e3ef-4025-936a-5e598f097b22", "value": "T19DF4125AE6D88073D8B52BB058FA02830E3BBC315D69464B76829D9F4E33B91F171727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686133222, "uuid": "42edc4a4-9749-4516-a4fb-4d299a19ccf9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686133222, "uuid": "2f308630-cad4-423d-b9df-c2ead2c9bd06", "value": "12288:LMrhy90MrC7Kqd61NLU0JgIF8aJGD5odpcHHMehGVwa:iyG2qgNLU0J1ID5Wcv8wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686133222, "uuid": "68a6d47f-0eed-4614-b516-0e5714c9f030", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686133222, "uuid": "69d30513-c350-4ce2-b2ef-2cb714bb0ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686133222, "uuid": "0e9ef240-0aab-4481-822a-cf66f84401ec", "value": "dd64d6d27db5d5de191fda027b7c95ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fa9f70-052f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1686141058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141058, "uuid": "ed7a579f-fa46-4c9b-af45-f500b59b9d66", "comment": "Malware payload (ModiLoader)", "value": "629208e19d01f3779a145aeb93850a1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141058, "uuid": "143317f9-dfd4-4455-84b0-c2a677459624", "comment": "Malware payload (ModiLoader)", "value": "a7a91602da7f08f87300769b31718664941f7eab6a28939c5a25e14ba537d66b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141058, "uuid": "596468b4-0e36-4bc1-ac3f-ce6847953829", "comment": "Malware payload (ModiLoader)", "value": "fa8612f8cffe5cc54e2b53871e7901d60fc4e0d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141058, "uuid": "7c6cf8b9-81f8-4499-a601-a70c5ccd4287", "comment": "Malware payload (ModiLoader)", "value": "73e5933d8af49203eeb6a5862c4097bafbb617bde6494a3f310d30d932a3bdcbef63059df47d4cb56b40257d069e955b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141058, "uuid": "09b1af1f-31df-4849-aadc-27f19e29a9aa", "value": "T15315C021B1B05833DBB61B78DD1F56749839BD141B2C987AA6D8BE0C2FB825438742F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141058, "uuid": "e8d2a8b4-9404-438b-82fe-6aa3d91273b1", "value": "56b9ee34a3c873bea4afe3c0ca147de8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141058, "uuid": "e1f77ef2-f02f-4510-bfa7-b6095625f5cd", "value": "12288:l/AeU0+lRGAb9ROvbNuMmUn/LR4q8M+nqwtv07X1O9noM5:lIBljROVrn9J8M+nqwh07g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686141058, "uuid": "0b87bc1c-689b-4963-9150-80b33256e76d", "value": 926208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686141058, "uuid": "336525a2-4b53-4d21-9886-1b4f8a2a66d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141058, "uuid": "0cf78ae3-5401-4fd1-b737-4980cb8bb292", "value": "U prilogu je predracun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66713c3b-055c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686160490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160490, "uuid": "7c84a277-1815-410d-8dd2-666e48a89285", "comment": "Malware payload", "value": "85354dfe37ae63cab7904b8a18921254", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160490, "uuid": "9836545b-d8ff-49e1-b4c1-4188e1b026ad", "comment": "Malware payload", "value": "a845d084fc66df929e8ae4026e3e2eea0db773ab45e42c6f7ebcf548e344da9b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160490, "uuid": "d6e00459-0b97-4e1e-a246-32aea459cded", "comment": "Malware payload", "value": "26237bd5e36ab4613441b7df5eb3124f765aa30c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686160490, "uuid": "87dc86ae-3540-425f-a610-40723f0d2165", "comment": "Malware payload", "value": "a46e0fe27ac4779a8368ff62a36242ee7acf37a5a8270d03ca5fc091883f60f6bf5e5b81d2c91d76c81f8b8f2ef1a55c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160490, "uuid": "c8bde2dd-3678-41d2-b5f5-dd8a0b12ba63", "value": "T18A942311722835C3654013E7AA0A68AC7347B396EF78146947E437DA7A3E8CDB82F167", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160490, "uuid": "bc23a442-00af-430d-916f-01c63d468c60", "value": "6144:XW2aPBtOC5/Bn68SnkTmMOo1c/WkP0n8XSMpCliI41RImW8MyTgci3SreYYPmJSm:mt15/w8SnkSlGn8iMXzwy8cUQUSSmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686160490, "uuid": "94ca8874-eb7d-49cb-9720-82c53aad8102", "value": 437588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686160490, "uuid": "eddd6563-0d97-4c12-b461-329cd16fd094", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686160490, "uuid": "68b01487-b74a-4b6b-bc09-38c27444cc41", "value": "Release.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57197279-058b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686180651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686180651, "uuid": "8ecccd5e-bff8-4b63-8986-3bc5a240f4f5", "comment": "Malware payload", "value": "a23c6c6f0edee1f06386afa64a56a1f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686180651, "uuid": "57aaae2e-3bbd-43b0-ad91-2b37b1886661", "comment": "Malware payload", "value": "a973c5027fe4ab592558a1cbc9e69e4aba9795badd326d29a46c7029e975a16b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686180651, "uuid": "76c2ef51-964e-4f8c-8748-aeced7f8359d", "comment": "Malware payload", "value": "8177b69fe3f194fd37faede76b6bf04553813ff8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686180651, "uuid": "d699aa2f-5f35-41a6-bc70-802fa599f183", "comment": "Malware payload", "value": "9a48f92b750b9699b2f84c681e0bc07de25e742460a98789b16d94e635f437a017d20f24071c7a0f9b9ac3ec83adbb03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686180651, "uuid": "30f6b3fe-f978-4945-a091-3456c119c199", "value": "T1DDC39D01B5D18471FD720B3518B0DBB69E7DFA701E208EBB23581A760F613C19A65ABF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686180651, "uuid": "9ebf8ae2-f8eb-4b00-86c9-f3810ad6147e", "value": "f264906d4975bf1277da66f2124faba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686180651, "uuid": "e2947000-6e84-4244-ab2b-f61ea498e242", "value": "3072:z9QLdsON8xxwaTq29LVYkS0/LfWvp8oyhuWVFrag1shbrrtvx6:hQLvN8VTHS0SWVFmZhnrt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686180651, "uuid": "fe21d640-8fd2-4d1d-901f-2444fa375a87", "value": 124025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686180651, "uuid": "422042a9-8230-4d4a-8561-ed20a3467fe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686180651, "uuid": "c9d539a5-61b7-4f0d-8615-358a8cde2efa", "value": "SecuriteInfo.com.Variant.Tedy.379608.19626.25644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8ff889-051b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686132798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132798, "uuid": "fa89a0b6-f69a-435f-84b6-792cb0598e14", "comment": "Malware payload (AgentTesla)", "value": "6a0f466407492013e80dcd780e5da3de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132798, "uuid": "3bb345bd-131f-4d39-a7ba-8fce80a96bd8", "comment": "Malware payload (AgentTesla)", "value": "a9c8b6ec1d3d72ddb29a511e1fc672176d5a3637cb57a32c40d3043af22bed5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132798, "uuid": "10d35e59-ce79-4b3a-b3cf-9b23e5c1f4e7", "comment": "Malware payload (AgentTesla)", "value": "6f17f6971462ad11ba703914efe362845aa47b87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132798, "uuid": "3367355f-e4bb-4542-bc17-b8696f98e0c6", "comment": "Malware payload (AgentTesla)", "value": "4d0e9f423e9e6d1f869cb89f17ad5cd0ffd77ee9ef6d18b156348a76e0d3505b88c18832d6af0c839378fd46ba1ea9b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132798, "uuid": "2c2ac99c-fc3a-411f-bf98-18d77f767e68", "value": "T16805E08862FA9F57C47A6FFD0410047083F5596B313BE2875DD2B4EEAE64F060A84E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132798, "uuid": "9ab10a2f-072c-40ee-b56b-8f002f6cd244", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132798, "uuid": "4b2367a1-fc02-40e7-8abe-641d763b3138", "value": "12288:UUlRun0haDnLMzIL2q+RTdOL8TE1WSJrv1vLgmMr//sjnH+rXsFyYu1DJG49O:UUlRuKOyqGUL8evluUjnFy1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132798, "uuid": "266224df-521d-459c-859e-f8f3d5867380", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132798, "uuid": "76890a8e-c5e8-4925-8e00-cc325abec679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132798, "uuid": "6eb488be-5f81-406c-9854-588f74a8cf42", "value": "DHL AWB 5032675892.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20411dfa-0543-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686149635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149635, "uuid": "968475fa-7b1c-408d-9a0c-e5d1eec271d7", "comment": "Malware payload (AgentTesla)", "value": "10c038fed5281fbbbc727a74336e2f0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149635, "uuid": "9864abf4-9f9d-4e5c-855a-0b7ed3099685", "comment": "Malware payload (AgentTesla)", "value": "abef18ea3dd420650a3c4ffbae70c8a3409788f67986c0bb08955a85b6b3a290", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149635, "uuid": "94dd14b2-4177-418b-97b4-ada61e2bfb3d", "comment": "Malware payload (AgentTesla)", "value": "8a210c8f48426cf1d8d18e5a267b680c4bfd256b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149635, "uuid": "92bc71b9-c505-43b1-8dcf-0445698915a6", "comment": "Malware payload (AgentTesla)", "value": "904d41a109e830473716fb7dddf729b1ed3ef568ddcca15fa86867658d2d6f54327b3e8dfddad92b7675f58d5458abba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149635, "uuid": "6340f357-ddd4-4c0d-9469-19c54a8ee116", "value": "T111E45BD20C6B41C6DCF64F344039361C2B78AA53DCD480AE7599719FCBF999389A1BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149635, "uuid": "1e49e906-0e60-468f-bed8-86f4b004c8df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149635, "uuid": "b47f2ef8-f139-4d4a-885b-ff132f16ad79", "value": "12288:F3CDNxgGmZmBlwzyeJHi8FT0Yrc72104IEiAgn:QNq8lwG8Hi8dB910TfBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686149635, "uuid": "84a51d50-bef3-4365-ba14-ac08d061fd3a", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686149635, "uuid": "8bfd1125-8843-4909-88c9-0ccaad5f5be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149635, "uuid": "f12b4167-a6ca-4c53-b49b-31807ad86c36", "value": "PAYMENT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097bafb7-0537-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686144443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144443, "uuid": "54e4087b-553c-4c6b-ab9f-9ed6df992d5b", "comment": "Malware payload", "value": "ea66e9134d13be0e02228fc60a4403a8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144443, "uuid": "c254795e-0059-4a5d-bf08-99bc6897e4fc", "comment": "Malware payload", "value": "ac60fab947c47b984e0a2d1d902004035331d8f4af911fbf98b690e814302800", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144443, "uuid": "d0346199-15e1-4b45-8658-5b0bdf6efff9", "comment": "Malware payload", "value": "5b1e3cfd39ad805649f829c38c65ecda1a5afe7c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144443, "uuid": "9dfb8763-9a62-459c-8427-4358334b67f1", "comment": "Malware payload", "value": "a7851a8b41ca8a71d44c2737d91bb3076dbd1e8b520cba7fb1522fbc7a40acae9cbd2579f5a43921d3f6ce8f84753c4d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144443, "uuid": "fc7b52ac-f381-4f1e-ada0-49e6c719e3aa", "value": "T19AB2BF74E706E518C0A752FDD80C12E9BC09C25FEBC09BBAA8947B5E55C15A70337E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144443, "uuid": "c53dcd7b-4ebc-492a-86cc-9aa391c67365", "value": "384:EXHAtfqSpBZgosf5hHpNaMLPbY7NbNxt/ZtNN7kNimgugXoEr5lkGmaDiu1Od1Ld:Ug8SpHQXJNaeIxllN7uCxlHDiu+7O8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686144443, "uuid": "94b90ea5-eaa1-4b13-b981-476b2d272340", "value": 25432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686144443, "uuid": "c40859d5-bc1c-4bc9-81ca-c0e88865617e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144443, "uuid": "c43df60b-1b89-40bc-ae3b-7c2967176e84", "value": "COMMUNITY SOLUTIONS INC CT 4 2023 .docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c161c126-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686128431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128431, "uuid": "cdc28fbf-2c50-4741-b20f-1bbfc72e8ea5", "comment": "Malware payload (RedLineStealer)", "value": "15bf8d21e52c5fb9464f15659351ab9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128431, "uuid": "95800bb9-b357-40fd-832b-0f198c3b47b5", "comment": "Malware payload (RedLineStealer)", "value": "ad1a0f8bed998f47aefe6539001b96702cf3b16c556a3178f17a96b012ae0a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128431, "uuid": "b37cd33c-d82f-4173-aa69-0103adebac32", "comment": "Malware payload (RedLineStealer)", "value": "d15cb63e2d074d960484783a341faa448c94e09a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128431, "uuid": "7aafd0a4-6fd7-4a73-8767-4641122f021b", "comment": "Malware payload (RedLineStealer)", "value": "4cfddf87dbd43989e62ffacca3e60d953e7c09392e2fe8d4cec5b4ebfe4eef1f456cbb0f3afcf286dff4d65aa9d2edd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128431, "uuid": "e8e5048c-0039-43ad-8adf-6c5f6a34db9f", "value": "T13BF41203E2F89073D8F51BF058FA23830A3A7C658935575A33D1AC9A0DB36D4A476B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128431, "uuid": "d72a4ec9-2ebf-4f6a-88e2-8f7970cc00ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128431, "uuid": "0b50c9bd-50e0-4995-95de-ffbff73be7f5", "value": "12288:9MrIy90yruno+p388ApDTNhJH2AD2cU8WTs1XTfshLTHdJ2s9VK+ZG6W461+H:tyTryo+p38X9hhF2uPUNs9TfsLT9ws99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128431, "uuid": "90125503-9e39-4949-955d-106a9fce964c", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128431, "uuid": "2b1363c1-ce30-48c6-8e3e-d576e762d050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128431, "uuid": "fe226241-5da1-4a6c-ad2b-4b33b7e7a6aa", "value": "15bf8d21e52c5fb9464f15659351ab9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63859e5d-0527-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686137722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137722, "uuid": "3164e67e-eb97-4642-915f-09d8115c40c5", "comment": "Malware payload (RedLineStealer)", "value": "56d0a5371d72cfcf23cc8969c0e27d15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137722, "uuid": "bb7c8f29-904a-47c7-82cd-edc93344abf5", "comment": "Malware payload (RedLineStealer)", "value": "ad425b0ff0675acf79c211e6cdaff9d36fcb0ecae7b51f685ffbe6b146a3bd24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137722, "uuid": "84bcb5ea-536c-4f80-99df-98a22fe1bb33", "comment": "Malware payload (RedLineStealer)", "value": "f3dfb71b3f17d050bb0f3cd386e11dd764639ce7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137722, "uuid": "1f9f46ab-30a6-4ef2-811e-a68a60f3677e", "comment": "Malware payload (RedLineStealer)", "value": "69219baa5957c523fc5351c928c5f8a8b38ff8ca984e39c55af6151d79ee0bafad5d20da0fdc39993cfa8dc16547c14c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137722, "uuid": "fb6c4d8b-d123-4c02-bf52-b7bb48257a9c", "value": "T14EF41202F6DC4072DCF02B7118FB46970E367AA68D7887572359A85B0DB3AD0A97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137722, "uuid": "2298b8b3-92bd-4b15-ad07-fcf974b9d63c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137722, "uuid": "4b187452-c26d-48c5-b8f5-49fd42ab2bd8", "value": "12288:wMr1y90IC1dS1eYaTX/bHakC9FdORcAD6zORJb9SnREkiPtJDH7cmepYwF3iHa1Z:VyxkdS8XOkYFAr5RJbGEbPtJ77YpYwFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686137722, "uuid": "fa14cf08-77b0-4fa1-87f0-aca2f15b863c", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686137722, "uuid": "177cfc3d-2fc2-47fc-b0ad-d4944a16a91e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137722, "uuid": "960214f9-e8aa-48d0-8d51-d5c60c422d96", "value": "56d0a5371d72cfcf23cc8969c0e27d15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9baace-0565-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686164445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164445, "uuid": "23e3c78a-2a91-47bf-9940-92a957b97e89", "comment": "Malware payload (RedLineStealer)", "value": "8b2d770e36644add52c0e4226a3a5552", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164445, "uuid": "bc00de02-d8c2-466e-ac39-f07d8f708bbd", "comment": "Malware payload (RedLineStealer)", "value": "adf41df5a6fd3f3d2fe86922a63568bb44d1cd90f66211b4ef537f05c17daf92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164445, "uuid": "ab9cf998-57d7-464d-bc9e-81cb1bdf7b8d", "comment": "Malware payload (RedLineStealer)", "value": "6b6f48b7a269ad2dbe1e705b298337b8705f0943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164445, "uuid": "96f6897b-9cd1-475f-abbf-c1f2e4538ab8", "comment": "Malware payload (RedLineStealer)", "value": "5d59287d643abd5bdd82b0f802aa4633fb26802ea4bd7719288fe6f90505df1e1d9bfccde96ccd993700f492d998fd78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164445, "uuid": "052c71df-204a-433b-bfae-7301b15e4f03", "value": "T170C41212DBF88033C9B41B709DF622C30E3A7DA15DBC436A2645A89D1DB26C4F47679B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164445, "uuid": "787efb5d-2461-4021-8251-6d4a13dda9fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164445, "uuid": "70b94a6b-5fc3-4605-bbcc-846115119714", "value": "12288:NMrOy90jtZHpCnZc7tkijvAGnXhCPSrXooTo7olvhh9m7:bymZJCZiS+ZnRCKDE0lvhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686164445, "uuid": "1e2c2de6-fdf8-438d-a68a-d808e31651bc", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686164445, "uuid": "898513ef-1330-41b0-bde1-38bfbf3b6669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164445, "uuid": "0bf284c2-4d01-48d0-b0da-010b2404be70", "value": "adf41df5a6fd3f3d2fe86922a63568bb44d1cd90f6621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ad5a3b-052b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686139397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139397, "uuid": "3be41889-a172-42db-9fc7-7f7631ddcedf", "comment": "Malware payload", "value": "198846e06e7c516ea60836ab50d0feae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139397, "uuid": "7928571f-15f7-4779-901d-3e31b20b93ce", "comment": "Malware payload", "value": "ae3000bc33ad8705992eac14fbb4ae403d6fcb5b2da3b00288b3f10029aa1ba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139397, "uuid": "250a05b7-b9aa-4b45-b839-f87128385861", "comment": "Malware payload", "value": "7c609896a1e3dc2bca5ba7bbc821b87f2f4967c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139397, "uuid": "589b74cd-4487-46cd-a777-db48b8a941fc", "comment": "Malware payload", "value": "6719ef57ff8b7235523c5acc9003a0bf4159c1c6950698c4b1892be73633e7aca36ad163fdb7b6fd0ab1a8affc24420f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139397, "uuid": "c7299388-cbba-4ac8-8daf-0063600b357f", "value": "T116C3069C766075DFC85BC9729EA82C68EA60747B570BC243A05312AD9E0DACBDF150F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139397, "uuid": "f9be2b00-7fb3-41ea-90c3-64d576eac8f2", "value": "3072:bAPMx/gOBx+VdSHiXU4/tjFf8U6c+h6lh1f2fxvPXj5:bEWJQ0H2U4ljFf8w+h6lh1Wvj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139397, "uuid": "a2add8b6-c422-48de-9fcf-e4886c4aa4bb", "value": 120896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139397, "uuid": "089b315c-cd55-4e26-8c5e-142a89d40c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139397, "uuid": "45218970-b69a-43f7-bfb8-a34c226830c7", "value": "rAlb_2023_869.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8152d58b-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1686130041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130041, "uuid": "0ed7cd84-5405-4006-93e9-e6e14ddeab94", "comment": "Malware payload (zgRAT)", "value": "542c8ada8c75d5212ceba1879648ffb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130041, "uuid": "eb56bef6-0d00-4e07-9c1e-9e715bcfe2e1", "comment": "Malware payload (zgRAT)", "value": "aebb3e0f0a1e4ccb34fa859b5e8d1cc899fc9ddd03217e03bbbd9b7832a3a0a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130041, "uuid": "7215b5bc-5a6e-4ecb-9390-501bf1a51d79", "comment": "Malware payload (zgRAT)", "value": "48e07687dca7c0b7e706bee9c795c192070b8e7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130041, "uuid": "d9d40c88-19b8-4f32-96cc-2cc58e7f9217", "comment": "Malware payload (zgRAT)", "value": "11a3028562f6ff07501669b87c4fb211e9b8c3cf10c6464047708c3b0ee3b63abffb0e9cc4569219463ae74768de8393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130041, "uuid": "577bc79c-bc20-42b2-86d6-2a5897bf8ee5", "value": "T1D4748E4A7719E92FC28E4336CAC61814E7E29D82920BEF0570C727D94D1B39BDE06797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130041, "uuid": "03fae518-33c2-48bc-ab8e-7b3b3c4cffac", "value": "6144:Di4ZnFnRhtBanhqzVz2tEHLxWAVxjgydPno/x0kk:Dppz0hqzVqtEHLnXo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130041, "uuid": "3ca92959-4743-459c-b634-8907f882c694", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130041, "uuid": "be1bfad6-cbc9-4aad-9e21-7b073f6de343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130041, "uuid": "54c781b5-fc82-413a-9fd0-5fc68df445fa", "value": "DOC-20230605=567890987655608911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6680e286-0553-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686156625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156625, "uuid": "63bc62dd-a8f1-42f6-9e62-c7b4b3ae389a", "comment": "Malware payload (AgentTesla)", "value": "3f67f05693ab5fa507ff7a163a92bdc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156625, "uuid": "92ea3ba2-86dc-4cbe-805f-5dfe4ff43fd8", "comment": "Malware payload (AgentTesla)", "value": "af1bcd9ba9a15d74a8819dc87f8032d22c4f26b4b5d10577e6544fa9674c7fbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156625, "uuid": "dba9e3a7-8225-4cc7-b1ae-a5ad6e8bc82e", "comment": "Malware payload (AgentTesla)", "value": "1bba95ee3541fb51e6bbe6d87d98cdcff19b3801", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156625, "uuid": "8a5d467a-4a76-40ed-8ecd-dca15ccba059", "comment": "Malware payload (AgentTesla)", "value": "675ca19a2c330885e08526cfe1fa5def39435c0294e9bf6798b9315f10b9b0c9b68f41f3ebf1ba212b0ac35c55226e61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156625, "uuid": "6f158f9c-6f70-4a34-86bf-631d539646dd", "value": "T11AF33868929A9D11F33D0078C5B115C85BB2E173932BE79D2DB1BCFA39163C3321AB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156625, "uuid": "afdb399d-df7c-4d50-bcf5-bc8825c9fda0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156625, "uuid": "f2f42ab2-ac18-4ebb-b56f-f18dadbeca30", "value": "3072:0m2WUrTS6DOS+QZs+VtVNAdMbA4OTntsJKn/uVb0:vIS/S+QZ37N8MOTtsJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686156625, "uuid": "bdcee5c3-d807-4f34-acf3-a8a9265851e5", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686156625, "uuid": "f6313e14-9da2-4acb-8ad0-ee0d767a171e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156625, "uuid": "0172cc2d-606c-46c7-a152-f2c23d1043e1", "value": "af1bcd9ba9a15d74a8819dc87f8032d22c4f26b4b5d10577e6544fa9674c7fbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b8d13d-0575-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686171258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686171258, "uuid": "6f94955b-faa5-4057-af45-c88ea5ba385a", "comment": "Malware payload", "value": "cb093c783abeb21910a13cc86fc6a361", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686171258, "uuid": "e15c6b85-0d6d-436f-9ee0-afb082b7846d", "comment": "Malware payload", "value": "af92599433f093b31aa91ecffac4fd100bfe2e89856bef9b85a7a9e418751044", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686171258, "uuid": "4de2b399-a7d0-4025-be5e-e0d5f269dcf3", "comment": "Malware payload", "value": "83f041fcd9f0ab4aa469a5cfa55ddbb717d88071", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686171258, "uuid": "1de4f5f2-280d-48ef-9ad8-4895928c5ee3", "comment": "Malware payload", "value": "d36d20d30e85d624025ad1eb2c9dc4d9a462aa59a1c9945f8291114ec662c3ef479a8234024491298009aa91666ca201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686171258, "uuid": "c621bc26-ef1c-4ca4-8e86-a062f427f584", "value": "T15AF58C13B751483BC4521B35D89B91681975BE2A3FB3958B67A0BF0D3E327C0763A386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686171258, "uuid": "0312b151-3a8a-4a7e-b496-fcd7d1eb5f93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686171258, "uuid": "4115a621-9c24-4816-af64-d9d7164c40a2", "value": "49152:Ty3cawXotqPZcWEi7cfQyuyWNY2U61p5AtfSBSortDWTcu1FxzOTHT8xe:TMwYtqPZcgZU6n5A8S1FxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686171258, "uuid": "fe604a4b-5969-47c1-9d95-b32c08678ab9", "value": 3616848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686171258, "uuid": "0bc61e9e-4c92-468e-b7ea-aab8805edb60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686171258, "uuid": "822f4a33-ac47-4a24-8291-5865c141c586", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0ded9e-04d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686100880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100880, "uuid": "f675f9e8-0a95-4ebc-87c1-6cc709b0a99d", "comment": "Malware payload (RedLineStealer)", "value": "3e719e8e96c3d92e61ae4a6eef5206ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100880, "uuid": "215514b8-298d-4bcb-9d93-b768aedbab18", "comment": "Malware payload (RedLineStealer)", "value": "b05cda9bb599d88b8d64aa956e6b6e693a2cc1b6f97b0a7f965f01414510c857", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100880, "uuid": "157f5531-cabd-49a2-b779-6e9a13d8284c", "comment": "Malware payload (RedLineStealer)", "value": "33a15fdfc24bc48cf374d9dd17f9fa2819614862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100880, "uuid": "f15395bf-ea62-47be-9917-409eefd82fa1", "comment": "Malware payload (RedLineStealer)", "value": "38fe32dc335299fb1e51a7c69981ea2d01ea809de28826a8aad3f48f25262daa2aa4a3f37f156fb268f57e57c53bd3c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100880, "uuid": "a057cebf-343f-4d81-b9ee-0864f77f9e99", "value": "T1B5F41252D7D85476E9B6277098F603D30B39BCA64938836B33459A1E1DB22D0B472B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100880, "uuid": "30e31857-c8c4-4340-8604-d18ff439e91a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100880, "uuid": "2321776c-5c80-4c93-980c-1c9d90a13678", "value": "12288:9MrMy906plynWWtWFR7fDD0kwubhrLlv8f5bPiEZJyehMf:ZyXpl87tahXsUh2fwoJyehS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686100880, "uuid": "9e13f72d-ef3d-42ed-836c-bf026a053246", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686100880, "uuid": "ce87f899-eb3a-4875-bb4a-bad658cba70c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100880, "uuid": "c39bbc57-d44c-4c51-9b51-2b9aaf98da4d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46d1017-0554-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686157239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157239, "uuid": "23438ac6-5a60-4496-ac9f-8bc5d6529783", "comment": "Malware payload", "value": "73271bce12e3fd5a5f6c259ff8b69346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157239, "uuid": "70e656dc-f42c-4a10-af4e-69076fee4b17", "comment": "Malware payload", "value": "b193d9f49d63707f102dfa2ffa15f5e3223a9b52559feb1d1082fb4fa27876bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157239, "uuid": "368b43fd-7414-4654-b473-ea2474b054c9", "comment": "Malware payload", "value": "35495627111aecd520e366644f3a971ff23002b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157239, "uuid": "86273f53-63b4-47c6-9f1c-8ba9be49a029", "comment": "Malware payload", "value": "1bafb054d43a6d2cbbb983b04c13a1047e4a7d8cfe92134cbaf528b37d5dc6befa5bf19cf33f249803871c9e9848e7f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157239, "uuid": "d3c5f293-12c6-470d-a2b6-c7baabd78d49", "value": "T19974010A3BD64F25C198C87550DB442063F2E7CF56F3CACA798842D94E827E62FDA64D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157239, "uuid": "d9bc61a9-4ee1-4c7f-85cc-eb517a6c6c1f", "value": "6144:nshh8KMK86uJVqRCci2z42ErClbKKxtkxw8RxFV9yJRrH7YSn4:shkXqth42gSbKXy8NyLHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686157239, "uuid": "e23245f9-829c-4529-af1e-cab7bb29270b", "value": 349256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686157239, "uuid": "969c83db-7b31-42e5-96ae-fe4e08668231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157239, "uuid": "da39ea7c-35c0-45fe-882f-ba15391ff3d4", "value": "b193d9f49d63707f102dfa2ffa15f5e3223a9b52559feb1d1082fb4fa27876bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c73f659-052d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686140153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140153, "uuid": "0c8ed09a-7ec2-4ec1-91b1-201e88d0f75a", "comment": "Malware payload (GuLoader)", "value": "da9e335cd673f6fe0bba1fa82aa04e4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140153, "uuid": "fd60ba24-a0ce-40df-b4f6-78a96c391610", "comment": "Malware payload (GuLoader)", "value": "b2280e958e4020f76a0096cff05b795311599a6e36bdc9f3131e66bcfd27fa5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140153, "uuid": "4f68d80a-dd28-4e0e-83a6-3bc7afe3b36a", "comment": "Malware payload (GuLoader)", "value": "fdb8e13542a61d2e186e9b4b1cf1573868a80121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140153, "uuid": "3b078811-7aea-4482-8f64-79219acf1659", "comment": "Malware payload (GuLoader)", "value": "2f479d84fc2387fd57bf27fc27cdc49cf7d3649efdbf7edf5ab0d6d633436395ca98988c6dec9e1d66211787392ed3ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140153, "uuid": "57656c85-5c7e-430e-a923-7ceef9426261", "value": "T144F302016375E0A7E5E75B301D36EBBAEE92EE741C50036753A17A4C7E70380E92F199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140153, "uuid": "c2b057fe-02cf-4394-bd0f-cf9b75888b23", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140153, "uuid": "454ace00-b927-4bef-b4c6-9a966e7b8bdc", "value": "3072:cYu/YbAcxltXuX4bBGCOVy04vEfS7ylxJdEOA1Uz04/GlqwTNqjnN+5:c6bAcJZxC4vvGDtA6Yfg4NqjnNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140153, "uuid": "23f3f576-c781-44e6-8394-d88ad5f03cfd", "value": 158378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140153, "uuid": "422b3e41-37ef-4b72-a7bc-2509fbc5b189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140153, "uuid": "cd02ff31-c58a-4c6b-9101-7d5ad789fc48", "value": "b2280e958e4020f76a0096cff05b795311599a6e36bdc9f3131e66bcfd27fa5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e703b267-052b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686139661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139661, "uuid": "677280f5-bb24-4fd1-b354-a197da067208", "comment": "Malware payload", "value": "d0c7c3757481ec57efd62fb2939425e7", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139661, "uuid": "bc1b7f5f-c61d-49ac-8c2a-2222674a08eb", "comment": "Malware payload", "value": "b361766d98fd72b6fa5fea05492950c12a25866a8a150cb9c0014af8b4b6a3f4", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139661, "uuid": "94e3583a-aba2-4793-96b7-bf7a58283d5a", "comment": "Malware payload", "value": "c915634806aec9a38fcfab12008720a1490f2f98", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139661, "uuid": "f2debca6-0834-44dd-9603-fe434d1388a7", "comment": "Malware payload", "value": "588483a0a0fac851b23f852c5aef352a99d4ac56a4e7fbccf057d9d39758e97a9bddfe3b9639202e899e2358061bdee7", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139661, "uuid": "66b2f69a-8429-4b3b-ada0-f8c159fd0a5d", "value": "T13FD2DF09E69AF24CDB3F44BA814914DB768E308441458ADF1EA0F35E46C66D363DF2AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139661, "uuid": "a1915f60-d7db-49a0-b195-9100befac7a2", "value": "384:oa3NUlM9z6pbuG7X4WNTlt2p6ZviDgdFD48awKNz/T1zc1x2aiT8etyrxa6mfJ:/xWpbp1NZsUZ6DIK31g1M0zrxMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139661, "uuid": "7f8c2209-22b4-4b85-a837-95435bd5cfce", "value": 29018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139661, "uuid": "e6c8577d-6260-40b7-aa57-b23675889719", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139661, "uuid": "db38c080-5940-4df1-86d1-42127eac72ac", "value": "29trxd5c012976cebc44375f96945dffc73ba.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8bf9a1-052e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686140964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140964, "uuid": "c22b03fb-1e11-426f-bda4-4d46ad12d0a8", "comment": "Malware payload (Formbook)", "value": "78f0c891901afb927816b6d3626e03c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140964, "uuid": "938a6f5a-6ec2-4360-bf4f-003cc808e69d", "comment": "Malware payload (Formbook)", "value": "b391b6d9ea7eb79eacf331ccea7809ee4b15c5db7494f34830dce1b0fb87b0b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140964, "uuid": "49eff1a4-1ead-4c2e-a297-16c42dba38f3", "comment": "Malware payload (Formbook)", "value": "db0b14119cb6301b3dec52fee4d8831ed16295ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140964, "uuid": "9f8fadc5-3baf-487c-92df-6c123d997079", "comment": "Malware payload (Formbook)", "value": "419e91b618f611ae5299efe608898bad9df12d3bb1ada8817082fd1fe2285bad06cbe71f9e980639cf3fcaf667ff3f8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140964, "uuid": "ad4ec1d1-d2e6-4499-88a8-c4cde566d1ee", "value": "T1C264014C4B6671E2CBED2676ED3D46680BA7BD023617E52D98881CF43DA2F268360D74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140964, "uuid": "c715e0ba-3a31-4bca-aae7-9013956320a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140964, "uuid": "2cd76b0f-88ac-4400-bc17-48dc87b57d99", "value": "6144:KfEttR2Nor0fA34WzmWyhKtzNtZ9rwkdjJS9zbXkhNZ7pc6wkN3bYVC+iwHFX:xhfzmW+4JD9rhjkHkhTpcQ3sV99F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140964, "uuid": "eef90a9b-465b-4e70-93da-c7aa5cce0508", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140964, "uuid": "d3f005c2-1fb0-4000-9128-746189a706d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140964, "uuid": "4343a5f9-374f-4d22-9607-6617495c4ecc", "value": "b391b6d9ea7eb79eacf331ccea7809ee4b15c5db7494f34830dce1b0fb87b0b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb7726b-0525-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686136962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136962, "uuid": "dbdf7dd1-fc74-44d5-a265-41f1cde50237", "comment": "Malware payload (AgentTesla)", "value": "926f1921a1c2823926681f21eaef2679", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136962, "uuid": "d7c7eac4-cf5d-4590-b9e0-e2ed17cc4a11", "comment": "Malware payload (AgentTesla)", "value": "b3ca0b93eff9f2f129fe069e2b7dc734f749db4d098a9be27e28e36519b3fb70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136962, "uuid": "61e045c3-3acd-49e2-b386-bcdaa5558bf3", "comment": "Malware payload (AgentTesla)", "value": "3685206ef80828371bb5ffeef5dc35351194eafa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136962, "uuid": "78ef47c3-58ab-44b6-b3ee-3879ae0894ae", "comment": "Malware payload (AgentTesla)", "value": "2cfa6ad4e6b929d0a291149902e654038a7212b95badffc510e549be3fa33457e0b243213dc17e075d6ac2a23a2e945c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136962, "uuid": "c22edfce-46cf-4064-a92b-f58c08f8759e", "value": "T1BA35011476BA4F1ED87AAFF54A04613083F16A5A347BD6495EE328EB5D70FC00E81B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136962, "uuid": "859b29cb-a8a9-4ee4-ba2a-9b1cd4bd1e14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136962, "uuid": "ace1a113-4b69-4efe-a820-e41bf3e2fc9f", "value": "12288:RINiEP/SJaieyY3Pdy7KVwG8Q+VrYLz4ge47WZ4ackzDOFU8s8ROI9HzuL56rcGF:RIB/4Kfdy70h8L8LzDe4Wf8I8R1EqTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686136962, "uuid": "07510041-2c40-48ba-a328-1b2be162cfe4", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686136962, "uuid": "4e9ae7a4-cfd3-4b89-8447-5ea743b78d8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136962, "uuid": "8d1d39e6-68cb-4b45-962c-86e8c25c9d64", "value": "Oferta-CTHU- Equipamiento..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58692f01-057c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686174211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174211, "uuid": "d5561497-88d6-46a2-9a83-eec627e3138e", "comment": "Malware payload", "value": "057cf980c4b4de7f084ae27cb20389eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174211, "uuid": "d2903178-56a7-4dda-8121-b4a383f9699b", "comment": "Malware payload", "value": "b50e55afc29af3a0448a1ee55d494b4b9a9da8c68c0e0162f6c49029e9c3dfef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174211, "uuid": "8590fa05-4fac-4d68-b93e-d9d0bf85fa3e", "comment": "Malware payload", "value": "913c66502924a81f16482c7f96a976ac4b7cd1ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174211, "uuid": "6d7d1102-4a77-42fc-a866-428ff9767b3e", "comment": "Malware payload", "value": "26b7d65ec6ea12d24485363560e379ffc4578a254bee0a599365444124889a864c4d40e7a0568ffddfa47ea5bee64715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174211, "uuid": "ca80a770-2080-44ca-ac7d-db7e47d915dc", "value": "T15AF4D1897609B99ADF1800B1F472529101F3ED2F1663FDCF7ACB32524912BD39A0975E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174211, "uuid": "3e6db0e4-7bb3-4e31-b087-120e03f518b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174211, "uuid": "db0c0c2b-2b70-4ab0-a083-2c920ed3024c", "value": "12288:L4m8ZenYzJV2O7C/Fne5VkCvtDPhVgk56N5LMUHaI+FlDUgu/NJ9unZm:GRzJVNC5WFvZJOkkMUHBiDUguFqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686174211, "uuid": "5bbe920d-6b05-477e-a0c9-212b0ddc05ea", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686174211, "uuid": "580ffec3-704e-44b8-ac97-b8e1fdbf5e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174211, "uuid": "fc52e184-a943-40b7-8eec-42a8e7752818", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f388a7-0547-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686151583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151583, "uuid": "9513e9be-6f64-4dad-8bca-110e46fbad3e", "comment": "Malware payload (njrat)", "value": "53e0e83caf70d19261f4083978938824", "object_relation": "md5", "Tag": [ { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "blind-eagle", "colour": "#819959", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151583, "uuid": "46a95812-ce94-4b60-8092-a74f2f6300a4", "comment": "Malware payload (njrat)", "value": "b5ff070aa79546ee662377a44ea58f3b5d6f0c1e6a1498a983096b2b4790587e", "object_relation": "sha256", "Tag": [ { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "blind-eagle", "colour": "#819959", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151583, "uuid": "b45bf1a5-1f5c-4108-9659-d4e23f108104", "comment": "Malware payload (njrat)", "value": "1d466f06b727736440a5808b5963e51fa22d29f4", "object_relation": "sha1", "Tag": [ { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "blind-eagle", "colour": "#819959", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686151583, "uuid": "82a2900b-9bc8-4b62-abed-3b213edd7ff4", "comment": "Malware payload (njrat)", "value": "0072a9e79395150d4c620ecc6bcfaa565b0c04d5621e009138f4ac38106ee8324c7ca5959dc05e1f4386961e7bdf836a", "object_relation": "sha3-384", "Tag": [ { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "blind-eagle", "colour": "#819959", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151583, "uuid": "e6f39a28-7e73-450f-a506-958585c0c15f", "value": "T1EBD48452A6DE0084F3F23A009BFD5125BB2BF9D69879CA4E049CC96F67DF500D861763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151583, "uuid": "2734344d-9e59-455a-90f8-8af5ae203512", "value": "3072:dsG7wfkYFEhNe4VTdRnTT8w4TWq9TpoKlz/vPUjUJ2TZqs4gospW+og0S7wQzS1y:vwfkYFXsZqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686151583, "uuid": "2036c94e-c430-4745-ab97-1c839a3c1718", "value": 599254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686151583, "uuid": "81e4040e-c369-47d9-bc0b-e2d25ac201ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686151583, "uuid": "e4df6b79-85e4-4d3a-82b6-5663b8ad7bb6", "value": "INFORMACION DETALLADA BOLETA DE CITACION FISCALIA GENERAL DE LA NACION RADICADO#2023-6666958-996520-PDF (2).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e823c16-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686130036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130036, "uuid": "f8c61279-ab26-4187-a492-1418739e99ae", "comment": "Malware payload (AgentTesla)", "value": "1265ba87324fc8dbad67386fa965e739", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130036, "uuid": "6defd479-84d2-45a4-9ae6-01a7767c8ad2", "comment": "Malware payload (AgentTesla)", "value": "b61eefa8b1751ea5698f8b0fbed1e062a824815cf0a14776e9e0113b704236ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130036, "uuid": "c6c6833e-c131-4bed-a2d0-9dad1fc8c9d5", "comment": "Malware payload (AgentTesla)", "value": "9c9f6a5d59c68d6debede6d0e08ebd60cae2609a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130036, "uuid": "db449654-1554-481d-8fa5-b7b592efd98f", "comment": "Malware payload (AgentTesla)", "value": "78a3285883fd3ff96b550e299ac6b1c051a306b7e79efdaad26f3636b6617a4e6d2c4d1d78e40ffcd05c0829dda1b459", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130036, "uuid": "e73255a2-ca33-469b-bee7-05582349bcfa", "value": "T174F34A6992C98ED1C32F4078E8B11114CABAD1477717E7AD1DA1ACF63F067C7332A866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130036, "uuid": "5c2139ad-1352-464e-9a7d-25da2a8324a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130036, "uuid": "31120d22-70e6-4704-aed0-9bc337cf835c", "value": "3072:Ppsn7KZdJTFtOu1QQxm29Vwyp5e6MWnGnauiimabUls5dvkchK0Y:PDRgMQaX93Lesn4az2Ss1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130036, "uuid": "e81017e2-197e-46ca-ad0c-b78f84a92235", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130036, "uuid": "b5ef0719-5cb1-409a-8792-9f65e34feb33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130036, "uuid": "7526657f-070d-42d5-8ff6-8515da34fa26", "value": "b61eefa8b1751ea5698f8b0fbed1e062a824815cf0a14776e9e0113b704236ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4843b92-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686128436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128436, "uuid": "b1b65927-48e4-4076-af6f-695724906321", "comment": "Malware payload (Loki)", "value": "4d2320d5b7d1a45d87d843ab5ab105d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128436, "uuid": "e717ddac-4841-4cf6-b66a-13f386ac811f", "comment": "Malware payload (Loki)", "value": "b62f7e9d5d3bb7b464e7c83ec0b27f602a5f6d32baaafc53256290c34f76d076", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128436, "uuid": "5f51459c-515b-4daa-bf00-b0e42dc5bdf1", "comment": "Malware payload (Loki)", "value": "8aca8fe2dfa143a3210f00df3f43d4185fefa7a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128436, "uuid": "8633d9ae-5448-4ac2-a596-358d6f5ddaa8", "comment": "Malware payload (Loki)", "value": "b7a1c4a5d8fdfb631c0f958b7475e41b5139361afae63be70a62e7ac85ec370f732de18a81891f78a7eaca9c8ac41117", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128436, "uuid": "45f78d50-7ca7-4142-84de-8b74e34a172d", "value": "T19C343B1393E17D54E9264F329E2FC6E9761DFA908F49BB6522189EEF04B00B1CB63711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128436, "uuid": "eaa53368-e54c-4d30-bda9-07a9c4a165c0", "value": "73f55c9a8ec43dc84ad4d9211db141b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128436, "uuid": "85cc65cb-2403-4137-98d2-619dedca1fd9", "value": "3072:J+5hexnVH2JIELvzZOPqoueYiX4zexvToQ+3cVvywLFvDXu+9hO+d:E5he72JIELvkCoU6IovToQ2cFyy5Dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128436, "uuid": "6a76af93-c19e-49af-b3bc-20a12f2d6eda", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128436, "uuid": "2b3ae869-b921-4978-9515-40f5a85151f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128436, "uuid": "31ea1916-4b3a-4aee-96e6-b5872f956657", "value": "4d2320d5b7d1a45d87d843ab5ab105d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c9c1a8-052a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1686139258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139258, "uuid": "a7e928c5-931b-4397-aef7-50b05990e3fd", "comment": "Malware payload (ModiLoader)", "value": "8f29ce52fe5cd011fa6494d4ae13c8ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139258, "uuid": "efa2fb9a-8861-4597-b769-699b1a2bd5f5", "comment": "Malware payload (ModiLoader)", "value": "b6742722cc6fba8559adf5ebacff443d5953ff8f9fec8266f30ca2830112bebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139258, "uuid": "d8edbe4e-abf1-418a-86e2-332c29cca999", "comment": "Malware payload (ModiLoader)", "value": "5359e6dcf36389fb2f38edbecfcbbd9a932f84ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139258, "uuid": "a427ad20-3fad-4432-939c-55ac48f79d74", "comment": "Malware payload (ModiLoader)", "value": "b0eaa52a8d517e409162f401caa762d8880ef51178b9c4ace9ca3ba1e5d7abadc7e920eedadbb04264a68f68ddabf0e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139258, "uuid": "b0bbc76f-6daa-46bb-b4c7-d74fb9fd3843", "value": "T10405AD56B7E28433D06236749D1B62607C26FF7129A4AC43AFFC7D485B3A3A27819353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139258, "uuid": "05054abc-6bd4-4d8c-bec8-07d2f5f11f96", "value": "c48fa6b31811bf7515d9cc4ed63944b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139258, "uuid": "c4a7d953-f4a9-4e75-ab41-b518e8e2fdd8", "value": "12288:BduXy5c5DIcGJoiBvCrWtfcsvc4qhuugSHv8icrHsjclyFmhV:Bdg8dcGJoJUfP7LzJlyFmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139258, "uuid": "2eb2d153-fb72-4217-8a4e-d026f8a2c3f1", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139258, "uuid": "edae4b04-6969-4c72-b632-b219404b9985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139258, "uuid": "1f7cdc26-3c1b-44cd-8ec1-6d5b1e22f721", "value": "b6742722cc6fba8559adf5ebacff443d5953ff8f9fec8266f30ca2830112bebe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0c3fbb-0567-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686165332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165332, "uuid": "acffc9b7-9a88-42ae-85a5-716e0dfc5c54", "comment": "Malware payload", "value": "b79c954090c0eb0ac0cfe12da96253c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165332, "uuid": "d067ae6c-fb95-49f8-9298-4e964b4042f4", "comment": "Malware payload", "value": "b6ce0375ae4ce3427bb677bcc5adfda35c53cb7adbf8b4ac49f8fad5e745b092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165332, "uuid": "9aef2b7d-2beb-4ffc-b3fc-a79c6bd2629a", "comment": "Malware payload", "value": "d0755e4b159a9e86a04c7351b2730202b9655a44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686165332, "uuid": "aa93438b-7416-43bc-94c5-3956fbfeb25e", "comment": "Malware payload", "value": "609e0e83044e3b122890f9b62d6717d1f4994554b2c138d8579d129543dc4b38ec079e269d9dc8e146a0d08c3dba7e09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165332, "uuid": "81d1106a-acb9-4b40-8890-b152fd7422bd", "value": "T125548E1262E1BC71E5E746725E3EC2F4662FB4216F6D6BDB22465A1F04721F2F932302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165332, "uuid": "e4b99278-240c-46f2-bfd6-e4cb181bb77d", "value": "04fcc8db11b5c1b7316151fcbb546c01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165332, "uuid": "bbb4c876-d18c-4478-b104-1f5e77709ae7", "value": "6144:M280VAqNDcOLJhmuqYgcl5sMFVkRRSyXn:M2NnhzLfmbYBl5Zi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686165332, "uuid": "6cd1f6ef-b2cf-48da-84e7-328ed0670d63", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686165332, "uuid": "f71bb788-94fc-4761-b5ce-28816d031d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686165332, "uuid": "1c70bf9e-95e6-4e3a-8e42-590c1abc148e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57704e1-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128384, "uuid": "0227964a-5fed-45e3-8663-034fddd719fb", "comment": "Malware payload (Mirai)", "value": "93c6ff4b0f05dae8d560a9f65afbc70e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128384, "uuid": "6228c859-b239-43da-96e8-b314d66261ae", "comment": "Malware payload (Mirai)", "value": "b716e51a266e5921c5ce33609e5dcbf6db038298f80ba6504b4a0abbf8444cf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128384, "uuid": "0409e324-069b-4bbb-b7c3-0b2662a7af6a", "comment": "Malware payload (Mirai)", "value": "351bcedf18161a9da8db65216b5304a4ef69f0f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128384, "uuid": "8c3072a3-4126-4f52-8e3a-c0b512f8b4f5", "comment": "Malware payload (Mirai)", "value": "132e2418fa8fbdb3699779c7d085ae69ab305ba545c68c22ec51daa693e28dddb874e03ffaf81f2554c169c73a558d0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128384, "uuid": "4affe363-be5e-441b-8396-eb71d0e5c32d", "value": "T114C3C63B67170E23C0CA50B101E34332AE75DE9B34B952D7AAD07D686F36A843856BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128384, "uuid": "68e733a1-f1e0-4cd4-b8ac-c7d101027d4b", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPPL7ymm/QMurB1nKGNb:SMQplVPamm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128384, "uuid": "b1a36672-29fc-4f1c-adad-602bb11967c8", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128384, "uuid": "fe9e0289-f6aa-4307-85b8-6c4de5d913b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128384, "uuid": "4be5d4ba-9bce-44df-b362-b4d0b4124167", "value": "93c6ff4b0f05dae8d560a9f65afbc70e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf61e5c8-0528-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686138333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138333, "uuid": "ee7e7942-7a1a-44f2-b0a6-fb9f7c46dd41", "comment": "Malware payload (AgentTesla)", "value": "d9b2665773e1e3dfc4c6a0e16e64ef52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138333, "uuid": "7c39eb81-2b24-4023-995c-dc7e297ba043", "comment": "Malware payload (AgentTesla)", "value": "b86c811ee7f0f3e6c8d3d1e8a9b431f19232b6abae2bc0c85ebcc03857f1bb68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138333, "uuid": "0ed327a2-e892-49ad-9843-dc7b7be978a4", "comment": "Malware payload (AgentTesla)", "value": "303b98a5296aa57fe9e6a4506eb44f15df20924f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138333, "uuid": "9ccf0868-acbb-4fe9-a590-40cf9c0ba1f1", "comment": "Malware payload (AgentTesla)", "value": "0f160a10249826cf2f9c62767ad9ae3fd1e1748f3e8276a8b4ef066c918b10a146b83a14d50dde6eb9e1a8040a730456", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138333, "uuid": "d51b7e66-c634-4931-ab96-c17bda56c25c", "value": "T10A428413236C9261D7753E318FB65E0D2AEFB312D472C9DE9BCC1B2A5EC22034491756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138333, "uuid": "8299408b-4e5c-4f3d-92f7-4a6eb0161f69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138333, "uuid": "f1b5a82d-bcbf-4415-8135-08ec83bbe1a0", "value": "192:XfPLlLSclLMEYjJ1DRulL9q4PekyRbdXFTKWEBbOy2xOdV/0xewPwz:XfPLlLblLMEYjBsL9hcdXWf2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686138333, "uuid": "c57a5a77-7e89-41a6-88b8-db795e3f671c", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686138333, "uuid": "b6a4a9f7-8732-44aa-90fc-78bb9e4297c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138333, "uuid": "67614836-bba2-4fe8-b8f2-9b9ddbc93f47", "value": "b86c811ee7f0f3e6c8d3d1e8a9b431f19232b6abae2bc0c85ebcc03857f1bb68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a720bf4-057b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686173758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686173758, "uuid": "1590c9cd-cd3f-482e-89b2-1c00893ef81a", "comment": "Malware payload", "value": "a254e95af764b162db0dc73636f7f5dd", "object_relation": "md5", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686173758, "uuid": "1173d155-b6a0-4bcc-a362-e4302aa4902e", "comment": "Malware payload", "value": "bb02043cb749f91364f655b35404dc37e517d6aa7cdcbf474bee1fa6be5abe5f", "object_relation": "sha256", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686173758, "uuid": "a32d50aa-971d-478b-8405-e89e9f5a06d1", "comment": "Malware payload", "value": "04a370029afb2f25c22445f53ef843af7facce63", "object_relation": "sha1", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686173758, "uuid": "ad6fbd94-0517-4014-9a4e-432d54251ddb", "comment": "Malware payload", "value": "79489f19588d965fba9229245ce21d143fad42f1429e137a928039efc0f584ddb21aa83b43101610aa3cbbdc162a013c", "object_relation": "sha3-384", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686173758, "uuid": "80bc7623-ac3f-4b02-9e4b-3893a4ac6b42", "value": "T1DD3733A90549CBA9694D5C3CE2FEA8C0DA075BCCF56C9AC6A73B16583473B3771836C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686173758, "uuid": "5f997bfb-b51b-480e-a95b-7110bf2aa305", "value": "393216:iGAGCSlH/Lzw8nNnil9nLTYDdfG9QaGfRpH93VaxNIo9V/zj1c7llwjvd:dZH/Lxil9vYDd4QaYpH9Far9Pzj1c7lU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686173758, "uuid": "d47f1d8c-3849-4e11-9ffd-7803d0387df7", "value": 22924654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686173758, "uuid": "62055815-2e3c-4c37-96a3-7e711a44499c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686173758, "uuid": "efa0e7bd-696d-4cc7-a257-a3c30db72be0", "value": "1234.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d54a553-0529-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686138678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138678, "uuid": "0fa7ddec-9941-41e3-80f2-fb00d867fa8b", "comment": "Malware payload (Formbook)", "value": "1c54017edfd8a1b4b9e92852b0d4bc73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138678, "uuid": "7bb68906-f794-47eb-81bd-4eb6a8652e4d", "comment": "Malware payload (Formbook)", "value": "bc7c75d0ea4c85a5e6c27bced82d81e4be9394455fdd845b3a4436550de78b2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138678, "uuid": "4b511f01-c327-45ff-bcf1-6feb0b7786dc", "comment": "Malware payload (Formbook)", "value": "74110ef342c22f794b0066da1612019e07e68fb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138678, "uuid": "881b03d2-5157-42df-b0a4-208cf2ba2389", "comment": "Malware payload (Formbook)", "value": "f48f83b9b72f3e0cb5b4769d4c67b1cd2b580f984bac496201b4b631bc18a00818ef02e8eb01797ccc9cc602d94724a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138678, "uuid": "615b2278-873a-427c-bbad-28efafe50570", "value": "T1E264022537871905C6218B7290D7614837B1AB43A0E3E36B694F31E98B963D3352F9FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138678, "uuid": "d43ff1d1-4182-4bdb-b731-41f932326046", "value": "6144:3eSbihzgTFF9TE+4SPLQ3h7i86ooVn8zv2GsDcHb2CNsBPxkn4:7AkFF69SH8KVAHNyCNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686138678, "uuid": "1c452a3c-0ca1-42a3-94bb-8e7cc33325e8", "value": 331336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686138678, "uuid": "a1ce37a2-72db-41ce-8bf1-971fc5023c8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138678, "uuid": "87ce9243-3a70-45b3-861f-1f7461f68bd5", "value": "bc7c75d0ea4c85a5e6c27bced82d81e4be9394455fdd845b3a4436550de78b2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ae5cb7-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686130067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130067, "uuid": "87890a90-3170-49ee-8c60-a25622839ad8", "comment": "Malware payload (AgentTesla)", "value": "81f81fd0f05f3c17d048594594eff66e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130067, "uuid": "0d061ced-224e-4c70-a97b-9951db898579", "comment": "Malware payload (AgentTesla)", "value": "bd46a723d17048369ac18ff1a2ec0d0f54a8a4a3c5e23d56a53e014a02d1c42e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130067, "uuid": "070f25e3-325f-4819-94c7-d43997d0db41", "comment": "Malware payload (AgentTesla)", "value": "1ed6c21a82e8867702411a99c2ce9f090696cc63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130067, "uuid": "8158d27a-4322-44d9-a01f-78ba45771ec3", "comment": "Malware payload (AgentTesla)", "value": "5a2ee9c8185199be9f50b03bfd6615182807992c260a921e39e58bb5b2d942670b72483a10fd80986e9dcf6e01e419e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130067, "uuid": "ee1e6995-8a59-4381-9409-c688ac9e9a12", "value": "T12FF4126C33F7191FC41B7FBC0800A172C2F966A1B423E5974E6BE99DDC42B650AD648B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130067, "uuid": "d48ea442-a8ea-4125-8afd-f31018831ea7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130067, "uuid": "3b471fdc-b643-49db-ad7e-d40a346988b2", "value": "12288:CE+J/M+Jhewx/NscEQ+vgXK1HsaPkIaUiIfulwZ13L/YNEZSJ+p+HZBxQcAjeimU:I/thewlqB6pXIdiIfwUd7YR+cHx4n7Eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130067, "uuid": "00d6573c-2dfe-42f5-be17-c548fef08993", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130067, "uuid": "ea6d62f7-7e1a-4ce3-92d7-ce052a0a98e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130067, "uuid": "ea8f3a2f-f8f2-44b2-b35c-fd39e1ec24cf", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1199eb6-0582-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686176910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176910, "uuid": "02a22b17-cac7-4572-8784-9a1d9fe1a539", "comment": "Malware payload", "value": "d3e975c99b61f9e36bc4be3d218d484d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176910, "uuid": "11b7cd3d-0e37-4b50-b57f-8c3f2d1ad330", "comment": "Malware payload", "value": "bde590ce8aad046c624f2b8b588d872f905e7f12acf69d49eca7299f60c7b906", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176910, "uuid": "d3aa8cb4-294a-4451-856e-76784270fcb5", "comment": "Malware payload", "value": "ba164b5fbdcd367779025138fac43b59e4951468", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176910, "uuid": "405851b1-3c15-4e0a-a457-f9de8f58b398", "comment": "Malware payload", "value": "d9f36a52a837128000219164c2be809598830957e07cba364c8eabc214cbc550614e5a1cb62dac60efadbcdfddbaa01c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686176910, "uuid": "e9fb5c12-5093-43b1-bc99-999d7ec2d7c4", "value": "T174A38D1276DCC2B5E81A35704C60EDB56AF9B979377F009BF78906692E233D042B271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686176910, "uuid": "c11c18bc-e4bb-4f40-826c-8154037b5420", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686176910, "uuid": "32400772-2cb6-484d-92d8-0c1d30bcb759", "value": "1536:Rp6kFya9c7Ok/YNQmdgB75eGFKiTjyXX9di2YTHLYjzDm:bVBQmy1KiTjyHxYTHcj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686176910, "uuid": "8ef9bf07-34dd-41d1-b337-b89a578d4c5b", "value": 103520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686176910, "uuid": "13e85e6c-e903-475d-b315-d511e3e954f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686176910, "uuid": "e964e2b3-b058-40af-b278-1c7ca6c409ed", "value": "SecuriteInfo.com.Trojan.Agent.GEZN.17852.12552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6c7ba9-0516-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686130521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130521, "uuid": "f62fefed-416b-4a88-8fcf-ad604f96ec19", "comment": "Malware payload (RedLineStealer)", "value": "4b53a2ef8d9d654910b27c8104354958", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130521, "uuid": "fb910cbd-3919-4a9a-b226-13a09f677e20", "comment": "Malware payload (RedLineStealer)", "value": "bea375529a4692a5743fbc11bdcc2e27165bfe110a68d32cea03715a6d9c6ff2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130521, "uuid": "617e4f67-cf48-4db5-912c-8ed2176c48b1", "comment": "Malware payload (RedLineStealer)", "value": "352d5ca7aa4936399faac0baa5a6d881175ef121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130521, "uuid": "5165243e-0a61-4a62-8db1-21c58cf778bd", "comment": "Malware payload (RedLineStealer)", "value": "0b3fa8a974cd6ad3a5294506fa23f0e65a8c36ede67d3eb1ce4a5ad94e97cbab17fa850e24ea86fb2a4e589fc038850f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130521, "uuid": "cbb0c487-c1c5-4e44-be31-525b30ac926f", "value": "T13D052263ABD84170ECB46BB05CF602C30E3A7D664938436F6355A64B1CB36A4E93537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130521, "uuid": "07649eab-b28f-4e3e-a094-e8961c36559e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130521, "uuid": "afdec7c8-4c58-414d-a973-a681cea729f7", "value": "12288:qMryy90xVNzGtx+/DFgrl6nl8CUpKSGZqJDsw0JQbMA5yPByJ0q4dJWXQNKU3y6l:MyQVNzGT+/Z7lwpheqJIwgQuS34dckZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130521, "uuid": "67877c43-bcb8-412d-a607-77ce7b14cb11", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130521, "uuid": "990b441d-17a8-4f83-a847-eb9114216037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130521, "uuid": "716986e5-c45c-4f7a-9217-837c285c0900", "value": "4b53a2ef8d9d654910b27c8104354958.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c1d1b0-04d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686101699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101699, "uuid": "b397a370-3f6a-49d7-a206-b08f75c0cd22", "comment": "Malware payload (RedLineStealer)", "value": "d82a579f47866646558ab1199f1d2466", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101699, "uuid": "69a72694-8257-413d-b89e-c58015754bc0", "comment": "Malware payload (RedLineStealer)", "value": "bea70ab601b24724852cb0c1e84181ca8adaab537f7319e1aa7723ddc97db42b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101699, "uuid": "15aa007d-0899-4ff6-a845-3797aca8e91e", "comment": "Malware payload (RedLineStealer)", "value": "aa6861f988269b412c2c6dfe838cd4b021f488a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101699, "uuid": "aa6fd3f8-7a8c-4cb2-8399-2169d333e642", "comment": "Malware payload (RedLineStealer)", "value": "a0eedc704b5061457e8fc8e7fa674e6dba83b51cd14d11190c4f885f8c6d12a3c2ecedf54b74de645a9a34255f455f40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101699, "uuid": "9482a207-31c9-4ef9-aee9-16a0aaffbaa2", "value": "T12144F853E2937D64E6254B368E1ECAE8771DF9A18F59776E22189B2F08B0071C163F31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101699, "uuid": "735dc93c-e6bd-4d26-abe7-82dda956a1b7", "value": "cffb13fd9da7f89cf243dfbae0e78962", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101699, "uuid": "6535b1fb-8cc7-45b6-9632-7337e84546d8", "value": "6144:uXDWOA17P8mXLaaCppfrx34u6dQAyy5sYc:uiOAdUmXLaaCpxJiv5sD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686101699, "uuid": "ac4d094f-ff43-48ce-824f-fae5acb0da49", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686101699, "uuid": "c281e2de-aa1c-4bd0-a441-1f7e1011053b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101699, "uuid": "431ad1d0-b0cb-4438-8d59-b973d21284af", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afb0083-056e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686168202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686168202, "uuid": "3c2ddbc8-9ed2-4a40-93f0-dac62d54b8a1", "comment": "Malware payload", "value": "e93e12945a7eba0b34996d6d9abff50b", "object_relation": "md5", "Tag": [ { "name": "POWERTRASH", "colour": "#AAA91D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686168202, "uuid": "c02517b1-4974-4ee7-8344-2dc1d8b7c42c", "comment": "Malware payload", "value": "beb543e25cf0a9df7b6600bb03626df66f46f88cfe83edd7edc5049394dc062a", "object_relation": "sha256", "Tag": [ { "name": "POWERTRASH", "colour": "#AAA91D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686168202, "uuid": "f67aecf2-4528-4aa2-bb18-b4fd0f29d688", "comment": "Malware payload", "value": "9707e4e4a17039b9401b90bb6f14fa67b7c53415", "object_relation": "sha1", "Tag": [ { "name": "POWERTRASH", "colour": "#AAA91D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686168202, "uuid": "35cdde10-c17a-4a2e-9223-8805ddcfcd7c", "comment": "Malware payload", "value": "4c128b2e9781344fd7eca5dfb46e88812fccca3f53d7dba87168fc9f6629aabd4b1aa618c012602fd4c98d62262ac00a", "object_relation": "sha3-384", "Tag": [ { "name": "POWERTRASH", "colour": "#AAA91D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686168202, "uuid": "6bd60ccc-d964-4284-9aee-2a91451c0633", "value": "T162F3292D26CCBC70E9E79FF0422F446D056A72213413D436116D86E89DAABBE9B53C1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686168202, "uuid": "fe10ff3f-16d9-49ae-b5c2-427013d13466", "value": "3072:2tCodq1hy8YJ4KYO/pAY/4mFok3f9z/PKZHItcB26tonlcujpUH/gY5:2tPX97P/5FokFza9VQdlc4pU4Y5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686168202, "uuid": "1e8c24c9-4b46-4dc6-8190-b6cefdbeee10", "value": 162693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686168202, "uuid": "2334f211-8dc7-4746-bb90-6bc583260e0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686168202, "uuid": "a40b01a6-f330-44d5-9fa1-12489d5160fd", "value": "icbt11801_64refl.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcb9b18-0538-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686145232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145232, "uuid": "dbce70fb-5a84-487d-b8f3-daa7e07ea1ac", "comment": "Malware payload (RedLineStealer)", "value": "15783c2f6d831c104c8fc9a5c0ca0a2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145232, "uuid": "a60f33ba-2249-4c18-ac76-3489a3733902", "comment": "Malware payload (RedLineStealer)", "value": "bec7545e47cb2434996e76018d36da93bbadd69e1f6435d2e194b512e85a46c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145232, "uuid": "d85904a2-cc3a-4a86-b2fe-4afff09b692c", "comment": "Malware payload (RedLineStealer)", "value": "3d501f50876c43112171436f2bf2977e1aeff98e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686145232, "uuid": "2ca3ecc3-fe09-48b0-bccf-9d5666755666", "comment": "Malware payload (RedLineStealer)", "value": "eca9586adf6f8acac4d4d2e5f73a9386ad168cacf563cdf3dcd0487d1ad2a88f9bb931f6668c17e0c7aad98c3cecd292", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145232, "uuid": "dcb51a44-f854-4452-9462-bd88e7f92483", "value": "T100C41202E7E94132EDB2273089F101C71B393DA24DB583AF2B859E0E1DB25D59971B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145232, "uuid": "bc5d6b58-b2c9-48f0-96c6-b46c31b1076c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145232, "uuid": "42736239-30c3-462b-b726-66f97c18c701", "value": "12288:FMrgy90fPJfViUKiHnmuFqgZpDMrH/UXnkhl0lBgFdEx:ZyKJtiCHn78gZR0fSkhlAgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686145232, "uuid": "048fa554-fd97-4abd-9524-db858f9bc18b", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686145232, "uuid": "3e8eb32a-b2f1-4c06-8d7c-9cf89fd6292c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686145232, "uuid": "61c9281c-02a8-4949-9529-ef9cf0afbdca", "value": "bec7545e47cb2434996e76018d36da93bbadd69e1f643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdfbec8-04d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1686101526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101526, "uuid": "db8ba8a6-f772-4bc3-b472-481297f16457", "comment": "Malware payload (Stop)", "value": "03483bad9b960538fe39ff5aab1a907a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101526, "uuid": "32be90b8-1363-4bd0-b0e8-c33441fbcd58", "comment": "Malware payload (Stop)", "value": "c041c2a6e4803095086cc704bb84f9c7b377c6c4720bc45f76fc93fb53beb1fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101526, "uuid": "fdad13c7-b819-4c05-ae63-e6bcab80f05d", "comment": "Malware payload (Stop)", "value": "444d08535d4d700a4259f27a056275d5b0a4610d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101526, "uuid": "c6f0f6f9-63f9-4514-80a5-1649124e3661", "comment": "Malware payload (Stop)", "value": "b95f2576dad44fa439042833736d9232716b3773b3e6607754453a005a7e2694814445864b439e58962bf28f01c9f09a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101526, "uuid": "6c067d31-11ae-4f90-ab60-e92fcf28871b", "value": "T153F4F113A2E17D54EA264F32DE2EC2E9771DFA508F58BB7622189EAF04700B1C772745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101526, "uuid": "87043e59-dc57-4785-97a6-93c415a34515", "value": "73f55c9a8ec43dc84ad4d9211db141b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101526, "uuid": "4127a56a-833e-4c81-accb-2f521356f1e5", "value": "12288:T5fbu5mbzSITzDOR3TgKOl1XHcaeS+lQS4qEuqLMUmLjpLfP+b0:T5fdnSWOXcHBeS+W/qEdMUmRL3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686101526, "uuid": "a4a21702-f570-4795-8826-3b65a2c8ae16", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686101526, "uuid": "75849c70-71cb-4802-8e08-124a3e241f11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101526, "uuid": "f0313f26-1d5a-413f-a37c-6bd4149a7fa0", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7f16de-0565-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686164205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164205, "uuid": "122aea78-f9bd-4abd-9b62-e637c83ad799", "comment": "Malware payload", "value": "042f919d5298d64aece2cf280adf7b32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164205, "uuid": "6315d93f-c7f4-4b20-9d11-7d8097f297ab", "comment": "Malware payload", "value": "c042a2264faa2bf81b7b057d280ab14c2027b8da71cf521d4e9bd2e8e08f3e8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164205, "uuid": "86c10a5c-b831-48f8-b95e-e8de3cee9c88", "comment": "Malware payload", "value": "f3d0c561f6243e5f47a979bdecc73c859fa1d3fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686164205, "uuid": "57f8d3b3-7da5-469e-a644-7c357d437a30", "comment": "Malware payload", "value": "98b00e844c6e5a45107c99206ffd43ebada100bdfeb85ac30de1c92f0a502f82137420b33ace1ef9885b0f6b595f16b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164205, "uuid": "cb564f5b-820e-4bad-bb9a-ee91f26672fe", "value": "T153052242A7D49532ECF24BB115F612C31F38BD914C74830B269AAD2A1DF3685EE72727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164205, "uuid": "05258f95-1167-4463-b185-cc961a187240", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164205, "uuid": "bd2e96a4-d78c-48af-90a0-45edd40aa540", "value": "12288:FMrMy90YuFRTuYgEV0Qni27ap+4AC5qaH1ZMh05r/KyONB9vc50zvtqAX8+ajvad:dyO7aYgD27a8435qaH1Zk0lAsia0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686164205, "uuid": "115e1fa2-a4a9-409c-bb6c-2ec2670a056e", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686164205, "uuid": "f5be45ef-5072-4e25-9722-f2a3992d5e55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686164205, "uuid": "ff32a478-aded-4a40-893b-7538fa018bd4", "value": "042f919d5298d64aece2cf280adf7b32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925567f6-0563-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686163571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163571, "uuid": "4accc5b9-0407-407b-bb27-abc132490c45", "comment": "Malware payload (Amadey)", "value": "1758e059a9cc977098c29b3a033c8937", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163571, "uuid": "e86732d1-a2fe-410c-ba69-3453c321f82a", "comment": "Malware payload (Amadey)", "value": "c0623cb3dd440fa4bf164a486f0ba0831e17dc0879757d55a2bd98d6d8ad4366", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163571, "uuid": "eaf22a77-3d83-4e75-bdd4-8ef33015b07e", "comment": "Malware payload (Amadey)", "value": "2a262e0ce7cf25bae2cc81bd99d6536b509550c4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163571, "uuid": "a2b06d2f-44f8-49d5-9e89-0d0fc2d85249", "comment": "Malware payload (Amadey)", "value": "14082b2dba89c9354b4572abc7749af7e9c9995e035909ff5eb255623c8c00b9dfef460dcab05a7513068d1cb85a0a51", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163571, "uuid": "e4ec73f8-15be-43ba-b895-387bc65df7df", "value": "T1A424F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163571, "uuid": "1aaeecf6-c073-4919-a728-02062c07e214", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163571, "uuid": "91ebce41-53b7-4877-b8d4-080c09f45c42", "value": "3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163571, "uuid": "2ab0f8f1-7352-446d-887d-5a9daa5b053a", "value": 210436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163571, "uuid": "ba5b21fe-59b2-4ed8-8167-f011ac4249a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163571, "uuid": "64ae0437-4a6c-46ef-a69c-c898410d0037", "value": "1758e059a9cc977098c29b3a033c8937.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0badcb-04d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686101744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101744, "uuid": "c1ba9529-1096-4ac5-8ba8-ecab75785873", "comment": "Malware payload (Amadey)", "value": "22acf65ad76e4322a020bc1afdc2c935", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101744, "uuid": "7c99902c-614e-468c-be5f-edbe8bcb6e4b", "comment": "Malware payload (Amadey)", "value": "c0832b1008aa0fc828654f9762e37bda019080cbdd92bd2453a05cfb3b79abb3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101744, "uuid": "b3d2d0eb-7114-4a49-ac88-a021c09d91ab", "comment": "Malware payload (Amadey)", "value": "808c2d353ded6249bdb2cc560047fb374e8bc5b2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101744, "uuid": "bfa7d5a1-8a1a-40cb-b967-eff73c7e8017", "comment": "Malware payload (Amadey)", "value": "bd221913ea8d772ed583344e363ab32f2829c2228c12ceff654af83d0b51b82b21ea3d72dfdd0532d3f527b3afa4c199", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101744, "uuid": "e69c49b3-0127-4ae5-a593-e34de44c4d0a", "value": "T15544E853D2A3BD54F5264B329E3EC6E8371DFAA18E59776E2218AA3F04B0171C163731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101744, "uuid": "80618c5b-d98a-40af-a63f-92994bd5b7c3", "value": "cffb13fd9da7f89cf243dfbae0e78962", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101744, "uuid": "8ff662d5-7ec8-43b0-b1aa-292b57fb36a5", "value": "3072:cLeg2PMPu+JhaCkBmxvMcKedNTYko2WglgEYhQLRARwObINwaUiraf2nXn:7g2P3ehaOxvDDrKUYhQOOwINwfirj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686101744, "uuid": "7235f275-a070-444e-b88b-5e56a8341735", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686101744, "uuid": "e30d27f1-928b-4483-a15d-09faee2d2102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101744, "uuid": "1096f60c-bea1-4a84-bac5-9b228073f3fd", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e665c9-0542-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686149324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149324, "uuid": "25803d1d-8475-45a2-87ff-6af929fc2bd0", "comment": "Malware payload (AgentTesla)", "value": "fcc8cbfcef7fda3cf7ee95bd020c3a31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149324, "uuid": "9fccf821-f451-4b19-af15-9256a35f6f5f", "comment": "Malware payload (AgentTesla)", "value": "c1861f48bc8684453fc7a339b2bbac26cd79e2c145706066a77b8ab482660c84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149324, "uuid": "31f2c753-0d0e-4f2c-aeaf-6c99e0e0ab3b", "comment": "Malware payload (AgentTesla)", "value": "7cd6d1cd3e179335c6b4b99a443799eb0d15b036", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149324, "uuid": "c2db6782-0088-4fd2-970e-a827959351ae", "comment": "Malware payload (AgentTesla)", "value": "b5a54469ad19c118736d96d57fcb446dfe16fdfbf8eef54a227867c6018f3bdd40e5086035a8dde0a1bd74d292ad1527", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149324, "uuid": "9e77f416-7def-471f-865d-4750b6732211", "value": "T15515913816741E62817AE26D95D9F91BFA544CD3360CDC1E8AC64FDA4A03B32E1CED1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149324, "uuid": "ac38d0a6-35d4-4092-8060-4296572fcd6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149324, "uuid": "88623b2b-c988-43f2-bb24-ef3fc6edc83e", "value": "12288:Rces835+po/LTofA8Hx7JnRu5wKs3Pan0Af/1B:Ges835+pojEo8HxXKs34X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686149324, "uuid": "340f9f94-82d2-4e91-b71c-e5f63accaa40", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686149324, "uuid": "16b9f692-41ed-4521-b1e8-7b3c477e1a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149324, "uuid": "26f55d2c-b6d3-4ab2-962e-c238f90bddfa", "value": "Order FC22068032478332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1f81c7-0542-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686149549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149549, "uuid": "4d750fbd-743d-49fe-b003-3ac20c08eac4", "comment": "Malware payload (Quakbot)", "value": "8c836e7cbb1be6066855c419822a1437", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149549, "uuid": "e916526b-c723-40b1-b5c2-2f5d5959975d", "comment": "Malware payload (Quakbot)", "value": "c219d1d518dde48b751f44298530fef731cfb1c0abf969a334bda025423ba162", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149549, "uuid": "0b4e7c1b-6987-4eb2-abd8-f6edb70975dd", "comment": "Malware payload (Quakbot)", "value": "6793557ed4c894fd8aa101eacb121b42fcaea3f9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149549, "uuid": "d738da02-8d5d-4154-8346-f7b274decfa0", "comment": "Malware payload (Quakbot)", "value": "e9f6b001a2c75b99b5135f58a4144e578499f9884287202aeaee77db3cc6dd9f61ffacb9ad0fe97ea859863cb79f83ee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149549, "uuid": "1e5c4b73-3963-49d8-b05f-f9d469b204c0", "value": "T184A4BE12B881C07AD0AD103471BDBA72587CBE351394C9CBE7E2A9B84E175D26739D2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149549, "uuid": "958d7d77-fa77-4904-a0ac-4d3d04421023", "value": "d19bc81dd07500009987ce5d4014a449", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149549, "uuid": "6bef91ec-7e68-4b20-ae72-4a75db73219f", "value": "12288:1BBzPfDyNMCLzaf1jhk6rOB4VzW9PXNYL5FHnKaWl5N26tw:lfeNMCn0j5rjI1NO51SI6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686149549, "uuid": "1586a856-ef1c-47fd-8c30-de1a33a7d8f1", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686149549, "uuid": "5e92b55b-7815-4a88-a734-b53112d07c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149549, "uuid": "6e110083-f9a8-4f07-a4c7-0452d443a5bd", "value": "0.49569073719754747.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e40ee76-052d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686140210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140210, "uuid": "eb5dfee6-4c24-4563-b420-831ad3a6688a", "comment": "Malware payload (AgentTesla)", "value": "fff1b886f7d7f40bb239fad9059c1073", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140210, "uuid": "6f756385-29c3-4c1b-9e43-5c9b135b0735", "comment": "Malware payload (AgentTesla)", "value": "c2746aa548363ed963af6f2acd25f456401819163861f4247c216dc529dc11f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140210, "uuid": "22e362c0-139c-4b1e-8286-2a473d6a998a", "comment": "Malware payload (AgentTesla)", "value": "0caa6dcfbde6209714272cef3f0e1f5deeae023e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140210, "uuid": "c1a2efe2-e877-45ab-b1ed-ed3e780399ba", "comment": "Malware payload (AgentTesla)", "value": "fca31abdf763de405279e960561f3128bb0f4afa2f047dedc26fbbbdd54ff50323558b024adb3c05d46034535222e0be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140210, "uuid": "fdb1b7e7-4268-4258-9dac-9f00b51ced15", "value": "T176E4235A6FF22F6B3B4124CEFF2275B1A5A1F2B873247435A59C8611C70A20DA54CDEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140210, "uuid": "8fc1229b-5828-4785-b980-324c06e19d67", "value": "12288:uL9nXrX2wm+21oOZ0yp1sgtlgqBHh3sb4JIhTVoOKuGXLP2Sdnf11qSGJ6zg:uRrX8+S3ZPpCg/gIB3EhTVPKpXLnnfLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140210, "uuid": "7d4c396c-5d8f-4e2b-ad55-e3f450186318", "value": 699035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140210, "uuid": "8a124806-32ba-4390-9642-58a7656076f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140210, "uuid": "2123af04-c93e-444b-adbe-659e760fcac4", "value": "KYP22-001 shipping documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1113d273-0540-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686148321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148321, "uuid": "1868d8a4-8003-43d6-afcc-2f73560f0cd5", "comment": "Malware payload (RemcosRAT)", "value": "5a01a667c84893b0ab403b39b3c73b53", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148321, "uuid": "777845dc-0194-4319-bc3e-ac9249729e97", "comment": "Malware payload (RemcosRAT)", "value": "c296470f0a24955e74c6695312974b6f7b32b89147368e84804b47f76d5befa3", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148321, "uuid": "5d011565-ad55-4511-8251-e43ab79dd6fb", "comment": "Malware payload (RemcosRAT)", "value": "61e797ce7faf1a6eca4038b29aac0364fb61fba9", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148321, "uuid": "f6f6b3a3-4702-41ff-b56d-7145daa9bb27", "comment": "Malware payload (RemcosRAT)", "value": "b97d02455e020c895ebdec8c88e471ab0ef6de2e61af75a9e8d64ed2f84d90de01e2e7672c95080cd4af776d252f43cb", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148321, "uuid": "e154c216-a635-41cc-aa10-9591c1653f5f", "value": "T105B4F19D769072EFC85BC9768EA96C68FB503877432BC203A46315ED980C98BDF054F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148321, "uuid": "e1ed4d74-1441-43e4-94c0-255b0525f5a7", "value": "12288:eN44r9HYXzdEXVDBbupm9PwbZxCMhrI5cRdbtF9fgdm1ttt:u9GeXVDmeYFM5cRdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686148321, "uuid": "022d4707-8d54-4b72-91b4-f39fe86b8bf2", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686148321, "uuid": "45e2dbb5-eeec-4ff3-b964-9a6d2306b7ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148321, "uuid": "1023b78f-826d-4a6b-9c3c-dc80f57ca6fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b163a4-04d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1686101440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101440, "uuid": "cc52586c-3717-4a22-adf4-47946b1c94e4", "comment": "Malware payload (ArkeiStealer)", "value": "f76b7a03bc4db7e669adc6a0eb80322a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101440, "uuid": "e05dfc6c-768c-4891-b936-9f32ed4c8d25", "comment": "Malware payload (ArkeiStealer)", "value": "c2c5560cede5fe447363e0d432707fc287312c20e92715b59700888e77eab92d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101440, "uuid": "a8359a93-6420-425d-9fbc-d85f1c85dbc5", "comment": "Malware payload (ArkeiStealer)", "value": "ad3ef2ea2dcf95e805c7be56a7d63f654328121e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101440, "uuid": "0946e6a4-f31b-4c5f-8e58-5f5482977da7", "comment": "Malware payload (ArkeiStealer)", "value": "4d5dd17677ad7d48053cda30ec3d64e017b96759a2662f32c6de78f8875bbbc6b97ac83f585ad14cb2bab599d2e15be2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101440, "uuid": "77cf67aa-27d1-4afe-93a9-abe04a035fcb", "value": "T123748D0363E17C54EA264F32DE1EC6E9760DF6908F19BB6A22189BEF04B11B1D763315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101440, "uuid": "e49375f7-5b33-4e49-a5a0-918abc620904", "value": "73f55c9a8ec43dc84ad4d9211db141b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101440, "uuid": "87e8abbb-f88c-4991-9980-d573012df9a0", "value": "6144:E5CQQnBqVqhJJPZE9q6sHDNov5OOEkWprEFeJVU+WtiDllr:E5JQnBXjK9rsHDNo+kWpn4t6lN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686101440, "uuid": "733d845b-6725-4436-a5ec-9e4920556e60", "value": 360960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686101440, "uuid": "ca5a213b-cf97-405a-8dd3-c8952e274499", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101440, "uuid": "b00e6596-d5ab-4eb1-8238-5eeef79451da", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd5830d-0556-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686158037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158037, "uuid": "b43d95b6-25d5-449c-95d5-3f5681911fed", "comment": "Malware payload (AveMariaRAT)", "value": "120d685f89e2953d1ef59a28f3d5b464", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158037, "uuid": "3d4ed7d8-d1c1-4c86-8819-d7147a65ae9b", "comment": "Malware payload (AveMariaRAT)", "value": "c6d715757297e68e8c898b5c2c11e95883d17d428b13bd9318ea7122aee8c034", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158037, "uuid": "a0f3a9e8-be7f-4527-a995-fde546409ded", "comment": "Malware payload (AveMariaRAT)", "value": "a9d6db9ab0c92ab1463b250290aa68ab740943aa", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158037, "uuid": "4648ae82-5fae-40dd-ba9c-ef7c9deeef54", "comment": "Malware payload (AveMariaRAT)", "value": "5d1cefca5a800097037a47df234fc2264e96401321c356b5baf3f2096062f49aae5ce978fd9b1637aa2c03d999cb70dd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158037, "uuid": "74040c31-cf35-4567-8732-1bc0cd977896", "value": "T1C134DF8677C04B02CA4958B4D0D369351BF6E6C73A31D3457B5882A20F827D89E9BFED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158037, "uuid": "5e6a48ca-d69b-4fdd-bfb0-acb3f01c0e32", "value": "6144:bp/8sJ3Psr6CQ5d/90RpEGUvHYIGbdrKW6kCmn4:hJ3KbudSRp0PxGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686158037, "uuid": "9dea77f2-83b6-467b-aa8a-aafb459b47a8", "value": 245320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686158037, "uuid": "1cfc4620-350e-4ba4-acc9-0e1628e6a571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158037, "uuid": "d5bbcfb6-dd13-4edc-b28b-2161754dd99b", "value": "c6d715757297e68e8c898b5c2c11e95883d17d428b13bd9318ea7122aee8c034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df71535-053c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686146679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146679, "uuid": "a35c9638-5a36-495a-900f-baefd9aa7d60", "comment": "Malware payload (GuLoader)", "value": "0b97047b1dc39760402c9daa82a25cbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146679, "uuid": "ff939037-82e8-498c-82be-a069248277ed", "comment": "Malware payload (GuLoader)", "value": "c912574d97fc69697687cc5f38f0d6ca750c58a11227f442fde822160240534c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146679, "uuid": "414e1ba8-7bde-4b57-8793-eeb6697709c9", "comment": "Malware payload (GuLoader)", "value": "dd86c222a932692b3d8406b1b192241edf9b4967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146679, "uuid": "b6ee0924-57d1-4bf8-8e77-6d4ae9c32cea", "comment": "Malware payload (GuLoader)", "value": "31e1367ff673848e071a01bda82ff66c381e0e64fda90d38bae942f27d812eb020944eaa34bfe08588241411c3b6f274", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146679, "uuid": "19205801-0da4-47a2-9698-f4fad457258e", "value": "T1CFF4BFA2F501814FDE24183FF576366C2AA56FED888A76D12341B7D71C72A52C38F60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146679, "uuid": "a95a3dc0-3d82-45e3-8fa6-aa5e05c1e0b6", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146679, "uuid": "bbca0372-05d6-4463-b75d-f8d8e7ae04be", "value": "12288:dgQ44tKFhN2ASu/YORz3Offtrnzjpp7nMJ6r7AfA2T:d0CKau/YOR7Qftrnpp7nMgQfAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686146679, "uuid": "7d7e667f-730b-4f0f-9c2e-9c05f1147ac8", "value": 778321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686146679, "uuid": "fddd0503-45b1-4f7e-8860-a395bd861f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146679, "uuid": "40be0279-3e3a-4046-b6ad-d073effdd2ea", "value": "E-dekont_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e74683-04d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686101164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101164, "uuid": "28de06ea-755f-4f0f-b6f2-6771059ff17a", "comment": "Malware payload (RedLineStealer)", "value": "d1f11a5e7cca2f9255cddd7795c691f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101164, "uuid": "d3cc9ed0-18d4-480f-921a-0f35dff42fa8", "comment": "Malware payload (RedLineStealer)", "value": "ca2a2a54f3a0789f278d3c69983aa9a82a9470f46fc2db474bd3300ee08eee24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101164, "uuid": "6db544a4-6620-4fbd-b609-4e49d0351749", "comment": "Malware payload (RedLineStealer)", "value": "8830827fa586fa048225e5f94694e3b2f385fcda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101164, "uuid": "c1b9ccdc-415c-41ad-84cc-5e8a35dc5bec", "comment": "Malware payload (RedLineStealer)", "value": "c1cff6882822157acaca44f7989eb1972de32775e0d2074f6461904a7218e6c20c8df5aab4f01c0166b0f2fcdaa4ea78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101164, "uuid": "02ceac7c-9966-4bc1-8c92-65c9d33d7a4b", "value": "T12EF41287B7E88476ECF127B088F303830E347DA19D75536B26A6A96B0C325D4B47176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101164, "uuid": "22fc1a05-abb6-4a66-89cc-9bf87fbfd99d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101164, "uuid": "bd6d9631-c96b-47ea-a5f6-8bf3ad307511", "value": "12288:wMrOy906/kjCMAFybyAVlGp3pBjgKnE8Lo8RH+jl5uvCf+cdu6+rkhgSD4:uyPkjy+lO3ovYooHWXuvnCu6gy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686101164, "uuid": "56ce9543-78e0-4ff1-a831-694ee500b53c", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686101164, "uuid": "f5088cb2-6345-49cb-a0e0-0dd12e0a48e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101164, "uuid": "1730d303-509e-4f58-b9ce-653b68e2d976", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c042f2-052f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686141182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141182, "uuid": "e642ccb9-1adc-4b43-b98e-e44bb2e37b49", "comment": "Malware payload (AgentTesla)", "value": "dbf04ee1e6e2558f123a342ebc88573b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141182, "uuid": "275817d0-780c-4470-8833-af4e670b8bfc", "comment": "Malware payload (AgentTesla)", "value": "ca85116a906c89b87336c43bbc9efe21b5428997fac2ba12031eb093e69e573c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141182, "uuid": "d974e4da-e400-47b5-b4c0-f756d0719624", "comment": "Malware payload (AgentTesla)", "value": "46482e19b2fb361660ce926bf5378430443956a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686141182, "uuid": "2b15d9cd-77e5-4199-8d85-e75ecac9bb69", "comment": "Malware payload (AgentTesla)", "value": "5e1b61e4f6b019b18fc94f58f7ce4ab2ed150049f69487a1f7ab19f5eb6d55685cf43273e3724697c553ae18cb010f09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141182, "uuid": "2bf823a0-70af-4777-bfd9-7f7afa1ebb6f", "value": "T199E423866EDD0909CB820D3D781233C712E01C5A0A4636EF1EBA7529196CF9BDFF5672", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141182, "uuid": "a743955e-3acd-4084-affb-47f7b39b07c8", "value": "12288:03zOXO2ijIRhWT0CqwVfcr7VBLJ/da5TZo5pa11eD4m0eXIAxNrtek4McW0UdgyD:03SXO1UR00cVfcr7Ro8o1aIADwrMsKLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686141182, "uuid": "5bb530bc-b53b-415f-a454-0a42036b1c1b", "value": 721271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686141182, "uuid": "6caa11e9-e9e8-4e3c-a44e-9ded4d64a0ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686141182, "uuid": "3fd10410-f247-4cb4-b476-d107d883d177", "value": "PAYMENT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0292c41-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128375, "uuid": "0145edbc-995b-4738-b98f-8d1a2834772b", "comment": "Malware payload (Mirai)", "value": "9b874090047103b0d87fbdcdee28332f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128375, "uuid": "329a9579-a087-4303-a9e4-258d23abe533", "comment": "Malware payload (Mirai)", "value": "cb56d30869585ae0951c322a5fc6b747dede60e49e647744ed5eff66e87f3379", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128375, "uuid": "f16178a5-ce51-4c47-9bcf-2870a266c1bb", "comment": "Malware payload (Mirai)", "value": "0006d37491e551fbea70b491f0a7fa0d49c2a021", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128375, "uuid": "a766c670-098c-4893-a269-f1ef3618ecef", "comment": "Malware payload (Mirai)", "value": "723d360acaf197b1cb7673460f8a2a5df32775deae7af7d022ced1b7af4689f7aec01e3f05378ef0b7833c11b5d3a153", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128375, "uuid": "48605aa5-da2b-4d83-93b0-a51d546f2c7e", "value": "T113A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128375, "uuid": "75e18bf3-b2b0-46f6-84f5-84073afca0ad", "value": "3072:wW8FUmgujld6Mkxm6AJ+4feHmmFVcqq0GnDZT:wJFv4Lm6AJ+4feHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128375, "uuid": "d10ea64a-bcc9-44a8-a824-01c9e347476f", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128375, "uuid": "595e22c9-8042-47f9-991b-4635dc17a7d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128375, "uuid": "8d8af168-3de6-4484-bd8b-10f8a3bd57fd", "value": "9b874090047103b0d87fbdcdee28332f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b48f71-0524-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686136513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136513, "uuid": "4bb3ed39-72d3-4fb6-a23d-f73ff00128c2", "comment": "Malware payload (AgentTesla)", "value": "38e97d9b99c27ac6af84073f07c16d98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136513, "uuid": "03ea5c94-09db-4e6f-ac2b-bfc42eb2aa28", "comment": "Malware payload (AgentTesla)", "value": "cd8bc55c70d85611ef59efe45a5676da4e0b82f067cf188035fe9c28be2c591f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136513, "uuid": "66195c94-74c0-4889-b509-12f682cde7af", "comment": "Malware payload (AgentTesla)", "value": "ce0ead7c672ebee23282c23d76cda8210d483350", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686136513, "uuid": "fc0e309e-f6eb-47d0-9f14-a8dac18673e4", "comment": "Malware payload (AgentTesla)", "value": "c416a6a290956f7cf7da25a7e26486438a85f6a7297de8e059d4aade0f2be7f42b863b47b044000670fffdcbb464113c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136513, "uuid": "e4ef44e0-3fe5-4e11-a731-ae219cd8bd5e", "value": "T1AFF4025933E3108FCDAE7FBD1A560A79C5F8A9163916C3879ED3709DEC58F488A01253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136513, "uuid": "d25ef8bc-1ca7-4d85-8b2f-873df3265b4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136513, "uuid": "8f946f12-7b40-40e3-85b3-e831f5af238b", "value": "12288:id6L7PVnfhiCbhaDnLMzIL2q+RTdOL8ozHTAitZY+4n5nWKCbeh9B15z4Jd1G4:XOyqGUL8YY+Z8zrz4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686136513, "uuid": "2f3c3620-095d-4d7c-a5f2-19b83aa2dffb", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686136513, "uuid": "8a969354-51b1-4010-96d6-8e08cf75fed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686136513, "uuid": "c7bfbef7-cbde-4f10-987f-9aca0a5465d4", "value": "New-enquiry #67203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff2a884-0562-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686163244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163244, "uuid": "d8913242-e8d1-43e0-83b1-f9f814069dde", "comment": "Malware payload (RedLineStealer)", "value": "f3921df29805a4d961518ec18f90cd15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163244, "uuid": "4eb745f5-8180-4413-a3b2-df2d2647154b", "comment": "Malware payload (RedLineStealer)", "value": "cfd547c1738fadb3ce9a7bc60f27ba552774573093b2009e899f6b8a6424b3f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163244, "uuid": "a71f35d8-d445-41cc-ab16-64e26e2a9499", "comment": "Malware payload (RedLineStealer)", "value": "14bd04ae6df018c67363b3e31bc2d8ef8a7f90be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163244, "uuid": "00cb24c9-ab35-40ed-a174-2d1ae9110ecc", "comment": "Malware payload (RedLineStealer)", "value": "e7f77d44738fea7fa786e8825e910da95d48788ca5e3cd29b7f4850b8e66df80a4fdc4e08094c7605d4f041a0e4fd1b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163244, "uuid": "34017de9-da11-4d5b-84e2-36a2292bc185", "value": "T194C41253ABE89173E4B417304CFA02471BB6BCE69DB8832B3755F8294DB2241A871767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163244, "uuid": "bb344727-33aa-47ba-a0c4-efbde7daee2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163244, "uuid": "19aa8ee6-7072-484a-9fd3-4df109064152", "value": "12288:iMrxy90O/yTIencHQVNxPknA2IbBuf83lEfmmBYh:/yRKzp8n5IBu01EfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163244, "uuid": "0fdd4381-4b56-469c-9730-979889ee12a2", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163244, "uuid": "32e1b97e-2a03-4d36-b3a9-3af4f34e96ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163244, "uuid": "0f89877a-f7da-4968-bde7-c3079495619a", "value": "f3921df29805a4d961518ec18f90cd15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f9aca4-053d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686147335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686147335, "uuid": "8ef8e6b6-0708-4cbb-a7b8-3fe83dfa99b0", "comment": "Malware payload (RedLineStealer)", "value": "e300abed549737fcd1fbea159d48cbbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686147335, "uuid": "69efa91e-cf7d-452e-b406-02f838bb3486", "comment": "Malware payload (RedLineStealer)", "value": "d015fa18b6e473eee8889901dbd5b159143d20c0a8bd75586d6adaf07cd2dab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686147335, "uuid": "7dba042c-b195-4376-8485-4fcca70395cb", "comment": "Malware payload (RedLineStealer)", "value": "de5d99f757efe269c815c30c8c3ef888fdb521ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686147335, "uuid": "bb6ef946-9725-43a6-af87-4e1e36ef3025", "comment": "Malware payload (RedLineStealer)", "value": "17fb8ad2b2a821867ccae30e2d26b8e0f732022c30433306aa79fb0bc8edee6237dde109b842b84cc5bd4e46d8c88989", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686147335, "uuid": "8083b503-f5e1-4499-9bac-c951c25bce21", "value": "T12B446B09E4EF42D2FE463175216D905AF5BF80F323BFC02ECF5A3AD61C572A096A115A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686147335, "uuid": "8baef48f-1ef8-4777-b7e3-57ef93e8193a", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686147335, "uuid": "a67bec04-81a7-4ebd-ba5e-2fb5625e449a", "value": "3072:Ox/qx1OuyRyXFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2SUHcj/:a/qx1aEFaQ7W05AEezbMPZFzAy2Sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686147335, "uuid": "5efc77c4-4aad-45ab-9948-fdb10cd31e23", "value": 269156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686147335, "uuid": "bb460dd8-b1e0-4554-adbd-2726b354a35f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686147335, "uuid": "3b2304d3-bcfc-45ef-9c09-e0dc9bed9a49", "value": "e300abed549737fcd1fbea159d48cbbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc6ba3a-0562-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686163241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163241, "uuid": "791c8b2a-ccd2-4578-bde8-686718f320c5", "comment": "Malware payload (Amadey)", "value": "1c5576d97a1199392aaccbbc01b03bbd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163241, "uuid": "d497a247-5d02-43eb-a2f0-9ba12f50aa16", "comment": "Malware payload (Amadey)", "value": "d03161003bf1cb65324c3d57ae3d96ecdfbe844e12d237b9cdb2a00f67c714ea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163241, "uuid": "d2750bdf-d92a-418b-8dfb-872f03ce90a2", "comment": "Malware payload (Amadey)", "value": "03676dba11f92439438538b3632413549cc1c6d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163241, "uuid": "bfbbb5dd-9df8-4fe0-adad-bc17388afd19", "comment": "Malware payload (Amadey)", "value": "e15c899e19c2cabf20d875fe3634fc48eadb1636b0b2eaa6b14573a3a0f01e965e3ce1d4a5399f2d3c99071a5c0c9a45", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163241, "uuid": "f96e2751-80c0-4f32-a228-1231ae9e6cf0", "value": "T187052203BAED60B6D9B427704DF617930B3BBCB05DB4425A6B85984F1EB36C0A935327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163241, "uuid": "5e9ea235-8316-487c-ba63-cd125bbc0e0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163241, "uuid": "bd9ba36f-ff80-4f47-bdd9-8c5646293318", "value": "24576:LyQQj5DOia9sMzq5DdhVOWJYPicakzF6ZNOk:+50ia9sM25LVOWZca8F6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163241, "uuid": "70404f95-c200-4fdf-996e-533ded15aeda", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163241, "uuid": "0fca8e31-4555-4e97-bcb3-91844545df0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163241, "uuid": "746caff3-d4f0-4c11-b916-89fbb959e530", "value": "1c5576d97a1199392aaccbbc01b03bbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d01309-052d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686140248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140248, "uuid": "36e18845-3637-4d6f-9064-44a6a942f7bf", "comment": "Malware payload (SnakeKeylogger)", "value": "38c2a9d5567755dea34e0221599135ec", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140248, "uuid": "db869a47-e89f-4b8f-8a26-5137798f8a78", "comment": "Malware payload (SnakeKeylogger)", "value": "d189b6f2cb0ed79c79e57951edb069ce77501f357e8078470752f82789ccc9cc", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140248, "uuid": "6d31f57b-c231-4b1d-bb66-7524f3ea537f", "comment": "Malware payload (SnakeKeylogger)", "value": "c3bea2c8c5ebcfedbfd115bbdd1a079b232722b7", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140248, "uuid": "d91ad242-e265-4f4b-84a5-8549c4554e59", "comment": "Malware payload (SnakeKeylogger)", "value": "cc17fa7fbc652ebab1b37c94350eaf27a9c9b2d2b6ddff0dc8e239b7f90d1ae2c2101379dfa2ce436fb6d227af6edf51", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140248, "uuid": "61b5f843-33e0-4de7-8512-18f80f15a80d", "value": "T14B2533448E270276D8473AA26C141DCAF374732D2DC149DCC6F77DAF27CC7282A6A19A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140248, "uuid": "5642d48c-a68f-4a2d-a43a-bd6fc4978a4c", "value": "24576:45kNqR0u5fzZf1YrM/lBrZqeOvBQWovGIBFrgxs5r:BNzuhN1YI/l1ZqeOvto8xsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140248, "uuid": "ccee2c90-cf16-41af-baa0-6da4df11c2dc", "value": 1008486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140248, "uuid": "fde273bd-2b70-4183-9836-3f6a4992237a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140248, "uuid": "f5fb6147-172c-4c2e-9e8f-8dc2ffe29f2e", "value": "Quotation.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599ca82e-052c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686139853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139853, "uuid": "4a1a9c9e-f9eb-4c26-887e-d0bcf412afd1", "comment": "Malware payload (AgentTesla)", "value": "e6f5fb5770e2568d802460db156243bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139853, "uuid": "dfa04fa9-bf9b-4674-8d69-c5494fc83369", "comment": "Malware payload (AgentTesla)", "value": "d251105b8f759575df13e99a0200f71bf422f7ba87a67c385f7a1d11d25d1814", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139853, "uuid": "f6a3d20f-882d-4ab4-8086-ea67e341a7e8", "comment": "Malware payload (AgentTesla)", "value": "7b5ae66a32ec80f3974fb0eb2b4e55540ffeaaee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139853, "uuid": "d83cc2a4-28bf-4cc6-954e-2e2992b6d6ec", "comment": "Malware payload (AgentTesla)", "value": "fc8f6e97b3ca5025e12405bd917c6459cc0b18b71c1a56e5a23eecbc0bd79d9bc20ef15554e8078d302efe40336a8c5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139853, "uuid": "ea085182-bd9d-4fc7-a7ea-531b4963eb9e", "value": "T130D4E19A81B88B12CEAC09FD4D63C6C506F9C5B67C25E7711F8724BA8DD392F18441EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139853, "uuid": "362f28ec-a4c4-40e9-8161-06bc0e09f2d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139853, "uuid": "bf7a0568-a98f-418d-9396-539c39d2c3a1", "value": "12288:8awwhh2Y4YVhZz0yM+7jwx7xN1JDzU5qyaYxTaRPn9u7GQ4Yz:6whh2uhOA4NLnMhaV9u7MY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139853, "uuid": "4d7e5c43-a7e0-4a76-aab3-7727dd5338e1", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139853, "uuid": "61757450-0990-4c0b-a311-df11743ca427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139853, "uuid": "bd59bce2-bdfe-48ca-8c32-6a6a0c4d542d", "value": "d251105b8f759575df13e99a0200f71bf422f7ba87a67c385f7a1d11d25d1814", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8483401-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128415, "uuid": "6ca316f7-9ecd-4037-8911-2c4cb0801644", "comment": "Malware payload (Mirai)", "value": "bfc6a53edc933bdaa33c154f96f3cdec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128415, "uuid": "cc9f75e1-c84f-4d12-af92-01727d17bcb3", "comment": "Malware payload (Mirai)", "value": "d3a583b573391fc17d3b9cd774da6e0dfb928ba886c52cff77eaf17cc4d8d600", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128415, "uuid": "17fccafa-7b9b-454f-94ab-dad4ad6a2d1c", "comment": "Malware payload (Mirai)", "value": "2aeb3832a5d50ef1eae7e22fb0b26cb31d1a024d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128415, "uuid": "bc5cdeb3-0110-437b-aa80-ea5db7fd9ca4", "comment": "Malware payload (Mirai)", "value": "9fbb1fc8a826f9bf60475b87702ba7fa1edc5f1d3eae49ac6641e8e111890cfda0f09f96f012683a2c30dc78265143e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128415, "uuid": "118bb6e4-0073-4725-a7be-c48fd5060036", "value": "T124732946B8818B11D9C4127AFA2E118E331327ACE3DE73129D155F2477CBD6B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128415, "uuid": "b7dbd003-8cce-41fc-aad7-8fc4b1672337", "value": "1536:kinULNaPWrl1BdCNyAxhD66sbE2X9farwdnuMXiS34G/Xg8Lc5dYh:OoU1mABa834G/Xg8LcLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128415, "uuid": "c0ccd44b-feb2-4c9f-a032-0595a4ef09ac", "value": 79480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128415, "uuid": "da906600-c232-44d0-9c84-35169e080a5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128415, "uuid": "0a438e4b-1ced-4e30-a586-635481a05f1d", "value": "bfc6a53edc933bdaa33c154f96f3cdec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb86b300-0562-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686163237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163237, "uuid": "498c615e-eb8b-4657-8b2a-75532e0e8570", "comment": "Malware payload (RedLineStealer)", "value": "df915e4648c148cc98b7e8051b182891", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163237, "uuid": "9811cf4a-7697-48e3-a8ba-a9f8f22ddda3", "comment": "Malware payload (RedLineStealer)", "value": "d4727dba9a619e5039e2f3af4625f32335c28b309881359e6fe61af9c1240809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163237, "uuid": "64847347-db77-4864-ba30-6ddbd1869166", "comment": "Malware payload (RedLineStealer)", "value": "f911be570c3b21cadf97c1b580bceebefa2d5e87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163237, "uuid": "1568f837-e7fe-483f-b1a6-34a9fe1477a4", "comment": "Malware payload (RedLineStealer)", "value": "f5ed5447208cd1f68a551e226c157cfb6bbe56ae257eb43178350a4e2ab21188a2ebb5792b0b18db3955e44ce43ae00b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163237, "uuid": "c00d987f-34a5-4c26-bb95-ea6c60cdd770", "value": "T1DDF4120AB5EC45B6D5B927301DF303870F3A7CA55879874B3741A92B4DB3280BA7276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163237, "uuid": "b15947ce-fa33-4058-b6ba-bcf108f10500", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163237, "uuid": "5bb235ca-8b8d-4f08-b5d9-140b0da2306d", "value": "12288:pMrLy90JsYGE+HLlvmyv7gNSRPcW5eXXaamwG9Ev/bgKVMgZ4p7BNoU:SyEsvE+HhOu7TpcBaaTGqHbgKVMgOp7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163237, "uuid": "e4183ca5-fceb-40ae-947b-a0d0b2c95037", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163237, "uuid": "914b10c0-da00-4fa7-a2a9-57bc9d715e0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163237, "uuid": "ca67aaf4-7375-4e74-bfd9-4dd6c035588c", "value": "df915e4648c148cc98b7e8051b182891.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c7e922-0556-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686157755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157755, "uuid": "c599148c-2ffb-482c-ad56-288017448151", "comment": "Malware payload (Formbook)", "value": "89b540b1e92af275aacc4358c90a5321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157755, "uuid": "eb11a0c5-c7d1-465f-9305-d7c6f84d20cc", "comment": "Malware payload (Formbook)", "value": "d544b431bfca13bdfca0efe987946061cf7479edc6b826b5954ce015856296c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157755, "uuid": "0cdda0ec-4ac2-4469-ad13-ea21e173bc6c", "comment": "Malware payload (Formbook)", "value": "bdae0959a141897170ad28d3a5b8f66a61a38671", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686157755, "uuid": "521bf5b5-40b9-4b11-8f71-3bd21581e7b2", "comment": "Malware payload (Formbook)", "value": "af2d3dceb712d3469efdf04ee0c7d452151177035561881d91571a47b777cd7b91a11155ce5e9fb802bb7fb7f4ddad25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157755, "uuid": "443e8fa0-5590-46f2-a683-7cdcd728ffa9", "value": "T1DAB4F16835A8820CE17DB978D8E5822347E574A23676F30FBA05A47F1C71BE38D16F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157755, "uuid": "44d23bf5-a87c-48d0-b57a-8a9289c59136", "value": "12288:ymPsyDo8g57nR8+/VPHTUOtmsG3QA99JiUBQS5O+w2q1ACirGzCnDPdvEH:jng5ru+xVmdrZQS5O+w2q1ACirGzCnDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686157755, "uuid": "a0ec8345-5e5f-4169-8d31-4e1e0012a6d8", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686157755, "uuid": "cfb3cb23-e1f1-46e9-a5fa-ac5dafa027fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686157755, "uuid": "94eba0d9-ec44-49af-b641-cd85871a7541", "value": "d544b431bfca13bdfca0efe987946061cf7479edc6b826b5954ce015856296c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9565696-0533-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686143127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143127, "uuid": "0a3e3533-e0b9-4c86-8a99-16599efda069", "comment": "Malware payload (RedLineStealer)", "value": "068ab81c3febee870bcfc3228c4c1969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143127, "uuid": "715753ce-b280-4187-9902-fd8ef94e8cc4", "comment": "Malware payload (RedLineStealer)", "value": "d576dd6fa10cbf78cceb4680fc96038e6b7ca19bb0145767cdbd70bae2b844a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143127, "uuid": "a3a7c281-36d3-4698-ad83-da0fcd3dd087", "comment": "Malware payload (RedLineStealer)", "value": "36ccab03457d2dbf6acf495d26fe24c16c103ee2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143127, "uuid": "0f66eee6-f986-4f51-a81e-32802a83250f", "comment": "Malware payload (RedLineStealer)", "value": "748e9a9b3de206c38334c4a76385af4364992f58da80af560acecdba4531cf77705287aaab495efdbb8aeb77d60d3eb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143127, "uuid": "d2d5fa99-bccc-441e-81fc-1ff2c6d71e3d", "value": "T1C3F412016ED9C133DCA1237188F607D70B3ABC51B9B8936B7746E89E05B3590B63672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143127, "uuid": "66806214-ca70-4281-a8e1-508244e4b26e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143127, "uuid": "48de7b36-58cc-40ee-b62f-7eb84fa96d5d", "value": "12288:9Mrdy903V2Sm0aEW6TmtozwqV6KNgjnWGRmrf60B1Wb2ydTNf8kbI1H5IR:wy42qaZozzNEnW0uya1WCyPf8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686143127, "uuid": "32c9230f-e216-4647-a1d3-9940fcb623d4", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686143127, "uuid": "52007346-e572-492d-a21e-559deb7e0674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143127, "uuid": "5112b1d2-6fe1-45ee-bbed-c4bb17891d1d", "value": "068ab81c3febee870bcfc3228c4c1969.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11c73c5-052a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686139141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139141, "uuid": "600bc54e-1b4c-4035-b133-4f02978f1d56", "comment": "Malware payload (AveMariaRAT)", "value": "7977d30d69609641b7d0989c01b821fd", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139141, "uuid": "5450ad9a-b25f-449e-aba8-9181d7a770c6", "comment": "Malware payload (AveMariaRAT)", "value": "d5c7829ecf6c9d3a91ea7ab65b3925a7fa79a2a55a03c6d993ac98ed8ed6b6a3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139141, "uuid": "b2c4a38b-3b06-41fb-87a8-bca5168b041c", "comment": "Malware payload (AveMariaRAT)", "value": "7051ad0be44509e4ccd0795f9bc237d6cd50e00a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139141, "uuid": "6e9a309f-2eb1-4993-949a-ca08988107fc", "comment": "Malware payload (AveMariaRAT)", "value": "4410977cc73ade37811008a118c1ac1cab6bcbc7ad4ad4e6956ad71f8757befc18b8b3709ac8fc8be2532383d47d5628", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139141, "uuid": "4c50c3ad-1020-44fc-b4a9-bf3dcb35c56e", "value": "T13D05224A5E78DF63CC1F4530C1B684FD9B33AE48CF9507E311957CA93A3A59289C682B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139141, "uuid": "1d70dcba-6073-451a-889c-5df99ef9046a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139141, "uuid": "b5606c70-4e31-4ca6-8e01-873d802facd1", "value": "12288:Gpkli5Gv+aAuctbXFe+6fTz2kOQmdh9dpXOzsJND66nFcA9BSn1zARSgsp:Gb5Gv+go5e+iTRuT9TXOzWV6oe1+sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139141, "uuid": "3a4c7595-4651-46a1-8824-f4a9db4146e9", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139141, "uuid": "2f901a21-25e2-478a-8102-dd0b3570b469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139141, "uuid": "c945a3ce-ca5b-45d4-9281-9e41c333e171", "value": "d5c7829ecf6c9d3a91ea7ab65b3925a7fa79a2a55a03c6d993ac98ed8ed6b6a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1a72df-054e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686154487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686154487, "uuid": "f891fd13-a283-48d5-a90d-7d242d81c75c", "comment": "Malware payload (AgentTesla)", "value": "aafbb89d5d9f71fb0737a4bae1b0b05c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686154487, "uuid": "dbe97f79-c57a-4bdf-9824-02a8cf4a4d9a", "comment": "Malware payload (AgentTesla)", "value": "d682a1ef2502e7cf9e5b16a35469e615cec1eab8eb0385ed763f30346b311b7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686154487, "uuid": "cb63542e-9a63-45c5-83fa-b98e91e46e4a", "comment": "Malware payload (AgentTesla)", "value": "e9cf06b4eeb503c479ba9b56b344b79bd76ab958", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686154487, "uuid": "4ae1eb22-7323-488d-a3f4-4632581c295f", "comment": "Malware payload (AgentTesla)", "value": "57c008f99b5a5949341c4de0eba9b78cca8bbab7329bc5c911a39a589b9dd3f706c164a5dca888a6d144c1f47d8a332c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686154487, "uuid": "a2fd08c0-5917-455f-a1b8-a02260a2b4f8", "value": "T10E05D05437BB5F66C43ABBFA4440693447F86A5A383FD24B0ED2A4DBA951F100E80F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686154487, "uuid": "a9861df7-41e0-4f87-b310-6a8d98fb80b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686154487, "uuid": "26e1ee62-31ef-4294-aac1-4c82ef026d59", "value": "12288:SHrbhaDnLMzIL2q+RTdOL8l26iGfA59rKVB61cggAjFv7wXzObsTh4c0UJVJWm/R:SBOyqGUL8lxw9rKViYWNQyb6W4JHL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686154487, "uuid": "a6075fc9-372b-49e2-8810-d0f48efa9007", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686154487, "uuid": "927bb7e4-9c97-4f60-bbe1-5a1b22637d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686154487, "uuid": "11469cc3-4a04-4d1a-9dd9-db1a02305ecc", "value": "OriginalCopy2023001982_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f502570-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686130038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130038, "uuid": "609478bc-39e5-49c6-b032-f62b1a0f41dd", "comment": "Malware payload (Formbook)", "value": "cdf9376a5a9c71a805e57949d2baf367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130038, "uuid": "beecaa90-8714-4875-bc48-f3ad1e6d2522", "comment": "Malware payload (Formbook)", "value": "d6898c482bc4fe5f113713ef217dd26b9c537906272347f69d85b5029f7cc401", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130038, "uuid": "73eead27-9c68-48e4-8687-820fc00f0c02", "comment": "Malware payload (Formbook)", "value": "8a9681f6fbd36ab461f10d263cf35dc9b531e491", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130038, "uuid": "141bd546-cd51-444c-bb7c-bcb90108a84e", "comment": "Malware payload (Formbook)", "value": "20f8aff559a4b65023ecf203ef5af06f82ac4b4a3e30f4aed976c2821bda77319247b2e0ad3d82f892628332b11f5f45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130038, "uuid": "8440705b-7a11-4cf5-bbdc-a5616ff8d462", "value": "T171F42394B72BC02FC29B2FB40C44A77661FC82C6FEB2D3171E4BA6A9DB17D25004575A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130038, "uuid": "609bec89-a61a-480f-970a-5b8d09ac66e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130038, "uuid": "d51aa595-ebb2-4c5a-a7fd-69ec609b66ec", "value": "12288:4RP2B0xTGlxNqvNu2hZ+nUEsn9yCzf6dlh4PZl/1qW6tEcdsRzdg1belSmrJR:MPLaVUH999yKfTPZl/1qpNsxK1it", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130038, "uuid": "68415c97-e8b4-4466-b2f1-db0174eebda7", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130038, "uuid": "006dc161-f7fc-4a7b-ad1d-7aa83adf75de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130038, "uuid": "897e5797-cecc-433d-8635-95caaa325440", "value": "Bank confirmation-slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e222bc36-0537-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686144807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144807, "uuid": "190b857a-0bf8-475c-9503-32581a615a5f", "comment": "Malware payload (AgentTesla)", "value": "44d49b28a48549a5813a75341aa9e1ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144807, "uuid": "8e342213-82e6-4a82-8cc2-22e21e7b1261", "comment": "Malware payload (AgentTesla)", "value": "d71a363cb7eb4a5d43ace6dced0ee05e1132b0bb9d62fa097d9e7ee516b40ac7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144807, "uuid": "369daafc-80e1-4f6c-81d1-b61c2ed59fb2", "comment": "Malware payload (AgentTesla)", "value": "de8ec5379831f99d836693b8d5b313a678e3d324", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144807, "uuid": "4cb1edff-6491-4d46-ae36-aa18dcb3355b", "comment": "Malware payload (AgentTesla)", "value": "d7c43b24da75b75c20932325ba619519c1ff60ca12660b2329575c6a9bcb5c03167a708f4bba948e718ccbfaf01c027e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144807, "uuid": "4b437c95-1ca9-4754-b450-7d78ea66efdc", "value": "T18BE4338AE49B58DA66B54E1FFB3476B8A1F2D31E82C7374105CB0E9FB32D0A54049397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144807, "uuid": "4a73052f-48bc-4437-9ee1-dc65cab7b397", "value": "12288:0mpdyhly3VIYHCNpp4NLUXS529skM2BqXloWv/7OgGSrU19IcFmZZ6Nimn9S:lp8lyNiNpCGXS5E8XlN/6gbCIDZiiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686144807, "uuid": "ed6c6a66-19bc-4912-ad75-2815884d6913", "value": 721211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686144807, "uuid": "f9045778-1bf9-4d03-85e8-b5f3946b8154", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144807, "uuid": "814657c9-0912-427b-a672-32f7188cd91a", "value": "TT Swift Copy $90,000.00.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83323f23-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686130044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130044, "uuid": "3a1318ac-3849-406b-8a68-712bcefd6288", "comment": "Malware payload (AgentTesla)", "value": "69358b89075d783f87379580f52c9f8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130044, "uuid": "ad7aa35d-9597-42f1-996d-35eb3a1ed83c", "comment": "Malware payload (AgentTesla)", "value": "d787f2f6abe3ddcc308692f1e8b5cb2903d22bdb00348b195edd3e934eac6b3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130044, "uuid": "c4d9f0ec-d517-46f4-b2b2-6ab5bc3d4a22", "comment": "Malware payload (AgentTesla)", "value": "56a565ff78629440459f45688c630878cd80df8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130044, "uuid": "9ab0d98d-d089-420e-a836-b5f6e2001acc", "comment": "Malware payload (AgentTesla)", "value": "ec7c2e28174321123c5ea6ac6072d91cbc95929d4e1f671d864864bd2e4fc3d36e8bbad9afb7f8e360177d3c4d8e8ad3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130044, "uuid": "89f77015-4f22-43e3-8316-62d0bbfe65eb", "value": "T11364018C7B945729D4B19BF408B1AA2203BB7E3A6462FA4DCD8F70F468737610211F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130044, "uuid": "11f37198-c6ec-4125-b80a-9f0ec1b80be5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130044, "uuid": "b8a20810-7aa1-4229-8e12-b1eab7d7eb16", "value": "6144:6h3VXxtKruju+JJJL8DrGb4LZ8qzTqOBHGwJKOJVXkWD9:6XxtwSxJv8DfZ8qzTNBmwIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130044, "uuid": "6fc6d09b-c8aa-4d3d-abd7-315e43e60e42", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130044, "uuid": "7e2a24ac-35c9-4646-9cfb-7b1184015253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130044, "uuid": "954e2dc1-cf38-43bd-8888-e89af97a723b", "value": "IMG_751_8652pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a988be-0557-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686158399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158399, "uuid": "790e3bb9-5b43-4ebd-8850-5ef066c9582f", "comment": "Malware payload (Amadey)", "value": "a5ed103ec4719a27ab3d3c01dac66f01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158399, "uuid": "71bee8f1-7f3e-405b-b573-57e08c5cf042", "comment": "Malware payload (Amadey)", "value": "dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158399, "uuid": "a6e574d1-1996-4f32-b31a-c2f8335bbca0", "comment": "Malware payload (Amadey)", "value": "c830d6980d7edea60568a518eccd36c0bc2a4924", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686158399, "uuid": "54ad30f8-66fe-4517-82cc-6aadbd371d5b", "comment": "Malware payload (Amadey)", "value": "4a1f2ee091954054cd1c5ff7e7bf74240142f38cf780e974d96b30f34956e9eb6e3fcd43fbda1c3b6e77cb56c58d2d14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158399, "uuid": "622854a3-c383-4673-848c-067c8dfc5b35", "value": "T12B936B1030D2C471D57E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE32E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158399, "uuid": "8545fcfd-2e6b-4bd6-9082-45a239b5be51", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158399, "uuid": "46d258a3-8871-4513-974d-e7c7cd8e2ce1", "value": "1536:Qo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUQHaB89p:QoUCWbBNpplToUs1uNhj25LJUSaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686158399, "uuid": "4b54cbd1-4c7e-42b3-93c2-d6d543bb72bd", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686158399, "uuid": "426abe89-5e29-4087-925b-24a63f35a97d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686158399, "uuid": "01f569dd-fe98-4ced-8b25-20c4486deac3", "value": "a5ed103ec4719a27ab3d3c01dac66f01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4895f5ce-0550-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686155286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686155286, "uuid": "67907193-f0ef-4975-8cd1-2a1ab5c897a8", "comment": "Malware payload (RedLineStealer)", "value": "ade03e110bc19e7bf8ae7c6009a3e14b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686155286, "uuid": "27f0a8ee-f95e-44a1-9743-09963a7c2ee5", "comment": "Malware payload (RedLineStealer)", "value": "dc822f1316afd8ad60f3d2c3eaa8f74786879873b157309ba8673fad0826f6e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686155286, "uuid": "5255bfc6-2738-41a7-b690-f81daaefa4e4", "comment": "Malware payload (RedLineStealer)", "value": "68da3d0f23ea41ffddcff3767db6f76751ae7b45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686155286, "uuid": "c76330c3-0715-4aec-8f9b-f199faeb9193", "comment": "Malware payload (RedLineStealer)", "value": "65b2c4a71a55ff3ad1b4d638ae548b8ae5691651217571329d85263660232fdfd71e082e6b015c01e89058a44a1374d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686155286, "uuid": "9da79c84-9e2e-40fd-b6d4-7fde5562875c", "value": "T1C2F4224266D890B3E9F5177034F206930631BCF69C3C8BAB23995C6E4AB33A4507677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686155286, "uuid": "37c21dd9-5992-4c64-a366-079a668bf2b1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686155286, "uuid": "713bff2b-49c2-4f39-a6f1-a88bc2d342b4", "value": "12288:dMrAy90QU/fdNplocfuvBorLCYh3prRXC5RvzOCcKlt:lyk/fd/loYuZWLCYvrRQRlci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686155286, "uuid": "af30d90e-8aea-4904-be1a-718f1d2fd93d", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686155286, "uuid": "ee08737e-a88a-4b97-b42a-cc4b5d451b9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686155286, "uuid": "52b7bb18-72eb-4e6f-b11d-4f99e64314fa", "value": "ade03e110bc19e7bf8ae7c6009a3e14b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c3e740-052d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686140310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140310, "uuid": "9560e08b-d760-48c1-8005-746d8bec1073", "comment": "Malware payload (AgentTesla)", "value": "7bcb765eb24e99c14ac625934e2a3283", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140310, "uuid": "8b00751e-2fb2-457f-b247-e2c4d0b884b6", "comment": "Malware payload (AgentTesla)", "value": "dcd2a1a571f36c2739e2c358225fb7bfa4c8ff7379755aedcc68e1cbd71bc076", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140310, "uuid": "9973677a-8e5b-4b06-bdc7-2e6530edac95", "comment": "Malware payload (AgentTesla)", "value": "9f880a683b12a76b3c813392c3dd6f21441a8fd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140310, "uuid": "c673c972-b8b9-48ce-8366-ba3c59577bb2", "comment": "Malware payload (AgentTesla)", "value": "567283498e8c3d542f58723b8a444cada669851fb667383f78a27fbb649f48346d77a2cc5bf7684af8749ba313803377", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140310, "uuid": "3bffc101-ff89-49d0-b839-1ca3c8e22587", "value": "T16805F10AB6BF1B17C036BBF8153092305BFCE915613BD28A9ED365DBA465F311A81723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140310, "uuid": "d36b0dc9-1a7e-4c9a-98b4-c3444642ee90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140310, "uuid": "cc581548-c56c-4c6e-b41b-d6571b59c494", "value": "12288:/x+OSUAh3NVa42iNa7xdvo/MdyrhFgtDsuBHsSj5J4+saBGENcq8wcwdQpcJvvi2:I1U9BqmycgiH75Bjcq8wJit6xfhJHqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140310, "uuid": "7360a117-f4c4-4dde-9369-33ea6a91d51f", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140310, "uuid": "5f9c4955-3f0e-406c-b572-ea5f3f85923f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140310, "uuid": "cc1f214b-a52d-47ba-ac4a-b9036eaa7ebf", "value": "Amended Order No. 60-230235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3168f348-0577-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686171998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686171998, "uuid": "570783cb-dc13-4b20-90fc-3d7c02cc274d", "comment": "Malware payload", "value": "2c66dc153c947bdc4dda7118f60e4540", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686171998, "uuid": "ae33d903-e63d-490d-9f83-54f691ef0016", "comment": "Malware payload", "value": "dd649575ad8c4888137f3325a6262d7634f97c07c9711fac49e2c73bd395202a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686171998, "uuid": "b6a8b232-e2a6-461c-8b42-f49570cfbf30", "comment": "Malware payload", "value": "a6c6250a54c16cebdd8ded3a3b8f7bd6d7db0464", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686171998, "uuid": "e979d796-ad7c-446a-a12c-6acd7cce762a", "comment": "Malware payload", "value": "260da511e9250d6b7b55d346c706c234a44273644123f9fc102cd26893072c57672af31a9869fb7afde89cabcf84ae36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686171998, "uuid": "9cd09f18-d9cf-49e0-9971-2cf59fabcb41", "value": "T1C355039905382BF2D2599C30B0DB9D0E5F27E3B20A74F735DB851769549CA8B1B0AC3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686171998, "uuid": "5a1746e4-93e4-4c2d-8c94-bf50a79eedde", "value": "b9083dd82a429a49d949568d3647ca0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686171998, "uuid": "597cd3a8-7171-41dc-81e6-c1d9e7d584bb", "value": "24576:ehloDX0XOf4lLZPs0AZCZWE7cRGo8sOgZQz00a3CI98Ye3BmQ/KV1PpAOvqADs6u:ehloJf6FFAZCZWE7cRGo8sOgZy00a3C3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686171998, "uuid": "94560e6c-062b-4d7f-b73d-ac1db2f24095", "value": 1381376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686171998, "uuid": "be3cfdd5-e991-4bd8-9cf1-bc3c60b587fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686171998, "uuid": "41290f3f-d6ad-49c5-992e-c109bd85249f", "value": "11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f90ed8f-052c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686139970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139970, "uuid": "a569a56b-9a28-4df0-932c-7256dc8a6d6b", "comment": "Malware payload (Formbook)", "value": "5782280eedee71aa7708b6c7efc80cf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139970, "uuid": "3e650df1-98bc-4c7d-b2b6-539cb82d1474", "comment": "Malware payload (Formbook)", "value": "ddcb2d701db3ee66e73e1583e248895e4d2fbf8b372f336d1cb585f1352612b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139970, "uuid": "6d021880-3386-4cb4-b4d1-bf152c0e990d", "comment": "Malware payload (Formbook)", "value": "ba67e0ffa53034acfbba4e2bddc2a32471626f87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686139970, "uuid": "3f9919c7-0f43-411b-8dde-e6cf42fe9c7c", "comment": "Malware payload (Formbook)", "value": "b863a63f7fbbbf824d78bd2d865b748f2eeb36040e69e63ab4f28272c63cc52057cb90094197c3b7f759f2df840ed9af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139970, "uuid": "7f6ef31b-2022-4e9d-971e-5dd74238e889", "value": "T16FE4DF1C6BBA6F51D17957F460048A0403B8638AB0E9F77BCDC273E799B1F414A52B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139970, "uuid": "22afc922-b187-495e-a92b-67411f8b680d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139970, "uuid": "83b07c08-5dd8-42c7-abfc-65b8b19d3a5d", "value": "12288:4M4l00FTDfsBQiFdrbeRWPW3yL2oOAM/6sZeqGKP2ey:4M6T9SrlOiioO36sXjP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686139970, "uuid": "6fb25692-98af-484e-9bb4-c4a239b5da27", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686139970, "uuid": "7c2a7735-9e3a-4d56-956b-299ce0e41e15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686139970, "uuid": "4d5fad7d-d164-40b8-9bf2-74038c4917af", "value": "ddcb2d701db3ee66e73e1583e248895e4d2fbf8b372f336d1cb585f1352612b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cc8e2c-0526-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PureCrypter)", "timestamp": 1686137543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137543, "uuid": "d9e3d60c-44c1-40ff-8877-7b495211a0e3", "comment": "Malware payload (PureCrypter)", "value": "a7d0d43336b53412fb1aa14e88b631de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137543, "uuid": "231d7f75-2597-4b30-9535-600eb3fb35dd", "comment": "Malware payload (PureCrypter)", "value": "dddd830cca81b2e8402c75a98bb50dee4dec771a49c6328ae9d5498e8bd86f3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137543, "uuid": "89f2d00a-2793-4742-97ca-1b959c877a05", "comment": "Malware payload (PureCrypter)", "value": "144b35acf48de653268f5fc7b91c556854787c0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137543, "uuid": "2de126c4-63ec-4d11-9318-54ee033eb4a5", "comment": "Malware payload (PureCrypter)", "value": "09a61e27135276dc715ac69ae0978c4e7823482d01bf01c042afff3d87b59a561224e9075bd8d3abb10bd898780ff508", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137543, "uuid": "58d2177d-7cbb-4555-866f-6dc4d56acdfc", "value": "T174620885E7A8891ADE6C6B3694D362250378EB01717BDB5B1DDC30AFBE213D618133E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137543, "uuid": "622a0649-c919-4f40-a933-fb71281abdac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137543, "uuid": "5b90d705-c9a9-4333-b20b-a01903bb94cd", "value": "384:90kNtTh1P5nulaaaaaD3HT/hh9o/2KPiasuhh4h//rKa:tVYlaaaaaDLyuksuhha//Wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686137543, "uuid": "29df2c86-f3a2-4578-ae12-95f0b04d491b", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686137543, "uuid": "80093323-c899-43f2-b91b-6bcda7f64097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137543, "uuid": "126f3afd-bdf3-4f08-b43d-980cc2185279", "value": "dddd830cca81b2e8402c75a98bb50dee4dec771a49c6328ae9d5498e8bd86f3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6403e81-0580-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686176194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176194, "uuid": "6ab3256f-fe37-4a97-9eed-dc665c74e793", "comment": "Malware payload", "value": "bceff01d4cb70cf52d7ee082b8afa50e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176194, "uuid": "35d63160-a894-412f-9029-6c9e0808036f", "comment": "Malware payload", "value": "deb798c3ec8fbe52f3b5b33358f5fa4f6f1a7266bc132d673ae114fd77095003", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176194, "uuid": "25035f95-b975-4cc2-a22d-056d5ff53043", "comment": "Malware payload", "value": "52fdbb304d9186f3e45499335be0944628b97dc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686176194, "uuid": "26a0c9fd-2a34-4735-b5d8-3a7709cf60d6", "comment": "Malware payload", "value": "564ee5ce6d178da20fff1b4914ad2471d3a75a5689fd45bfb4020a87f2daac1ca303163b701edf776515318a42807b88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686176194, "uuid": "58e8bdb5-9dfc-4c22-bbff-350f789e0627", "value": "T19A249D1270DD42A0F84E70FC7870A9B7F97265F16B7F00ABAF69521156A33E0AAF1507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686176194, "uuid": "c65de6b1-bd5e-4d92-9af1-4096d1c1ce5f", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686176194, "uuid": "630e8bb2-b8ec-4c6b-9055-8b89057f9d01", "value": "3072:SRDJye1MXe9dypG57bIWsGuhYR3ducp3XV8UK4UGvMetHRfcj/6:u1f1MNG1bIWsGN6cpV8M1DtHNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686176194, "uuid": "00c1ec37-060d-4e8c-bae7-b507c424da0a", "value": 222136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686176194, "uuid": "f90f746a-a182-4760-8a06-0444fc89b59e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686176194, "uuid": "065bac27-b3f5-47a8-9a96-0af2e6709174", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb204c9-0553-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686156796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156796, "uuid": "cafc6210-7de9-4ed8-9387-54a868a469c7", "comment": "Malware payload (AgentTesla)", "value": "b5fa299c71402381a46be6d78beeb28b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156796, "uuid": "c8a6141b-6cba-46b2-a1b4-4206e76a8daa", "comment": "Malware payload (AgentTesla)", "value": "df9a7e3650b8ab89432a7ac8e79be3793ec91b7021c8e505cd6bd2da81596174", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156796, "uuid": "366adf95-40dc-4924-a288-b25d01b7f000", "comment": "Malware payload (AgentTesla)", "value": "934b7eb6ee2e4e67ff22f4523bfe6a2a47b6a5f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156796, "uuid": "27f180e0-43a9-4aa9-a8dc-456a5d255f2f", "comment": "Malware payload (AgentTesla)", "value": "8678999a4904036c2b5ce12b25b474932568aa39585603739de3e5cb1c308d18a78703605869dc4db8c5c1fe436bfcdd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156796, "uuid": "e9da1cdb-3fee-47b9-a517-28c5da22aaeb", "value": "T1E2C48DD1A3E84685F8FA1FF55435892003B27DAEA878E61D18E538DF3AB33821451F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156796, "uuid": "a6cfc7b0-c7dc-475c-b101-a9a146b467f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156796, "uuid": "bb36d85b-4152-4e84-afde-3ca7d5a5c5df", "value": "6144:+CvZQF89OVamhgTWMQ+n1ru1S8U+EcOYE0ZOu2qHS+guQzCbzVB8PQqZzHbHI5Ct:+CuFjGT/Q+n01SD+EJngnq+ezCn2b4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686156796, "uuid": "29ad70a6-4fce-4a19-961c-ca490204df95", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686156796, "uuid": "2c4222c7-e46c-467b-b75b-50d409382ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156796, "uuid": "7ad142aa-2f75-4eb8-9fe6-815af24213ee", "value": "df9a7e3650b8ab89432a7ac8e79be3793ec91b7021c8e505cd6bd2da81596174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4c5685-052a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686138999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138999, "uuid": "94e4a6ca-66bb-4445-ab6d-6ed4d6d6b3bf", "comment": "Malware payload (Formbook)", "value": "e36d67509593044d6e38202f5f24dfc7", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138999, "uuid": "6763b213-9f49-4b37-8227-40d54581bd7d", "comment": "Malware payload (Formbook)", "value": "df9f0960186bc1f5bf05066a5c5c62b7ab114bb6c9a858c3d6cc12696c3909da", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138999, "uuid": "766f6ff0-4257-41e6-a57b-3193f8b6a665", "comment": "Malware payload (Formbook)", "value": "0b45583d487f8888a444ba4924ff36215c0348a2", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138999, "uuid": "119826c9-af3d-476a-a197-02c0b7ea7921", "comment": "Malware payload (Formbook)", "value": "07f9bb98eec475d24d6a0e863533152ce60925cd3b55b9be5ab80c4f745b55993f4e803795b55ea2406664a4805387dc", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138999, "uuid": "5c2254f7-bcf9-4504-8d4f-bf5aae10f7fc", "value": "T14CB423BB8385DFD08C9D488505EAEDC976703FF2445EC2BC29BD11543228236BBB6E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138999, "uuid": "8a02e19a-ff0d-4bc0-bcd1-639a86d5467e", "value": "12288:Q3pTOBTtNxSkZYCrBsvZKQM9cQPN0Zo5Tb/LPJsFZPycswVUKHx:mxQZpZNKIVN0ZUTb/L6FZySUKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686138999, "uuid": "b5e1a862-d2c1-4a11-a2cc-ab144efe6241", "value": 529056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686138999, "uuid": "536768bf-0d21-4dbc-9385-40bd89e25410", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138999, "uuid": "c716e533-38a3-4301-9280-3a0095c7d070", "value": "Revised BL.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118f6ac4-04d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686100648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100648, "uuid": "d453cd23-1e2b-4e41-9750-16ec4ba27632", "comment": "Malware payload (CoinMiner)", "value": "fe881c939346b1f3a387ae07566dc80f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100648, "uuid": "56d22e99-a63f-402f-9f3f-14e2fd2d58d9", "comment": "Malware payload (CoinMiner)", "value": "e1d80bc7bb1f66eeb56bb89420987bd4e5406108764344013bb1966a20a443f5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100648, "uuid": "0465880e-cd6c-432b-99cc-09ee6263c8be", "comment": "Malware payload (CoinMiner)", "value": "f7fa0c839bfdc5f0d4d3d6466b867e952fcfe341", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686100648, "uuid": "4947ba80-03ec-41a6-b1f8-0ebb0880c9fb", "comment": "Malware payload (CoinMiner)", "value": "a3b7af8ca3d48f83bedb20c1b70cf563666012c9f0fb08de7a93cd2cee92ad3b7eb4fa364573c9b5f67940f1fb2f852b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100648, "uuid": "de600ea8-3fe9-4eb3-9948-77267a5d3a9c", "value": "T1BCA623BA6140B359C01A84348533EE5575F24E1E8E6A46AFB1E67FC5BFFB810E502F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100648, "uuid": "c4d4ef8d-ac43-436f-bb90-913f4ea6a3a8", "value": "8b3428abd1687b0abf69a71bd818674c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100648, "uuid": "9971c2d7-a126-462f-9c92-ac0e700990fb", "value": "196608:zvF2O9p08NT+WqG3prfs/f9xKWGpcR5lx1RbqSlJf4jGd14:zvrz08NTvR3p2fdGpcFASHgjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686100648, "uuid": "d35b5b4d-a8d8-4d97-85e3-9dd0c653ecf7", "value": 9905152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686100648, "uuid": "3e463b9c-beb9-489f-b3b2-3bc205641417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686100648, "uuid": "f3c6e236-51b6-4fc5-9b25-77015e6ccfb3", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c16cc2b-0526-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686137307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137307, "uuid": "b47e4d8d-1f74-497a-ad78-eb9a869c11bd", "comment": "Malware payload (Formbook)", "value": "71c18e8274447c67c89c7b48956199be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137307, "uuid": "994828c1-2577-4ce5-897f-27ca8873207c", "comment": "Malware payload (Formbook)", "value": "e28fb1a3afa196f54c1a3928afee6932b99e5e363bcaac31a57881e58f3ccbd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137307, "uuid": "2eee6ca3-c2f0-475c-b7e2-b73d0623cbb3", "comment": "Malware payload (Formbook)", "value": "5137e9e058e429c61f9d1b6d063ce7f1df854ac5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137307, "uuid": "f319df60-65f9-4afd-bf5e-7f61067d9c4d", "comment": "Malware payload (Formbook)", "value": "3cc4f30da0cea890f8532f4a1cfa36505bb964628eea08b3ebbf4598fc96cd1664a2b1b65fcc46930c5fbbb0bba1f466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137307, "uuid": "367195bb-8f25-4880-8dcb-6836a0a4bd3b", "value": "T18115CF22B1A05C77EB6B2B39DD1B5674983D7E202B0C983E5AE87E0C2F3425574642F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137307, "uuid": "feec54f3-ddb0-4153-b3ed-d0130dc2c9e4", "value": "56b9ee34a3c873bea4afe3c0ca147de8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137307, "uuid": "4f414e15-dcd8-4062-ba03-7fac3d7ad314", "value": "12288:l/AeU0+lRGAb9ROvbNuMmUn/LR4q8M+nqwtv07H1O9noM5:lIBljROVrn9J8M+nqwh07w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686137307, "uuid": "3d9c9978-1122-4d84-8d5d-d892d27bb95b", "value": 926208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686137307, "uuid": "9b5310b6-17fd-4abc-93db-cb0749a97dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137307, "uuid": "35448206-d8de-4091-8b92-82b0ac93b2f7", "value": "z108272615262526254.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a713de73-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128387, "uuid": "67577a72-df05-4303-9198-e08a11efbc64", "comment": "Malware payload (Mirai)", "value": "6912d00eef6109877fae4000257a3c79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128387, "uuid": "39b0ceee-211a-482b-8ff1-b1e85d58716c", "comment": "Malware payload (Mirai)", "value": "e2f063f78972136d5ba12b8101add96cdcf3fac5ac4d56a0913da9bc6203f12f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128387, "uuid": "048ecfa2-5502-4d28-8669-42eaec426eff", "comment": "Malware payload (Mirai)", "value": "dcdc21d4fb888a63757b48ff479da16e0c2d0a40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128387, "uuid": "58b90a3a-b65b-426b-9e63-f34a4d2d654a", "comment": "Malware payload (Mirai)", "value": "47ff8142daeb2395e14ffd1d0001d7158f415fab8a7cab7a48362aca56b65a4a6a87041afe5f8fd8e708a20a371e7b33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128387, "uuid": "7c16cc1e-1345-4e72-903b-4744d76dfa11", "value": "T17CA3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128387, "uuid": "8f1ee8f4-8c3a-47cf-8f25-5d6bce55bf40", "value": "3072:VK1z13U6HzHoXRtmTUhQogqEmmFVcqq0GnDZT:VK7DDeKlogqEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128387, "uuid": "2f2e8bc0-6728-466d-9c41-1c1dfc003f21", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128387, "uuid": "5ed7eeba-95c8-459d-bc44-598b4831cecc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128387, "uuid": "0fd33a1c-7e05-462c-ab4c-3c50173c8067", "value": "6912d00eef6109877fae4000257a3c79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e81260f-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686130063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130063, "uuid": "ae3c5d36-8792-46ed-8489-a18994d6a891", "comment": "Malware payload (SnakeKeylogger)", "value": "a1ecff90035f7012b78ac7d4eb67d0a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130063, "uuid": "24ac1d5a-1d0c-41a6-a1d6-5c36ec4517a9", "comment": "Malware payload (SnakeKeylogger)", "value": "e4083e69c82e69a41814def10c07a138d730398060abe67fd6a4a99c6f772bd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130063, "uuid": "5ddb05f6-dba3-4264-9f53-b3a3fac4013c", "comment": "Malware payload (SnakeKeylogger)", "value": "7db586d1080345d95ac40aaf38e3f84536e1e9d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130063, "uuid": "886ceaf8-188c-439b-8fa9-2a02ecb9471f", "comment": "Malware payload (SnakeKeylogger)", "value": "33227634095d6f07a2542874c32c4857c3340f22dd595bf74d08bfe64fd9ebc654e04036f463e81c6c73b942e0a92d98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130063, "uuid": "8c13e157-46ac-4683-9c31-b8b73ce01099", "value": "T183F4F128BBBE4B27C22A5DF809B0907407FEC555682ED2DB9DD774DF94C0BB049901AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130063, "uuid": "e5fc54fb-e853-42ed-9183-99759d2a4a08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130063, "uuid": "41d60b6a-91ba-4bbb-ab7c-fd9d8d0da206", "value": "12288:Pp82iNa7xdvo/MdyrhFgtDsuBHsSj5J4+saBGh88zEPEwhwWtRiDYwtX3AQVi8nr:PC1U9BqmycgiH75BR8W/mjftX3Az8nKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130063, "uuid": "affdfa35-fa57-45bb-a47a-35cce528ff27", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130063, "uuid": "e5a4db4b-e4ba-4af2-8d48-dab80c512a4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130063, "uuid": "ef0c71f6-2402-4b3d-a52a-2af9308565cc", "value": "S1H098765678900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2d964f-0538-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686144931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144931, "uuid": "c7dd4f2d-7a08-402f-a6aa-d3f269837736", "comment": "Malware payload (RedLineStealer)", "value": "28347649a61267e558617d6e53cfc5d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144931, "uuid": "eafc462c-e0ce-4688-b88f-0da4adb6b562", "comment": "Malware payload (RedLineStealer)", "value": "e5511ae9806847560af106f25caa3ad0a9b125ba811679a393a48ef310f32ee1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144931, "uuid": "38c41e2d-d445-49c0-aad8-69715175f98d", "comment": "Malware payload (RedLineStealer)", "value": "23cb737a607694c8ee0363d05888d87cddff0c88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686144931, "uuid": "eb017ee3-de62-4947-8226-e4075d01a6f4", "comment": "Malware payload (RedLineStealer)", "value": "df6d86ac9d06343702da6ff884358ea16626993260bf24d669661a95ff697b24c60a436f6818b3a24654102dd44217a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144931, "uuid": "d88c3e9e-25f9-4fad-819a-c1f096205b88", "value": "T126F41242BBF88076DAB5677088F613930F317C611835A2AF22479E4A1D73AD4943277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144931, "uuid": "283dadc9-53c1-48dc-9078-2983f7115dad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144931, "uuid": "67072951-ce88-40aa-993d-1c6955d89550", "value": "12288:yMrVy90XLQJOro7BNLUNuMiCMRN7tdwbXKIEbRUtpRRuxFIqk2KbXCeVFik:3yWQsoNR1C4N7t2XKIkSDRUqn2SXCeVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686144931, "uuid": "44c60c69-0d72-4a0d-933b-3da74caa5c2e", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686144931, "uuid": "6045c08b-c420-40df-8514-fdec8af7e87e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686144931, "uuid": "05108747-c242-45cc-b74d-dc31736aaac6", "value": "28347649a61267e558617d6e53cfc5d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b332a98-0518-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686131346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131346, "uuid": "732bd8ac-fbfc-4e01-92b1-a1b365d74f7a", "comment": "Malware payload (AgentTesla)", "value": "0cb87dd13ed07435738134991f685641", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131346, "uuid": "6db36f17-90e4-40be-9a34-7148c54bdfbe", "comment": "Malware payload (AgentTesla)", "value": "e6071ba2f488f316ab9de2f90837f31053dbbe5aee016f6c7372df78ccfd749e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131346, "uuid": "4ff0538a-03ea-49d6-b1a2-ec683bd0deb3", "comment": "Malware payload (AgentTesla)", "value": "af538075ae209107687f29ed70ef0c88e00fba0b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686131346, "uuid": "6d070d2d-8f95-4539-b625-a285e32ffb09", "comment": "Malware payload (AgentTesla)", "value": "84bfa02de3409e02d43e40a6efa0bd7895f78dc456bc8f8bd668a5e2e20ba64870751dbf6f50ee32ef197bda2482a49c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131346, "uuid": "c4950dfa-81fe-41a1-baa4-802546561f61", "value": "T17255D072298AFFD9DAEF0934D8453A641C832CA3DE5C83D5A8987E9A71F44249F44C73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131346, "uuid": "7eb31fd6-e878-4e5a-a0ee-544c7fbd300f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131346, "uuid": "cf00a923-a40f-4c60-b364-6e379ee3db35", "value": "24576:WDNz8FX180ect5Cq5X3QahJKJGqxfrD5nrXm1pmQzsY5m35RlUV4QYv6PF:WDwGSD5Xgang94Qd3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686131346, "uuid": "9ffb1aae-e27e-48ce-b64c-a83aafbed668", "value": 1403392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686131346, "uuid": "b9f1d85d-8093-41c6-9d87-a372ded965b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686131346, "uuid": "e2d132a6-5203-4173-92d5-43792fbb3d8d", "value": "Quote Order_Parts & Drawings\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7c95ab-051b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686132823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132823, "uuid": "f17d227d-07df-47cf-90f1-e9e7cfb585f0", "comment": "Malware payload (RemcosRAT)", "value": "2b262120999e89d0fae7cacf763301a6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132823, "uuid": "fac8f24e-6f93-47c9-9427-61cdeb19e3d0", "comment": "Malware payload (RemcosRAT)", "value": "e69d1e9f023deebccd2174f8507017de6ce4d62fb2c3603b708be5889c371b22", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132823, "uuid": "b38d7c40-7b9c-48af-9d2b-de182468fc71", "comment": "Malware payload (RemcosRAT)", "value": "1c81fe7a9891b4d0657769478f5d315d2e278960", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132823, "uuid": "43b15a76-4f55-47c4-b37f-464d015a38cf", "comment": "Malware payload (RemcosRAT)", "value": "6c62b28a3bc3114f38fd0afa03369ac22ffb551397910058917219c489c231c475d1fc900bc2db723f5c6a49368ce5e0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132823, "uuid": "7783409d-f03e-45fa-89a2-9709b9a0a947", "value": "T118B4E08C766172DFC857C4729EA81C68E650787B930BD153A09312ADEA0C9DBCF1A4F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132823, "uuid": "32b271a5-897d-4d29-a4d5-a91c39d16f22", "value": "12288:NUn4wO6TWyzY0sGvhb2L1Kdvi/GC1GtATEaO89kkGMrnC:Nm4wIoT900qyQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132823, "uuid": "4903e8b3-6d16-404f-b219-aff4669b7ebc", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132823, "uuid": "fd4d7062-ff58-4f2a-acc0-4586e58495ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132823, "uuid": "ab3de940-39b6-43f2-9f4e-45c0cd3f384b", "value": "2b262120999e89d0fae7cacf763301a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf983da-04d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686101419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101419, "uuid": "1bd2d67c-1886-4507-a88e-e66dd9e93d17", "comment": "Malware payload (RedLineStealer)", "value": "d5b9beaf52a8d268da46a94a6c1b1a4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101419, "uuid": "34a43c18-bf9f-482e-93ff-b6cdfc7df645", "comment": "Malware payload (RedLineStealer)", "value": "e6b5e4a15de0758793c71dd1b8ae4b6362a127148f70e25d8844156f114a86c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101419, "uuid": "24bc0b39-92e6-4621-a414-003a9004f1d4", "comment": "Malware payload (RedLineStealer)", "value": "cbbe554286c5a1877c6df90d0db739f6d79dcb56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686101419, "uuid": "84c26f1b-3f71-4af7-a3ea-8f41b8773f1a", "comment": "Malware payload (RedLineStealer)", "value": "98a8aa848f0a720dc736e301720d66c004cae716334f46f1e1e696cac8c233e94310c9f9e80ae3da66a1731db12d3854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101419, "uuid": "767454ce-2ddc-418d-b3af-2c9a1271efd1", "value": "T1F2744B53EEA37C54F5254B72CE2EC6E8775DF9A18E59376E2218AA2F04B00B1C163731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101419, "uuid": "51b70a73-11dd-4314-88cd-3d662510cc76", "value": "4bf83d17e4fe6ebaf744a99be88735bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101419, "uuid": "9b8bd0a8-44c9-44c6-ab68-c01cc02a8a3e", "value": "6144:Je5QoCqFyUX+fXrh4ktVuGfKA6a50dkwCFCt:J4QoRufXrhUGgprgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686101419, "uuid": "859b5f01-ba9a-41e4-903c-f368ff1b1086", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686101419, "uuid": "6bb99089-970d-48c3-8b1b-9977c5882566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686101419, "uuid": "62e02483-12fe-4388-8b72-8fbd714361b7", "value": "d5b9beaf52a8d268da46a94a6c1b1a4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c80c38-0562-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686162935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686162935, "uuid": "525507a1-c711-4e14-89b5-cf03f47a7c29", "comment": "Malware payload (Amadey)", "value": "840568da1c22b3606c8437fe943d807c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686162935, "uuid": "8480e1b5-a284-4554-97f6-78e51c8537bc", "comment": "Malware payload (Amadey)", "value": "e73a9070bf8918de53a4ec2c90ae2f5670cd35eb5872d9e21e909d94d608fd4a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686162935, "uuid": "e11155ed-e15f-4bbc-99bc-40e17c4da964", "comment": "Malware payload (Amadey)", "value": "bd47e94548b7f72a17c95b8f295b27e4594d2fa4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686162935, "uuid": "70de7493-78f8-4182-988d-56445cda8694", "comment": "Malware payload (Amadey)", "value": "b32915438997339e8397678ed50d9783e996da7302135229a4191d6098f49ac707cc2cb9360deec6f063e3a046de6503", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686162935, "uuid": "92054fbc-b494-450e-8ec4-e79dc830d797", "value": "T1A424F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686162935, "uuid": "40f3ebb2-ab60-4653-bfbe-5b22de23227e", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686162935, "uuid": "b1efc955-3099-453e-8126-ee1d8ec1d531", "value": "3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686162935, "uuid": "1d57f53a-7983-460b-a089-8ebad8f28fa1", "value": 210093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686162935, "uuid": "ddf39557-24f4-4f98-a93d-94e6bfee462c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686162935, "uuid": "0c73b4eb-1515-4c4e-8274-ec8982979b85", "value": "840568da1c22b3606c8437fe943d807c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9a7a1e-0563-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686163559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163559, "uuid": "b963f092-8f9a-42b3-a3e9-94c96a1625ab", "comment": "Malware payload (RedLineStealer)", "value": "c78bde751850090a0287d6d2c0a86a96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163559, "uuid": "e213f159-911d-447d-a590-ccc34b0c2fd2", "comment": "Malware payload (RedLineStealer)", "value": "e73aa308e623505b96aa7b85b32d31c5ca968adf99fbe3fb8842846f7010f2ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163559, "uuid": "e2ec52f8-f5c3-4ea5-9f68-a4c7e42ea607", "comment": "Malware payload (RedLineStealer)", "value": "b28029b800d881d3b3f66a8ee978027122cdc519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686163559, "uuid": "0da34114-18ad-45d1-a798-5f0687c2a136", "comment": "Malware payload (RedLineStealer)", "value": "f1234b5351ec7af9767b62d38ef0b94b04e6a119e0fd092effe8904acdb4387cce7e87508c7ea9425aafcefe5073001e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163559, "uuid": "0c53d10d-992c-4d03-9c76-81f49d00e081", "value": "T18EF41253A3EC5466E8B517700CFA52C31F36BC709925C39F3786DA5D08B2AE4A232767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163559, "uuid": "e9dc17b6-35d5-4804-bac1-c5c299a22099", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163559, "uuid": "84006607-00a2-43e6-ba72-cc0c2b9e651d", "value": "12288:KMrBy90+VYmk/5K1+H3MJuEFSJgEEaBIjZqpoPlWOFxaMnhHGrjg:Dy/Ym25GYqurXehFUM2jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686163559, "uuid": "35d1d280-ad26-4582-aafc-7211f29952b6", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686163559, "uuid": "84c57d20-4fd5-4033-a64b-316098204d96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686163559, "uuid": "c5db62c9-b4ea-408b-88d3-f1d8e39e6fdb", "value": "c78bde751850090a0287d6d2c0a86a96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f699ce-057d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686174842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174842, "uuid": "65b173d0-79c2-43ae-9059-bb4e1e208a7d", "comment": "Malware payload", "value": "b1b868b94a81a67afbc9b6a84459c718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174842, "uuid": "9859577e-9e31-46ee-b435-f44d184d359e", "comment": "Malware payload", "value": "e745e151ab38be7cea50e6d2f4143eaea729876180e8f773ef0c157063d26455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174842, "uuid": "fecfd119-f34c-46d3-ae53-657d484d48ed", "comment": "Malware payload", "value": "112582ec3b1b697804e3e9d8079dd298ef145e78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174842, "uuid": "1436f8a9-5298-48c0-a80d-83782dd2d4bb", "comment": "Malware payload", "value": "b42c313ac5aafd9d61f854dcaf8826b2bb65fcfc22519cc4005cc37c3fc062a24a77170f2671a1dbc098cf80b690b8aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174842, "uuid": "9fcf18a6-110b-4183-8327-e1325fce1954", "value": "T180B5AE8BB2D2C655C5703A358231D3840AE2B715A573D66BF6BF56933F03B392E412CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174842, "uuid": "c1d855c0-d81d-40ce-b962-661b9a9de65d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174842, "uuid": "94eb7f1d-663b-4363-9f85-fa034dfcb48b", "value": "49152:ZDPo2zaAMwx0kwjaNczZX8ZXfxdAkoYs3:ZDTzawwGWEDAkoY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686174842, "uuid": "72f325df-92ae-4dad-9ca4-03e95114b91b", "value": 2374144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686174842, "uuid": "3f858d19-2037-460b-b175-727b85a7e48a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174842, "uuid": "112ba55a-eb1a-40dd-819e-b60f13ff34f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f959a910-053c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686146993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146993, "uuid": "2440d229-efe6-414f-ac37-b7e18f6b958e", "comment": "Malware payload (RedLineStealer)", "value": "de7d1647c11aae44a9e548faee32206a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146993, "uuid": "f511f3ac-2b80-40c4-b2a6-e3b40a3ca35a", "comment": "Malware payload (RedLineStealer)", "value": "e7b0d857683aa5b7b3ed08a85e376a6fd7d56f61fc0470927bfbd8b9569a0485", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146993, "uuid": "9478b3ea-6b1a-4890-8e04-f510d7e07cea", "comment": "Malware payload (RedLineStealer)", "value": "1d5a3dbf1fe087886c83546cac1726a879b008e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146993, "uuid": "16dd4279-2119-4716-aeea-462ba31a8f96", "comment": "Malware payload (RedLineStealer)", "value": "13257c34c085aa2d489e6b5a2c4aa5763ae818cffca12fee70f49cbf700097c721de4047e4dc63de3082eae794bd046f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146993, "uuid": "ccf2dfeb-5f04-4f7a-a7f7-ec430a5e4a7f", "value": "T1B2446B09E4EF42D2FE463175216D905AF5BF80F323BFC02ECF5A3AD61C572A096A115A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146993, "uuid": "0066db23-793a-4b79-8c6f-efa6631a182c", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146993, "uuid": "f81bd816-dab5-4ace-a6b1-e4c9a73a83c4", "value": "3072:Ox/qx1OuyRyXFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2SUHcj/:a/qx1aEFaQ7W05AEezbMPZFzAy2Sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686146993, "uuid": "ca3d9c45-5050-4fa4-ba51-42732b50883e", "value": 269166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686146993, "uuid": "e51d938d-adc5-48ef-ab03-4bccd4aba216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146993, "uuid": "3fa32eb9-ed0f-4138-a825-b62f27c8a37d", "value": "de7d1647c11aae44a9e548faee32206a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d778c5c-0527-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686137605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137605, "uuid": "f181e56a-f03b-4074-b73f-add2e9e04146", "comment": "Malware payload", "value": "3965d4c7282128983b371a2d9ad120ed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137605, "uuid": "f51cb210-c330-4abd-b50d-9e25e87d467d", "comment": "Malware payload", "value": "e82eca7bf1927e3b0e40c9f7e738b19f9840d197d72a73efc0c5e117d1446ba2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137605, "uuid": "4a8083f7-7c4d-4dea-b8ef-4d46b4a6af7b", "comment": "Malware payload", "value": "5b550f13121c49743c6e0c762a7354c0113275f4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137605, "uuid": "581832cc-d79c-470b-aa7e-2121ca210b3e", "comment": "Malware payload", "value": "54f76346ed6e275147a03461b923841b960b23d8f9674a4c7e4dc041d11d29e993fdc40e61a1f089cae7572e8fd9c958", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137605, "uuid": "140c75f7-dab6-4dfe-ba10-32fe57e0f73b", "value": "T1F1243A50686BDBAC22E7C45E44E115B21BE43080D4D477BBB61EADEA13037AFF062DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137605, "uuid": "d74b0a35-912d-4514-960c-28311c3726f0", "value": "6144:nx5X3yrB8d60T6jZCcD21mcvxQfoJzh0aiC2Wp/q2:nx5X3yYU61m3+02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686137605, "uuid": "8e1ce2b7-abfc-43c1-8f79-a5640a6fa80f", "value": 214903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686137605, "uuid": "fe2e2593-e59d-4f64-9e1a-0cc602a894a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137605, "uuid": "a6fba66c-6024-4f71-b609-d06af91fd690", "value": "printouts of outstanding as of 06062023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f207c90-057d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686174517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174517, "uuid": "5003eae4-2abd-4798-9735-bf6e9ab21a2e", "comment": "Malware payload", "value": "2e08ece82fc8a6c1170f7d96f394a56a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174517, "uuid": "5d942583-e195-4923-9445-6c31b6b7d340", "comment": "Malware payload", "value": "e9d6b365f55aeff297d55bd4e9789cd78729ed070cdb7f5f25a2673fe97d7c9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174517, "uuid": "a0475c4e-0ed8-4273-884a-2dff3eaa5c9a", "comment": "Malware payload", "value": "b4ae2265ccf14497c07748aaed499198789daaa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686174517, "uuid": "84c8823c-e52c-4b14-b67c-18b585298566", "comment": "Malware payload", "value": "3fc0fd0d49e26faa674cd2275bc5b187a051b984703fccfff1b60d9c458a9539a6d656cbfffcd8dc7fb8afd0092ea75a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174517, "uuid": "ecc644d6-45ac-4cf8-81d4-39ab22b68724", "value": "T1C1F423121FE85532EDB56BB049FA57831B72BCA2CD74976B2361A91E0C33180793277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174517, "uuid": "ad90be8f-1a33-4609-be2c-f9d8a4c2534b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174517, "uuid": "6af8362f-623b-47fe-8728-33b0492b1e67", "value": "12288:RMriy90PMFjh+Ka8QZVYxyTfRLUSjEp4DKwRBcWEwp/RnrP7azc4FVW1UnZ6qvPX:/yLBe8QoURLUcEp4DKUBEw5QFV6SzXm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686174517, "uuid": "ba096829-536b-467b-91b1-a5ea38745f5c", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686174517, "uuid": "3d1ab05a-ca6a-444c-b331-8b011a902531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686174517, "uuid": "33bde41d-3296-4fd5-8446-55c7cf33aecc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0b48ae-052d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686140453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140453, "uuid": "eebefdf7-8057-4a98-b63a-1673c9cc64ba", "comment": "Malware payload (AgentTesla)", "value": "0e5278fcd5d2fac322dd3a2eb08cca88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140453, "uuid": "08deb77e-7371-41a1-a6ec-9e45b7d08fd0", "comment": "Malware payload (AgentTesla)", "value": "eac81a504c9868b007ee133de013fc4770ef0f8544e879b6ae9f21bbdadfe10e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140453, "uuid": "ea8dd296-12f8-4106-9918-716f8e7083ec", "comment": "Malware payload (AgentTesla)", "value": "bc86cb69a19a18675383cbf115e688180ce5857f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140453, "uuid": "1f5b71ab-9e6f-40d8-ade4-d3c109a1094c", "comment": "Malware payload (AgentTesla)", "value": "9fd797e14a0a27ccbd83084e1eb44fc4d6124f634b5108321d0b405be5a6478611382562756eac264842aa05e70c32d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140453, "uuid": "f3cf9142-0db3-4b35-abed-225dce589088", "value": "T110E433D76E3939647588E4DE61C5DE4A6CAEBC78803144B0A9298A3EDC0D073463B3DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140453, "uuid": "bdddccae-a959-4b48-b120-750885689d0c", "value": "12288:OExmlHzdoz73Z7hUosLtnyGwlox9YyLbyt0BeRhHCC89eOnwNTDnnkmQmqx5h0jQ:OEqdo9iosAvSWE2t0BeR9BVOwN/klmqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140453, "uuid": "941014c4-8d85-4189-acf5-eba5f4bb1a8b", "value": 720057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140453, "uuid": "4448c00d-b7ed-4933-b607-cce33d9a2bbe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140453, "uuid": "1af27334-5f23-4353-80ec-9ad169680de4", "value": "DETAILS SHIPPMENT PACKAGE pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe514a4-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686130066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130066, "uuid": "4a3fddf7-08c1-4382-a7f5-466464eb0b95", "comment": "Malware payload (AgentTesla)", "value": "35721ff57afc096802c64410e206e613", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130066, "uuid": "343ec098-f3e7-4fdc-af92-7ede0ea85ac6", "comment": "Malware payload (AgentTesla)", "value": "eae139ae39ad516ffb020b7b93016734b4a78e253924f5a6e9b174bffe391c48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130066, "uuid": "2b9fbecf-cc13-4b36-a1a8-b5a1e4d6c928", "comment": "Malware payload (AgentTesla)", "value": "bc10f231a05605301eb2d9f677bc2c6ea4f8aeda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130066, "uuid": "296601c2-54ec-4229-8901-5e451d919c75", "comment": "Malware payload (AgentTesla)", "value": "782545023ae24640816a459b593c9866cdfba626ff9e708e30cd01208c146483f79f56cbc792b63275d36c7da08fbd08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130066, "uuid": "3f69e560-aae0-441d-8d67-0f2a2e69a8c8", "value": "T1096412506BE5C163C6B76FB12E361B37977AB6231164D3872720DA4D3AB1482A10F3B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130066, "uuid": "1821ef59-15d9-482b-b4c2-42aa45785cc9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130066, "uuid": "1fa8e93e-744e-403c-ae6d-db6a48ebec63", "value": "6144:/Ya6FNBSpvq7LuU1FCUIWQa85hSjquH1tuB//vyIH27koko:/Yf3OE1cWQa8a2uH1tW//vrH27kDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130066, "uuid": "2fbc5ea9-ea1b-4d4a-8c1e-f49c1e545e54", "value": 308459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130066, "uuid": "b8ee614c-a35f-4eb7-b306-df4d689ecb98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130066, "uuid": "89f30fe9-172f-429f-a584-200aad35f601", "value": "Shipment Documents PO2305-007 YUEQING.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7ab5e1-0543-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686149709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149709, "uuid": "ff7c128b-6a26-4924-bc91-26b9dbf96b1a", "comment": "Malware payload (AgentTesla)", "value": "20a372760916a342fa132d0f53240da2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149709, "uuid": "5e0d152d-cd04-4c5a-bbc3-1f63728f5407", "comment": "Malware payload (AgentTesla)", "value": "ebd95361bcf948797ece2e75a9c5e908e85be967b016656d42ffcaa3a5c6f29e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149709, "uuid": "e1b2a4ed-9d55-4810-987a-8691b975a1f5", "comment": "Malware payload (AgentTesla)", "value": "6a5c8b6b2baa2dd1936f874dfd1366cebc51b913", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149709, "uuid": "59adce50-ce7e-4f0c-9508-d44bf72cc96d", "comment": "Malware payload (AgentTesla)", "value": "186bf2ed7f34678bb7a33ca4660f0105501f34d82d7428e82970cd29cdcd63efb3376f5743ac9bd7fd5fe0754a84cbdd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149709, "uuid": "7ae2fc2a-204e-4e81-affb-2562d7a0ffb3", "value": "T1A5052FBD1D02A6EBD1BFA62A50DC1D1FFF65B886FE96B84C64C20387319224E76C514C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149709, "uuid": "f9d7055c-1131-4a2e-9708-7a9e83d79662", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149709, "uuid": "918dbc90-e7e4-433e-9ef9-05fdb3a6fbb6", "value": "6144:yFvQe+OlUENL72yM5Vxvb08rAERvKawaNNuw7TtvpF9lr06U2U0L10m9nZm:yH+Ty/iA8rAEZ/1p9P920Zh9Zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686149709, "uuid": "9c680081-fc55-45e8-a72d-fcc9013b80d3", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686149709, "uuid": "620446a5-f036-4771-b371-2a5f55430a35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149709, "uuid": "8ffddedd-568a-4dac-b54e-7224f774b9d6", "value": "PAYMENT ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd65352-0535-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686143783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143783, "uuid": "6e854e6a-dd78-4c2d-81c7-feb649eb3e41", "comment": "Malware payload (AgentTesla)", "value": "d1cb97f973de6e9b2c7a7c678c66864d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143783, "uuid": "32715d90-6ca6-4585-8c58-038a716f31a3", "comment": "Malware payload (AgentTesla)", "value": "ec138fd03e6239e84fa8751411c8dfec0fb3ebff47e0deb9f7aad7e3b3cfd744", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143783, "uuid": "6972d862-2110-4a86-968d-7d0b10ceac5b", "comment": "Malware payload (AgentTesla)", "value": "3646d9bb7f5b5f714d143a47c4303b44826c2c9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686143783, "uuid": "5a3e368b-92e4-446d-9646-64e1649f708f", "comment": "Malware payload (AgentTesla)", "value": "fb6c83809bb499bb204d0f4a5ce32faa03bc1e2aba7e80f9c91e8da79db32c32c123f42cc2a71f85a56e5dfd8d121bfc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143783, "uuid": "b6d0cc93-7d04-4938-a9f3-b70bf12d6763", "value": "T1A115020533D680DEC81E5B7D19CE06B4D5B85C073836E90FA9663D9FBF70F884581AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143783, "uuid": "61b54543-a8e4-416e-ac19-72d2b4bc0436", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143783, "uuid": "b8f6ecfa-13f2-443f-8243-801f2f8272de", "value": "12288:vd6L7PV0f/ijbhaDnLMzIL2q+RTdOL8xuD+D3khSrcfLw+H0GxgHacrZOpfweViw:QOyqGUL8xuaD0hSroLJKDrMVi9n9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686143783, "uuid": "099a85a3-3c9a-40ce-9204-ace1e2ab8447", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686143783, "uuid": "5b1afdb3-3268-4613-994c-0833a7f519cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686143783, "uuid": "689308f0-7041-4e84-8264-3b1e619cf473", "value": "New_Inquiry_Sample_Spec..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c79a6c-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686130069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130069, "uuid": "be0475dd-1ef6-4d36-84f8-9b75de7fe9d9", "comment": "Malware payload (AgentTesla)", "value": "ef84bf3e5bd221a021e9ca7af7ab4e37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130069, "uuid": "9fc030b9-eb28-436c-a019-6b03da821464", "comment": "Malware payload (AgentTesla)", "value": "ed1be81694e6e2a92dfdf8cdd879514033a84bcc6ec435e77258383bce519789", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130069, "uuid": "ae033381-1d3f-4fdb-b299-1544537c2ab6", "comment": "Malware payload (AgentTesla)", "value": "d1d96b0569b7759cfea3cdabd0d8ed11293ec10b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130069, "uuid": "20d540d5-3333-4da1-af2a-f60a84d09560", "comment": "Malware payload (AgentTesla)", "value": "14c0da25531fd5782a78be9d9d08c3348247eae7bf0ec098c1ee43861cf203127eff54e4a5319efa8137b903b793e667", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130069, "uuid": "ce4591c2-34b0-4af5-984d-85a94b6a5049", "value": "T19F24D0AD764072DFC997C0B1AFE84C68EF6071BA570B4547A023969DAE8CA47CF240F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130069, "uuid": "cf993d28-7749-4c0d-8f4f-92f5d4940a97", "value": "6144:E9FBQzPAp6S8Rfqjr2AH+UkrtTt/xpgKwp8/Tvj5:kFBQzPAp6TI5H+U8tTt/hw+/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130069, "uuid": "1d690579-0d37-46a2-b43d-d8f45ea0407e", "value": 215616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130069, "uuid": "70a6b042-0da4-4a0c-92d3-93c27a9fce03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130069, "uuid": "454f90fa-8631-4dfd-9614-6b9741dbde1a", "value": "TALIMAT-23-01085 -06062023-DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b17ac1-055a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686159714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159714, "uuid": "89b12f43-209e-47f4-908b-e166a208dfdb", "comment": "Malware payload (AgentTesla)", "value": "3ad703be3ad38ae881f39d44cb72974f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159714, "uuid": "7abe3964-14f0-4529-8f5e-7cc14fc60d3d", "comment": "Malware payload (AgentTesla)", "value": "ed7f74a7f08c133d454c3b2484a86e288cb35f236bc3889b4fcd2c8f033601f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159714, "uuid": "c6f3348c-98ba-4275-9dad-3f29c3b66a52", "comment": "Malware payload (AgentTesla)", "value": "a25e7fa87bee404fd21c0b0fa8bb7f4259269e08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686159714, "uuid": "ea721685-2044-47ae-a08c-68ad0d71e951", "comment": "Malware payload (AgentTesla)", "value": "704233f74bf48b3bc3143e6a4805538994e5788537842a5ab211b1838db4f36c4610e0b64f531e573434e91cdcbe7556", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159714, "uuid": "6b3e30d7-739d-4385-9d4b-6266a9d4d15d", "value": "T12E54015423E8AF5ADC7E77FE81611C61A3A2B4521017E25D2EC5B1CB7A37B001245FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159714, "uuid": "a87a03b0-11d4-40ab-a6ef-638504587422", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159714, "uuid": "25e0c0c9-a5a6-44d4-9f61-58b72a1b71b8", "value": "6144:+38E9p5Y2o98uJbm44lyK+zrdQ3e6WRGlkiNzsYRBGklNaf:ozQAyKedQ3e6WRGbsGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686159714, "uuid": "24f8faae-b5d9-4a36-8d4b-031f199b260f", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686159714, "uuid": "7d6a40cc-bcf0-405e-bcf3-28747f8c6cad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686159714, "uuid": "8f87f70e-4768-40bd-9874-eb91f558136f", "value": "Sales Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1030d7e6-0540-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1686148320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148320, "uuid": "4f4c0fa5-ded5-45d6-ae73-1cf60b69c091", "comment": "Malware payload (LgoogLoader)", "value": "3803666407877f6bc945425ce874653d", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148320, "uuid": "a908e2db-20f3-4693-b68a-f8f07de543c8", "comment": "Malware payload (LgoogLoader)", "value": "ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148320, "uuid": "fba8c385-fe23-49cd-9481-0a7e5573c791", "comment": "Malware payload (LgoogLoader)", "value": "fc824bd0430c2e70e9bfad65a70e78bf059aa82e", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148320, "uuid": "1a7c579e-480a-4835-a632-87dd8e06f8a4", "comment": "Malware payload (LgoogLoader)", "value": "bea661ace62acbccb0d63a8f7c9d8476f76e791f223f06464ee5c3965361f79abd1659b942fa8133630e5e62ced6da86", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148320, "uuid": "74e3ac87-df05-4964-adf4-363ad32e1709", "value": "T18DA2191463F98363E6FF4B7658B362806377B7B3B532CB0D1AD410A91957780CA42BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148320, "uuid": "ee3599b9-6577-4c1d-bd6b-26dbaef7db6f", "value": "384:TAuZSCDIElD/AW6zyeUci3BBcWnYNBa20cDGXwfwqppg6+KnhkMSaTFTD:xlD/22eUcusWY6gZYUTJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686148320, "uuid": "4a89bd93-fd05-4af5-9bc2-bcdf7580ebc1", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686148320, "uuid": "7c183485-b09d-413a-936b-0303a07d9e5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148320, "uuid": "84633ef0-06c6-4241-ab35-df45c6d0e527", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c623b169-0542-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686149484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149484, "uuid": "597e7aca-523f-4e2a-a00d-cec688fc8fdf", "comment": "Malware payload (Quakbot)", "value": "80cdc585c8aac8c9d713c1c115637a8b", "object_relation": "md5", "Tag": [ { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149484, "uuid": "467b2471-5267-4f54-844e-e1a2c7d4ae72", "comment": "Malware payload (Quakbot)", "value": "ee6f0619725d82cb26f96f38d7896a1e57e6195c4c2b7b5ee4797b190fa6b5e3", "object_relation": "sha256", "Tag": [ { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149484, "uuid": "079d8807-444b-42b3-a929-89a8a6541968", "comment": "Malware payload (Quakbot)", "value": "95d97758bf98ba2d0bae100b107a66eabbd8f0b7", "object_relation": "sha1", "Tag": [ { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149484, "uuid": "8608befc-a818-415e-9834-f33818cd3e38", "comment": "Malware payload (Quakbot)", "value": "0b9b624bd7612885609c1c6a099c0d56bf03cdee3ade5c77851a5be8eb20dac67de9ca3a47bcef3260272e82fd795afe", "object_relation": "sha3-384", "Tag": [ { "name": "obama267", "colour": "#2066BC", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149484, "uuid": "027f5007-6b5c-4b75-8519-c1fc68f22534", "value": "T18AC34AAC988CD588C979EBF2F752F4CAA50D733B5E8A94B671AF0FD61243C15E943801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149484, "uuid": "6dd9e18e-8c7b-4148-a3b6-0ef661823203", "value": "1536:Jcs2Uwcs9ucsBcsRmcs0KcsHFb2AW2oERLYm3RT3MSLVMXLHtSR1GWBZD7p8VbLl:cHPCYLrMeVoHtSXGml6nize", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686149484, "uuid": "2d7a2284-1c97-4801-9ce0-3256a192ad30", "value": 129818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686149484, "uuid": "82f3e5c1-7466-4ae4-a6a8-ce54c8417af3", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149484, "uuid": "fb4e828b-27c6-4f77-9919-11e8f54fc9ba", "value": "Calculation-of-costs-1337.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e69a7a5-053c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686146733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146733, "uuid": "0de93384-6114-4dbb-a29d-8b030b4c3caf", "comment": "Malware payload (Amadey)", "value": "bd3d48d2d1b15b9108ab04b0d9e56d08", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146733, "uuid": "e2ab5410-e6fc-4391-a1d2-8e66124cc1c8", "comment": "Malware payload (Amadey)", "value": "ee795797a97c639a09c43d77a711f46e8d3f571ea8f1fb9f16201926950bcc7c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146733, "uuid": "dad7fb1b-4bc8-47d1-9b51-7c769770150e", "comment": "Malware payload (Amadey)", "value": "94fa452d8f6b24cf904828b865ab101be8d83e4d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686146733, "uuid": "687703e4-3d27-49e2-9f3c-23d1b60073f6", "comment": "Malware payload (Amadey)", "value": "11d42fea0987a9dc65985bd0478ab670f1d2c338f5311eed0084d8c4cb75e347aea9c9bdf655c3b46fed408f1a223c35", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146733, "uuid": "f74bf115-4e1b-4d8f-bd94-23247a3f613a", "value": "T1B2052202E6D891B8D8F103704CF617830B353DA29C7C9BA727812E6B19B36E5797875B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146733, "uuid": "bad81795-ee04-4f94-af78-7d7d946649ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146733, "uuid": "b301dc67-20e0-4da1-8823-652a60c15505", "value": "12288:8Mr8y90l+PRz7ruTtZx3p25tO2fAthdgETHyt9PX5ZVcjfiV5iCXHmlVdjLWInv6:wyw+PShM5tlfWdxDcGMiC30d2AYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686146733, "uuid": "bb932746-0d2a-405f-9507-cb6cea175400", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686146733, "uuid": "f7206b15-7c43-46eb-b275-73fcc7fc38ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686146733, "uuid": "45baf421-275e-4683-a10b-fc605ae14321", "value": "bd3d48d2d1b15b9108ab04b0d9e56d08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e44604-04e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686109290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686109290, "uuid": "0cab7039-79b3-4c6c-854f-07e7eeaa85c9", "comment": "Malware payload", "value": "3685a09911e0ba396910236ccae2bb4b", "object_relation": "md5", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686109290, "uuid": "97a59921-04a3-4a9f-936c-5f9fe40dee0c", "comment": "Malware payload", "value": "f104ef04c4b9982a994defa933eace1e2b80c13f4c69361268c8137db064e706", "object_relation": "sha256", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686109290, "uuid": "fbcfeb99-29dd-4462-8037-f4d530a00f61", "comment": "Malware payload", "value": "84f7ab1a39dc874affd2b2617dc6c6b019265e91", "object_relation": "sha1", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686109290, "uuid": "943722a1-2cb2-45cb-95ca-bbb26de6afb3", "comment": "Malware payload", "value": "ed0862f674472d89bc65f24c762baedab3c94384549ed7f00ae58c7d6e1b6281520c6b4b962e955b0c42793551f4634d", "object_relation": "sha3-384", "Tag": [ { "name": "GPT", "colour": "#9FE24F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686109290, "uuid": "f5285088-b2fc-4184-b858-e030dd64d942", "value": "T1A24633F41D6C7C326B14CF97410A2FC91649AE26FFB8ED498B9FD5620B1ABA4F007845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686109290, "uuid": "5fb55bbb-8d8d-4513-b898-9ac8dbffac79", "value": "98304:PES5Ex+UGKyUs/7BC5EazTB5Ayj26SQTwEcPyiBq7ZowaKTyKEWhSUQYg9nUkihb:sehdC5JzTB5Ag26nwEcPp0PaKWs9AnU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686109290, "uuid": "50385709-6495-4a2e-8a56-abd76b5aefac", "value": 5850568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686109290, "uuid": "8608de20-a09a-49bb-9d61-4f4be5080a1d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686109290, "uuid": "fa967ca5-31f5-4385-ace7-c6c73ff644b6", "value": "Bard_AI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ee0815-0531-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686142212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686142212, "uuid": "a70fb67e-efe7-4b5a-a198-095daeeb6d6f", "comment": "Malware payload (RedLineStealer)", "value": "41cdee11128dbc4dd42cec2938697943", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686142212, "uuid": "496ecb5c-8d1b-49a0-8a74-efe0066a5652", "comment": "Malware payload (RedLineStealer)", "value": "f22e976a3cc892e7c21cf6e222d0cf2e0e6c0dc0f7b882c7ac8d365a1e3b4cd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686142212, "uuid": "78091211-3c0d-487a-9065-868fb45d8f98", "comment": "Malware payload (RedLineStealer)", "value": "bb3db63027d136b5378997a8cdd314908f2e2667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686142212, "uuid": "ae1f89d2-fed7-4df9-a886-a7257c6f5acf", "comment": "Malware payload (RedLineStealer)", "value": "5ff63832d920144ef9055f48bb60abbffe3797d0694b0840b4077e276ab28766acf8d611546e4b5baabbc52e8552a7a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686142212, "uuid": "dcfff7d7-014d-49f4-a6e6-19884aedfc21", "value": "T1A684AF12E2D1B869E5E606325EDEC2F4562FB5218F3967DB3746462F05321F2CA3230D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686142212, "uuid": "7862c8e3-673a-4137-b2a7-9d00509699dd", "value": "7100519bc21d5ca9fd8de2cf0f042300", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686142212, "uuid": "5354abf6-01f6-45b4-a1ff-ee253b0c0f6e", "value": "6144:/xVB+m0DYufV438irNIrtxKX3MoevMqZKiu2gADhFILH10:8H34MEATYSfuzuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686142212, "uuid": "967a854b-44f4-4125-bf11-a61b5005df4c", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686142212, "uuid": "c9c542ce-45b8-46db-b6b8-c4b97d231008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686142212, "uuid": "636511c5-4512-43df-9ce5-c63d6a8a1483", "value": "41cdee11128dbc4dd42cec2938697943.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb81bdf8-052e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686140876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140876, "uuid": "b12acf91-8c8e-4181-a79f-a2e763a2b41c", "comment": "Malware payload (AgentTesla)", "value": "28e63e1e10d77ab417e72584e682324f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140876, "uuid": "6aff610f-f236-48f2-8ac5-f596787051b5", "comment": "Malware payload (AgentTesla)", "value": "f3b4b1719930593f8c1e135c3cc9d40567cd2077600fceb95aabed24792a5252", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140876, "uuid": "efaf8c80-b0a5-4566-a745-b9f1c476e1f3", "comment": "Malware payload (AgentTesla)", "value": "154b12723d567234e865db892ccc3efc7bf80e7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686140876, "uuid": "45c789f4-6375-4de7-90ec-9f46aca5acaf", "comment": "Malware payload (AgentTesla)", "value": "c6f58206bd8fd6c6a86e8b1a149de48560b77c70858847f8a76c8a0aa117ec2b053dc51d2364946a54030f81f3cef160", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140876, "uuid": "621a1bff-7b6c-48e8-9391-f049d3dc77db", "value": "T1D905F146BABE5B26C436ABF80230523057FDD965703BD28A8ED325DFA464F301E51B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140876, "uuid": "1aa8e59c-c6a4-4269-88eb-ee8d1b66d432", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140876, "uuid": "3ea38ed6-cbe3-426d-aea5-712bacf1d386", "value": "24576:51U9BqmycgiH75BP1ST/HQLGNBmulUPVrHmZ:5u9Bqmycr7gEklUNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686140876, "uuid": "7bf72000-8c6b-467b-9026-7fbb99b7a101", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686140876, "uuid": "723cad76-8097-41fb-9ed4-d37ce61c1681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686140876, "uuid": "3714d91f-54a3-4ba1-a3a9-aa2a4d11ca85", "value": "PO 614457.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fe9a60-0511-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686128407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128407, "uuid": "5b09b1ae-a7e7-4b30-aa72-f09a3cfc5e4f", "comment": "Malware payload (Mirai)", "value": "384e1dc2587b4f3869dcbc7104ea28a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128407, "uuid": "e6ea179d-0210-49f0-a2d9-edfe5dbf7df9", "comment": "Malware payload (Mirai)", "value": "f4d7cf4ebf7b1b796f35e6946ab383d7cc7bea7a4b56b591a29399431558e036", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128407, "uuid": "e6cad719-2662-4125-8628-be5a96672a29", "comment": "Malware payload (Mirai)", "value": "15b2da965b2117ddf9c1a40da4b5ca7343cf4e85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686128407, "uuid": "73d18664-1176-47bb-8c2e-478f856a96ca", "comment": "Malware payload (Mirai)", "value": "4e92927223d78555810b6eeeadd5199477ab9f607a8fd041d55b85c4fed5467dcf63bdae12c20cc735ac0f18492b1e16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128407, "uuid": "6661130a-0958-4b7b-91fa-6573aa5321bb", "value": "T190439E73C8296DC4C1988274B8259E7B5B13F81452931EBB1AFAC5AA400BFBCF6453F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128407, "uuid": "a01e1d24-8762-4de9-b2cd-3ce58985feb0", "value": "1536:A+ta2Ac7tLHu2+wtO1J/pmKM4kywm2bCiKkPR:Rrr6tN1JxZMxm2bnPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686128407, "uuid": "40545a13-d95f-466b-8390-ce3cbc943efe", "value": 60096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686128407, "uuid": "337167ca-98ca-4a4f-933c-8af864ed8f76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686128407, "uuid": "34af1f79-804b-4aeb-bb5b-61a7c36cff88", "value": "384e1dc2587b4f3869dcbc7104ea28a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b59a7a9-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686130058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130058, "uuid": "2c39ef65-efca-4923-8381-ced79112a933", "comment": "Malware payload (AgentTesla)", "value": "7ca4e35c64cd1cf66f65e02c1dceb748", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130058, "uuid": "6293d0d3-354e-4f0e-a37d-694f3479cc11", "comment": "Malware payload (AgentTesla)", "value": "f7dd22fb970ce053fe95c76ee3a57c846c14bd08187b1f8f2d1d56e19294df35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130058, "uuid": "d66b346a-476a-488d-acd6-02e1e94c160f", "comment": "Malware payload (AgentTesla)", "value": "633cc340ea8fd9c72bc742cbc14ddfc857ca5e83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130058, "uuid": "b20db852-0460-4054-bb76-66f543c07c7a", "comment": "Malware payload (AgentTesla)", "value": "b0b6852611f8145de3b2332ebdecaeb9132a013567219502dead6f5551dd1433e4001bd7b18a42eddd775f36dd147d6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130058, "uuid": "0c7ce2c3-1143-41b6-b1f1-9be2c69a2020", "value": "T1EBE4229532654813F89BBBB121A16B350BB576267439E3CB0DC677CF2AF7B141242B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130058, "uuid": "6559aaa3-0169-489f-8ec4-937f72e33763", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130058, "uuid": "c988ef44-f8a1-4ca5-8291-dbc110dcb557", "value": "12288:27z5GoJiGaq5aurKQbkgdLfCqBmgMduyiGrsFGNT1A4RAcf:w5GoR5adETh9mpt+4YW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130058, "uuid": "f1ce017e-6095-4c27-af77-e55db762e7ac", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130058, "uuid": "7bd03c0d-5d31-4dd6-aedd-d735cee4c7eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130058, "uuid": "51613c22-8084-4ffa-ad1b-17082ce402f3", "value": "Proforma_invoiceMAY_97747388289928288.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0455c4a-04e7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1686110363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686110363, "uuid": "7cfa652f-b846-4f82-b814-9c4eeaa9b369", "comment": "Malware payload (ArkeiStealer)", "value": "78ad2c1c626eb04bead4311e83d2b44d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686110363, "uuid": "6c489456-c810-49de-9aec-0289a960b04a", "comment": "Malware payload (ArkeiStealer)", "value": "f81afd992a0c5d52b1ef1d11acd3f03bc4ffe611d2e40ee6ccc0671e5df8d89a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686110363, "uuid": "24db0807-3e80-44cd-b24f-c4c494d579c5", "comment": "Malware payload (ArkeiStealer)", "value": "23a099ba1c59e8ef58fd871002644cee6b1a2387", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686110363, "uuid": "35f3d774-e05e-48ee-bf0f-c0046082d8b2", "comment": "Malware payload (ArkeiStealer)", "value": "722d342c947bbe135519d09e3d0e20ad25eca6b18c3384058a32abb51dd4d289729fbf96a42afc714e7e6fff84c5851d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686110363, "uuid": "966518da-d223-4ede-aa1b-fbfae91284fa", "value": "T14FD6A63D481687772176D219D0C8495BF965099BFA321F8E60CF8B96AE07A133CC4FAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686110363, "uuid": "00cd6701-1e35-4c98-b662-a17bbee9759b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686110363, "uuid": "45abba55-6e40-477c-8413-a123b982d449", "value": "196608:D84L0yHmqMHVu02XKO2cnDAxJ29BKRW0X:D8+wHVj2a2DcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686110363, "uuid": "9496c9d3-5af5-43ec-8923-06ef05311c23", "value": 13314784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686110363, "uuid": "de188667-e423-4e11-8ff7-1dd36e80b994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686110363, "uuid": "0fdd0272-dabc-45c3-8e48-9d6d22125559", "value": "LauncherPC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398da03d-0540-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GurcuStealer)", "timestamp": 1686148389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148389, "uuid": "fe0e4a58-f6cf-470d-8543-21154a157435", "comment": "Malware payload (GurcuStealer)", "value": "f693e2f2661b6e5824ccd29e5ba58bb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148389, "uuid": "3122dd11-4b3b-4450-a071-57172ebcfbeb", "comment": "Malware payload (GurcuStealer)", "value": "f8fd7b7eabb7b70e3f5a13bf8526eb620522a3c0aac6caf05b4db83d13e1e625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148389, "uuid": "c5e7c462-f7c3-40b2-a991-937ab7181c52", "comment": "Malware payload (GurcuStealer)", "value": "9ad9460ca70e2c603c693c3ea97e29b9b06d3d57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686148389, "uuid": "2c452759-c189-47dd-b43d-92158d0a1d16", "comment": "Malware payload (GurcuStealer)", "value": "8e1254033c5f6140014d69359703d12193999c32b502870c720ff847d0c259c02c48e76cb39259a27b4b0ff169d93dae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148389, "uuid": "fa4ebb93-49a1-468f-b543-fd43c8e003eb", "value": "T1A2E33C45F2887CE2D11B4A77D4B5FA059335F303294E660A2DFAF04A59B33C22692D6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148389, "uuid": "936537b5-6adc-4c0f-855c-2d77366bd872", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148389, "uuid": "9d373030-3020-4562-8291-9b101b310444", "value": "3072:r3I1ulD0nLS/wtsaLi4rJPd1F9b2NvvrG/pchkwglSOxAWP0w:LI1ulD0nLS/wtsaLiAJZ9b2ZvrCOgM7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686148389, "uuid": "2edbe935-4ecd-4e2a-bb0d-4dfa18bbee54", "value": 155224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686148389, "uuid": "5b7cb4b4-f62e-4b94-96d4-38f0bed93052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686148389, "uuid": "c56ed16f-e282-40e0-b4a4-ae848b12c9b0", "value": "SecuriteInfo.com.Trojan.Mardom.IN.24.23026.16313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ac0ce4-04e3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686108619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686108619, "uuid": "ad103b75-0baa-4789-ad7b-cf79edace47d", "comment": "Malware payload (RedLineStealer)", "value": "c0aee35d18fef859cdadc9963635bed0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686108619, "uuid": "a0ecf126-0513-497c-9772-a3fafd286b1a", "comment": "Malware payload (RedLineStealer)", "value": "faddde3b52559feaea7a22f2018926a5e3c4e582b91bdae884e94461a2ef0b2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686108619, "uuid": "de866c64-5ca7-4d7f-8ea7-ed2d0385d592", "comment": "Malware payload (RedLineStealer)", "value": "3cafbdaee3513fe2789f35f779778aa2fd3a8200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686108619, "uuid": "747288de-3422-4f41-9705-0d1fb9db5429", "comment": "Malware payload (RedLineStealer)", "value": "9b93985fafaa5a3092ca119915a41a06bb4ea388034f7afc12217eb092d4056a8e499bb8bb652b58530efb0009da7d59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686108619, "uuid": "2320b824-a190-4a01-b1d8-e8b789bd86df", "value": "T1778733732A81FCF1DDE60B36EE972D060C80F9B70A5C14D9DC961A920263D696FB9D70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686108619, "uuid": "fa114a30-1fda-47b3-ace4-92ae9d5cecb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686108619, "uuid": "ca1ba3d1-40ac-4038-bb97-5bd32085650b", "value": "393216:jmxpFg4ipI2e06dBbVIXFQTxFYsb1Gj4xCiokXtPh0zmQqJVqVC1i028c3wlod03:R4iW2Ybv1sWoNmQmYVC1i02JgXC3z6fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686108619, "uuid": "6bc13b81-615e-4834-9aad-7f73b97afaa9", "value": 36040456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686108619, "uuid": "dfb691a8-3de0-49d7-bf08-86e4026a00d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686108619, "uuid": "cf8dbcc2-7829-48c1-97bb-651f57119fba", "value": "c0aee35d18fef859cdadc9963635bed0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2fe61b-0515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686130059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130059, "uuid": "a02ed5a3-6a25-4860-898a-85f662e9ee81", "comment": "Malware payload (Formbook)", "value": "e7f1724ccbb35d49d7fe3adbeffd161f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130059, "uuid": "fa2204a8-14ef-4a0f-b5ba-6e6e624831ff", "comment": "Malware payload (Formbook)", "value": "fb9e9215deca3e197ebc03f3e84fd2c02fed5cb14ae31c5693dfd7a8727b9443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130059, "uuid": "11b4fd8b-8b1b-43c3-8251-db4816e15e34", "comment": "Malware payload (Formbook)", "value": "2fbe4e683985d358bddc51656fe6d67b35043d9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686130059, "uuid": "c1372ebd-5e11-42c1-99a0-5bb3ceec19a1", "comment": "Malware payload (Formbook)", "value": "81662d0e7f04f45327f45eed7be2ec5d79fb4538984362a4f61fd4552faeb732a22c6ab1ca86aa82192f890a80268e8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130059, "uuid": "3e2bd50d-2088-4bd3-825f-aa599f5f21f9", "value": "T19BF4126876D6C42FC5C70FB94980277466BC07DAF97BDB270C8786F0AB0AF195841B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130059, "uuid": "028fbcb5-1ef5-49ee-a69b-9b7cca7ec84e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130059, "uuid": "2719021f-07d8-4a9f-8e5a-453700eb010a", "value": "12288:iRP2B0xTGlxNqvNu2hZ+nUEsn9ujSkPXjEINck2egMV4fDoR8s6f4GNZhi5yQ610:yPLaVUH999uTvck2egMHR8s6f4GNy5yW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686130059, "uuid": "0289192e-62ab-4029-8549-f633d372d793", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686130059, "uuid": "9453e216-e0e6-42ff-9f84-b1006271f28d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686130059, "uuid": "4a1f566d-ad4e-4ba1-8f22-c49ac0574276", "value": "Quotation-pdf-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ecd44c-0543-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686149885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149885, "uuid": "396d39eb-1e84-46c2-8631-3257c0cd88cf", "comment": "Malware payload (Mirai)", "value": "f818720f425deb191b597816ce46a2c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149885, "uuid": "2c336ec9-204a-4339-93e8-4e4883223c78", "comment": "Malware payload (Mirai)", "value": "fc11e1af56578018ed1ed5e85574980844b910cdc1a4f78e54c3ccad88b64955", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149885, "uuid": "1c98b1de-64f2-4441-8c44-594e5d1dbf3a", "comment": "Malware payload (Mirai)", "value": "79d8aee03b5d40754323fcbf99af7956eab401d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686149885, "uuid": "cb783baa-41d2-4d38-876d-d4e4d0cd372b", "comment": "Malware payload (Mirai)", "value": "a2e3448c4688af237b225b7aa983b10cb199e54c30cbbbdee6aeb0a926ccafd7f7c646500ae2353a5cc200ff285b8a28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149885, "uuid": "fcd97eb8-8d4e-4eaf-ba5a-595f4bef03d3", "value": "T15492D171E4DA02CFD7A081FF9DA03791B795B624538EC5E11661FC3947C3123A74A662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149885, "uuid": "72bec040-3a44-4f4f-a9fd-2af90f61ca27", "value": "384:MfZdt0cj0aTvK3OUeMHnz2KGnffsN6ctWo0qE0VqXTGKk:Sh0cjxC38MHtGnwdWoSd6Kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686149885, "uuid": "5db2c93c-b7f0-446a-adeb-f9ff2e4ed507", "value": 19428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686149885, "uuid": "b2ce6a88-65b3-440e-b3a6-056da8db03d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686149885, "uuid": "93620849-155a-46d1-8895-8a10985ff725", "value": "f818720f425deb191b597816ce46a2c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1bb54f-0553-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686156881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156881, "uuid": "221d4dd5-1206-4d19-adf4-470b42c12182", "comment": "Malware payload (AgentTesla)", "value": "005c45c7069070fe6ad1f112a16f135c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156881, "uuid": "14561dc7-a406-49d5-a7d7-2af08274e050", "comment": "Malware payload (AgentTesla)", "value": "fd987d623939a8b69f25a2b8350fb6e76a51e77545add40658fc60f00950d625", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156881, "uuid": "c1658c76-ddb4-42af-9f0d-ef1826fa9b10", "comment": "Malware payload (AgentTesla)", "value": "a023833da6bc0ecbaa674be65bdfd75b0df7b9bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686156881, "uuid": "34e04f69-b6b1-417a-ab6c-dffe61cb4bd0", "comment": "Malware payload (AgentTesla)", "value": "806be308316e6c0d037c767dd6f5c32a81305c76db9ab030220eb552d1ec8443bc964877fce4360a790eb954740857a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156881, "uuid": "ad9499bb-9561-4a04-9b6b-80bcb4982dcd", "value": "T1E7F4122C2DB8AD56E1E5C7B194F172667121B83E36CF2D1F55867F4680B3A4334A322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156881, "uuid": "56ee5df1-a7a8-4719-ba21-1640ea62e4d7", "value": "ea06f0ebd05782e9caa4e3157d406e08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156881, "uuid": "497f7fe2-d692-47b3-a3b7-f8533c78bfe8", "value": "12288:5XiGDGvPSL84r6h7okw3DmKyhouWMNR5ZcnFzFJ+RsuDv5YQVqsjKx:5XvDGCLbr6h73klHuZ2nFf+RJvuQF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686156881, "uuid": "25a20a20-6b84-475c-acac-9f32dd1a539b", "value": 752178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686156881, "uuid": "c5d0c5de-d768-474a-b7a7-1f7fa574618f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686156881, "uuid": "abd6394b-11b0-4114-9a73-3a69adf6bc76", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633068da-04ee-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686113240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686113240, "uuid": "40eb2997-434d-4e55-9a97-e4d57e5db667", "comment": "Malware payload (RemcosRAT)", "value": "a82d5070b20af38ed372d74774a661b8", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686113240, "uuid": "e8802340-a81d-40a0-9070-a7cd20609bd4", "comment": "Malware payload (RemcosRAT)", "value": "fde8dca9b93f9c9df67d9a2698d73f1b5ae098a5cdc6c0f3e92b267d3b78dd18", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686113240, "uuid": "eb801b5e-45a7-4b4a-910d-880e119ff35d", "comment": "Malware payload (RemcosRAT)", "value": "5899cb279cec496199115377ecfc5fcf0f1c83c7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686113240, "uuid": "2dc1be8f-094a-4800-9037-a8551dfcf4b9", "comment": "Malware payload (RemcosRAT)", "value": "ce8c1e46bcae5cfa142ef8666613b9ba65302d0c1eebd433648cd8936da4721582768bdd926a6248827d7fae7df4c131", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686113240, "uuid": "6c6b8a54-b6ef-4250-9147-3c2d06f67fd3", "value": "T176C2F8565B8C4C61E369E8BB865DA00E19BCF23A31C205E4BDDDE2703B7D54E0B671B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686113240, "uuid": "db824ed0-e0be-4ae9-9af4-20bd8d08fe5a", "value": "768:+fSBg3DjzXWWoafmz/W9LjPy2/CMv5rfFYU2Q75:+fSBgTPl/++ZDygCMtfFYTQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686113240, "uuid": "8551604a-985e-4d13-abe5-102a44f235d8", "value": 28023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686113240, "uuid": "ba3533c3-5da2-4515-a7c6-da9a56813778", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686113240, "uuid": "74967ab9-3ec3-4e99-b4ce-feeb155c43b0", "value": "a82d5070b20af38ed372d74774a661b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3122f1cd-052a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686138926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138926, "uuid": "fc9f7919-9161-4afd-ab50-90f5eba45e9b", "comment": "Malware payload (Amadey)", "value": "bfe358b5bbabe51bbd172824345341b5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138926, "uuid": "73d1898b-6e37-4a1b-8c48-bb362bebf234", "comment": "Malware payload (Amadey)", "value": "fded058364123d92c811a25d681af0d8ad73297d1be1e2f215bc41818dda7fd4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138926, "uuid": "e1e347b1-98df-4972-9d71-1ca18cf450c6", "comment": "Malware payload (Amadey)", "value": "0220803c3f08f73afda81c91e0377d08eed02d0d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686138926, "uuid": "664d0861-5a3b-4249-bcbe-4bc3637ccee9", "comment": "Malware payload (Amadey)", "value": "7c0a15666d23f6ccc68fd73c8038ddf58f9e55ef28f84def6b04df01d353e009c107d09a0d5250ac52c132e267d50bc6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138926, "uuid": "7dbba697-99f2-4f9f-8e80-d85fb65ccfaf", "value": "T1B1F41252BAE850B3E8B5677109FB03930B39BD919DB8875F23460D9D28B36C0A47177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138926, "uuid": "8181281c-d01a-482a-bc67-edaca1ebbd5f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138926, "uuid": "15919ff8-6770-449d-9c7c-fe761bd846e0", "value": "12288:jMrky90J2RSBA34l4wGZaH7BCVyhWY3VNAqi+KtdN18hw889nXxCIcYDg:nyK784l4wGt3Y3VNsN+89XxUwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686138926, "uuid": "3805e6fd-85de-4f98-93d9-538c43d44fa5", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686138926, "uuid": "d64e45aa-69ba-4b9d-9a5a-21479fe2bbb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686138926, "uuid": "1ea6c3a8-1714-484e-b592-5f10fadd9554", "value": "bfe358b5bbabe51bbd172824345341b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068eed44-051c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686132842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132842, "uuid": "b6ffb5a3-1977-4a78-b3e8-168a1d672ef8", "comment": "Malware payload (Mirai)", "value": "48fcf8fe856a0d0ead9614d309db0bd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132842, "uuid": "01fb7609-1a04-4479-85d6-6e7fb6918209", "comment": "Malware payload (Mirai)", "value": "fdf7a6174d2b1d58b7a2644bf9c8be801b71c746444dad801f5d93f54bf54634", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132842, "uuid": "72243cd0-5cf2-4dc6-9539-128d4f36cb45", "comment": "Malware payload (Mirai)", "value": "bf12a205aca32dcf4e918129d2459737cbe53964", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686132842, "uuid": "5f51c93e-b783-468f-93b0-028d3e47809e", "comment": "Malware payload (Mirai)", "value": "a316253b5af8624381b59c547c6564047b461968506244fd2eb5301e4f44ea109ec932b952c8de68f6c98a7a5afdc3db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132842, "uuid": "86621d8e-fe29-4a6f-9f39-a699b43bcd54", "value": "T106C2D0E07B26FD31C4206C3DE52A4D8A3A51167C90FF393664258D39CFC165B67E84A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132842, "uuid": "9a92b178-0301-4390-9492-3fcbc9a88f5b", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwr09q3UELur:NKy4qfqoeJdXWgdLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686132842, "uuid": "5abd92a0-ef64-47d8-81cb-2560529da7da", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686132842, "uuid": "c6714320-9f4d-4027-ac04-7e859b0175a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686132842, "uuid": "323e3a72-9cf0-49a3-8971-7c55d2b3113c", "value": "48fcf8fe856a0d0ead9614d309db0bd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff55b73-0527-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686137582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137582, "uuid": "71dcefea-6a4e-4973-9032-c4da09a4187c", "comment": "Malware payload", "value": "a616a01aa85b33741b039714b9ee6102", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137582, "uuid": "93723380-e42a-4794-a7fc-fef8f3487a3b", "comment": "Malware payload", "value": "ffed0ffe92228ecf228df94943cb411c4e2e20cc9f28a58f3936cbb142104fe6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137582, "uuid": "8d02275c-e80a-4668-9a7d-f1e4a86e88cc", "comment": "Malware payload", "value": "819a29de2994fb57bb737ef2c49e17d493e6754d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686137582, "uuid": "66576ac0-5485-4540-b3ed-d9320deeb736", "comment": "Malware payload", "value": "8054ae850d773be239b71f7dd8e44eb66e46ae07ec978d9534acfa2c326be2b422f8b77c4429891b25c05be047fff98b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137582, "uuid": "f7e56841-7410-4d3f-915e-97acccf6157e", "value": "T12EB3122EB538DBF3E7E08D98241C85C71F4EEBF827A5C44118C7AD04EAA4A25E1162D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137582, "uuid": "b2c97f69-7c5d-4110-afbc-60a3bf29266a", "value": "3072:Iqktvg+gjpgZxwj8F4gZVmXpuEFJKEbgbcyJovR:YvIxj85y1FkEMwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686137582, "uuid": "c671875e-7ffa-49b6-ae15-1583652c925c", "value": 114536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686137582, "uuid": "7fd8a99e-4733-4f09-994b-64c241b1d70c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686137582, "uuid": "1fdcd4aa-e853-47c9-af36-6de552ab3102", "value": "printouts of outstanding as of 20230606.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }