{ "Event": { "published": true, "date": "2022-02-15", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-02-15", "timestamp": 1644969782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "83aced58-54a8-4b09-9337-94556652d11a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200025a1-8dfd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644887884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644887884, "uuid": "1d6e90be-0854-44e1-94a3-bea7d4d0d575", "comment": "Malware payload (AgentTesla)", "value": "b83b62a712ccb98d0ab88316a0163243", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644887884, "uuid": "0c732dff-d2de-4f7e-b48f-cd470ace9de1", "comment": "Malware payload (AgentTesla)", "value": "008e824dccee812bd491f58e3133eae9d557fd58e4feb60d30a766c0a283ae8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644887884, "uuid": "01750d43-6814-4aad-a06a-26e71863657b", "comment": "Malware payload (AgentTesla)", "value": "0dc99adc20f9adb39e17c4174a8fde0ee1393900", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644887884, "uuid": "6d47f90d-aed1-4b19-8702-3870c910032e", "comment": "Malware payload (AgentTesla)", "value": "b6f8bdef2eb39d6b262c4f00003409defbd25df510c69df6f0310d26a1b22df478966c4feee25338dc85e585be8fc41a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644887884, "uuid": "cb59395a-9836-45d9-adde-5e008d1e6449", "value": "T1CFE4AD2A02F3D8B1CD5B89FEE521C58C6F60EA2FB442FEF98845D4BDD06C3914256963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644887884, "uuid": "e7f47c36-7a4b-4951-8405-5667cba5b37a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644887884, "uuid": "efe39f46-cced-4b72-ba25-454546018681", "value": "12288:erasV4A4L1caNYfA7wKmBlyOvW6X/jw397m:fscL1caSIEKmBli6rwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644887884, "uuid": "390afd16-45a1-4b4c-956e-6b83c786f8dc", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644887884, "uuid": "a2d90f0e-eaa9-4e40-8f4f-d636d2df4db5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644887884, "uuid": "83854c03-6042-4d02-b0c7-25b6749cda67", "value": "Wire Transfer Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4def89-8e57-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644926532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926532, "uuid": "0379d1fe-3d60-4792-bad2-71a4747f9f4a", "comment": "Malware payload (AgentTesla)", "value": "7fb343f86202ed56c1b74eb766d0e305", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926532, "uuid": "99bbf204-4d42-46f0-b154-e9d064feaeb0", "comment": "Malware payload (AgentTesla)", "value": "00ccda8bbf6cfae14c4c80ddfb407e33ba27ed85baba3a97f34d7d02bcd5e429", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926532, "uuid": "ad88b851-81c1-4a5a-8864-a07b2a8e3501", "comment": "Malware payload (AgentTesla)", "value": "186f969ed7ab5914dc6f564563736a1fa58fa27c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926532, "uuid": "890078db-6264-493a-aff0-de04d171343a", "comment": "Malware payload (AgentTesla)", "value": "1a9dc3d409c32fa88c2e0283e4b3b4845acc50f3b7e822fa70e445c9475c407b19eb003a7808044d383ab72abb408ffb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926532, "uuid": "9db6de29-f487-441d-82d4-ddbf51d67575", "value": "T1F21402186D17CD0CD467DF3C7EB59EAA0651EC70B61EC25E3A8ABF3E2236D8509E0650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926532, "uuid": "49253474-7e0d-4a65-a7c1-7bc99b05838c", "value": "3072:o+icd7DBROn1RLKvA9LUMDqGTtqNfF+EHHWI1kZKsX8+P0Hg01d:zJdXBon1RLNLUzsufpH3xsXGA0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644926532, "uuid": "2255d9a4-72e4-45d2-8fd3-c1c1b1a18217", "value": 192040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644926532, "uuid": "b7f80f91-f829-4cca-b529-b929199dbf7c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926532, "uuid": "9fff1e35-cad6-4e19-8373-b72f8fc9f10e", "value": "Product_List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c786d716-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644953019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953019, "uuid": "924ddd53-f5cb-49c8-a2f6-9667f3a4c558", "comment": "Malware payload (Formbook)", "value": "7b1c7b65a53d3e357c67dc997d3677ac", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953019, "uuid": "db53d987-f44c-460a-82a8-623258e68659", "comment": "Malware payload (Formbook)", "value": "00e776065301f57e15e079693b9ef383b730540442e3316599538c095633cd83", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953019, "uuid": "98a38eeb-5d99-4d2f-b07e-86dd4b17d53f", "comment": "Malware payload (Formbook)", "value": "a5347c6cde94cee7efa6007c472b7d1675b6ff32", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953019, "uuid": "dc1a326a-6141-4a67-a95a-631ab1699a65", "comment": "Malware payload (Formbook)", "value": "93b37ebc90dfb6418631fd196fe080da1d04fe790a7b4f7917f2059b9832cbf6d4adcfdb386b3eba286064188a72233b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953019, "uuid": "8656e89a-4846-457f-a427-403e705f821f", "value": "T1AF14125B7B8DB0B1C5E0233ABA5CDBECA593EF37DB18904508513B3FA5B86955A0C207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953019, "uuid": "da2fadb0-96ef-46c7-9450-426bb955e8c8", "value": "3072:5t3JXsdEG//LU89HfMjZyGfG7ZZ67QD/v2hmbYJGAJ97RLLDFpG3bW1ce:b3JXsdpNfogiGO7Qb2Q8JGAJnvmbs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953019, "uuid": "d1550e84-8e4e-4896-a87c-acf6c9710a9b", "value": 191720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953019, "uuid": "d895ca77-ac3b-4663-aa60-146f892bb459", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953019, "uuid": "6ef8801a-6fd8-46a2-b887-1505d23227d5", "value": "NEW PO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5ff722-8e45-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644919020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644919020, "uuid": "e9563356-5e6e-43da-81e8-227797a9290f", "comment": "Malware payload", "value": "7e5aad6afb728af28b9bc9f56442509d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644919020, "uuid": "2b178fe5-6f84-48b3-8689-6c7e525c3efe", "comment": "Malware payload", "value": "02b06acb113c31f5a2ac9c99f9614e0fab0f78afc5ae872e46bae139c2c9b1f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644919020, "uuid": "97191478-8171-4fb7-b30a-506de5cddd25", "comment": "Malware payload", "value": "3c0651d8373375bfea29466ff85bc7f64a8e5e66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644919020, "uuid": "afaebf7b-2cac-490e-a1ba-398b5e84af11", "comment": "Malware payload", "value": "d9eaf121d04440ce8620d8d10aa9abc0bd99583c121f7971c3505e748bd93fde50ebadbd4c8eb821fa273446fa51bfed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644919020, "uuid": "6442b033-5780-4ab5-ae1a-e67598bcdc42", "value": "T140923993FA8A9BA5D72489304C66B1A9D07FF1726F18498BE7920C6E0D3D5E19C3610E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644919020, "uuid": "9795d7f7-5a93-4a8f-aa32-c7963f34b35e", "value": "05b52ed39c6c35deb93da7d639404837", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644919020, "uuid": "f6d4e351-a92b-44c3-a230-348d03f0d285", "value": "384:75itI0HKkbJ/XDlLaFjw5uraaIIZua9lBVuL9pW:75qykb1XDlV5urz0aHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644919020, "uuid": "90748d4a-755b-42ff-8a69-771ba5cc9f3a", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644919020, "uuid": "67c2115e-36a6-41b2-bb7c-919d06fe911f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644919020, "uuid": "82b30aab-48a3-4f13-9f97-b42f76a2e39f", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f903bb-8e83-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644945480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945480, "uuid": "d6f871f0-4f01-4a29-b1cc-a1df8e9e6ab8", "comment": "Malware payload", "value": "fa621efe98c71552f767e4d8e220a30c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945480, "uuid": "7806fb99-bdc3-488c-81da-263def408219", "comment": "Malware payload", "value": "035b98ab281fee9959fee80703e4464fbb09f9b770c433312c2d38983870217e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945480, "uuid": "8577480a-269f-4134-90e4-cd63d936839b", "comment": "Malware payload", "value": "96884d1e5f7f231030c1f4322df4e2d538c57641", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945480, "uuid": "f8e01dee-045b-4c5e-999e-f969a0565597", "comment": "Malware payload", "value": "7c26d2a66338420db4954ef7a5909f927b7122888ea9b5829bc235f8855afb7a86ee0dffdc8ca4f57c159fd81f13efee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945480, "uuid": "8231754f-ba6e-440a-8604-b4cfdc161efd", "value": "T195A46FA2B7D4AEA6DD0A42745A87876733B1EC705B53D3077A98333E1E733C41D62A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945480, "uuid": "c456a520-ea00-4e98-8c49-d056952b5c0b", "value": "768:osJBzsYv4tmAbg/Ra7LRjNY/HqGjXsHcnV/CgROA856dQqdAgtHGt4D/KujbnV/2:/JrCmJOYdpAghGt4DKKbssl5tb3AZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644945480, "uuid": "b752dfae-1f1d-4117-9937-279d382b9e06", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644945480, "uuid": "ee16fa53-c496-4936-9d6a-8c328be5ce50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945480, "uuid": "447ba2bb-ee29-43b8-ba4e-89ad6c5b558c", "value": "WAXA83A.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e0e89a-8eb2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644965787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644965787, "uuid": "44bcb831-725c-4e47-9a82-a3b1da14c791", "comment": "Malware payload", "value": "70b5c5f125b2fb587704821b23cac9eb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644965787, "uuid": "753e67f3-300b-409d-9dd0-726f10cde4bc", "comment": "Malware payload", "value": "041b03d0e1d7909c31e190b39e7852b6f93369dbbfa0eafdfa71212ea9cdb199", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644965787, "uuid": "b23f84df-b739-4209-a820-d646185bbd02", "comment": "Malware payload", "value": "a79116af94eef12df71d3e7a103e1603260837b0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644965787, "uuid": "14fedbda-82eb-41a8-9c97-6fbf0a2d34ad", "comment": "Malware payload", "value": "bd8dcd3c904699a16ac749a4ef6c066a92ef54c6e0f93e9d70df7943fe022feb421b9e3987fffc783c292f2acce93940", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644965787, "uuid": "8eb477cf-5f15-404e-b4aa-4a753fa4b504", "value": "T15224221FE98A110E7D0533F385DFDC6108A57C1D1BB44F452B9B1A078DEA6A90E7A2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644965787, "uuid": "75c6d258-f5fd-4451-9933-e668586d313c", "value": "6144:rjCQQb3dFH/X04qoeDdr/3mlq3033NsLh:rjCQQb3dt/K3DR3mlq3039Gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644965787, "uuid": "843ffe60-27bf-41c4-beef-bc284d73f6b9", "value": 213395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644965787, "uuid": "52a17650-c0e5-48bb-bdbe-380796acaaeb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644965787, "uuid": "a9e9f074-a251-405d-a68c-97e33ae13fc8", "value": "mimvutauoraoatppestsoiletusbuu-to-sql.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9912cf-8e60-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644930746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930746, "uuid": "a559ccf6-84c1-4069-a9b7-bad1db5adb07", "comment": "Malware payload (Formbook)", "value": "d3a7d68573e550afef3c0b778c9050a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930746, "uuid": "c30d5b7f-b84f-490c-96a9-e7f3647e578f", "comment": "Malware payload (Formbook)", "value": "05b6c2741d33e6b3a06eb63ddfb99d41f35463761a1d36fef5b408c36bf45637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930746, "uuid": "0280e066-0c39-4c67-b835-dbc539b364e4", "comment": "Malware payload (Formbook)", "value": "4a22ffa4793333ed8e286272aa9907bf1d5537b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930746, "uuid": "f0f8bb3c-a7cd-474e-9e59-e46f75ace4d0", "comment": "Malware payload (Formbook)", "value": "9141bf33578cba6437553256c6fe4844e87ddbd92d4e879aee19791afe443d2a07baa71c6b840de7b7494cba9f5e1892", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930746, "uuid": "c3109413-3f37-4ebd-bc56-a12a1d1773fd", "value": "T168F4014177B73B84D0365BFA50B194862BB9B59D1022D23D8DA724CD0C62791CEBFA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930746, "uuid": "23833aca-2119-454f-98da-880a2506a5e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930746, "uuid": "c455aab8-b382-4752-9038-1018d9638ec2", "value": "12288:CML5k+yMC6Sqj7+h/Nh3DSGicMT/wXufZDCFT1QhAvZdcxyqUGpUHOuYGlhz:lLavt6u/NhqYeRWZ1QhNEXG/+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644930746, "uuid": "5623798a-03c3-4bdb-b9ab-34891bbba7a0", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644930746, "uuid": "49370222-aa61-4e50-8ddf-fe035a67fed3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930746, "uuid": "778782d9-a24b-4a21-a5ee-8faa2af976cb", "value": "OszQV1HEQJLo5FM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdddea66-8df4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884283, "uuid": "a75b211b-626a-440f-9e7f-7ef40aa78e4a", "comment": "Malware payload (Mirai)", "value": "5a953d1c2d1c7369a49ffee18f490f00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884283, "uuid": "b76ae747-51f6-4e66-9181-c329ad4fffe2", "comment": "Malware payload (Mirai)", "value": "0619b86b6707c97febaae11d75f783ec4b32e88f83f5d55761a0d04f92bea42e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884283, "uuid": "37fb3fee-276b-4cf5-aaac-1546c2b2e220", "comment": "Malware payload (Mirai)", "value": "4b2abc7346fc5293fe373733bd466b8c9e0d1715", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884283, "uuid": "0e73362d-a50d-4a99-b3f1-7dd0946371d1", "comment": "Malware payload (Mirai)", "value": "f28aa38f10fd41c24766fc9ce634088d7d08f307eb953f4d323434c4dc93643b822c0fd9a3ce498dc95e97d1d3b917d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884283, "uuid": "f74da8ab-5ea3-4a18-b95f-8faa1ec53481", "value": "T1FB23B84A2E668FECFB98873587B39E21974833A227A1D544E15CDE005E6034E741FFAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884283, "uuid": "8dda8c8e-e9f2-4719-8d9c-032a4e2dc342", "value": "768:4cJn+QAAHFGf0How8HoYN1jSPI39S5IpVLjltNSyBzb3:7nnAAHFGfc0OIpVvlXzb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884283, "uuid": "4cf2c878-cb44-48fa-8db0-268bce0e280b", "value": 46792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884283, "uuid": "baa5d0f2-acc0-40ae-bfc3-494e2305371b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884283, "uuid": "b3a42318-78cb-4506-b2f0-ada4cee7fd96", "value": "mizakotropistaps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0669859-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644931962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931962, "uuid": "dd67985f-9437-438c-a9f2-a69aa508a8e1", "comment": "Malware payload", "value": "d3690a65cdaf9bf2b051d4d7c4010cff", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931962, "uuid": "6ecd1ff7-3f3a-4d4d-ba9b-dfbd535be2c8", "comment": "Malware payload", "value": "06c51c13f73031e577e21c7bc3f54c045c1c8429d398e10e94a0f437f1b5c922", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931962, "uuid": "95e5051a-4b5c-4496-bdb9-71e8d71ebcc2", "comment": "Malware payload", "value": "82d4b26af8b58ead1aed075c94849d6a5d631832", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931962, "uuid": "ebef291d-64c1-4ce5-adf1-2c6894efc118", "comment": "Malware payload", "value": "eb181d5409f96505b8b52c1c1e9d5df36fdf1bb9013e0c2832fc158ff01808be882a5c4e749f65754fd0251b4165b877", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931962, "uuid": "4d9d2c62-a20b-4c41-8390-244728d2d6ec", "value": "T14D531AF756176D8F86670E45E50C1300ECDDA8BBF3D990E4BF4A4AE689A54188CA0DFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931962, "uuid": "d48eb35e-86d7-44ac-a61f-982521fc3830", "value": "1536:YD6E9Gth/xYtIz3A2Lu9euZXEf7ER8AlUZqRCB:YD6E2h+Iz3gVZXEf28bpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931962, "uuid": "ee6e0f7b-1e09-4448-8da6-d15a9520025a", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931962, "uuid": "47f21a47-1334-424f-a102-46c592f275da", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931962, "uuid": "e41429eb-5cc8-49db-80f8-e8a293422760", "value": "asy-amarre.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb71d0fd-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644953079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953079, "uuid": "90147ab5-b3c9-497b-893b-359334de86d1", "comment": "Malware payload (Formbook)", "value": "03fe2e5b5e59253d0815b2e121fa1e30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953079, "uuid": "303ad9c2-164e-46d9-a273-db91e2ee0471", "comment": "Malware payload (Formbook)", "value": "08e2b0e469f2809991e59e65177fe994f3aeeea601a2af8aec6c7ae1406debb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953079, "uuid": "c27dab84-488c-447a-a124-31bcc25d3bdf", "comment": "Malware payload (Formbook)", "value": "eed9bbbb504bf208449c764fece9ccec3f23e771", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953079, "uuid": "73650c9c-0f27-445e-ad1a-d3d5520f6dda", "comment": "Malware payload (Formbook)", "value": "60dfc6e307f7700c99685285221918a6b3c4275f4c93ae015d65bd0f449e7c12608022900de54e764df817b275e43fcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953079, "uuid": "4309923d-73c1-4261-956d-ad87384d01df", "value": "T17FF48C6185FBCCBADC6704BEA02085881E61EE5B7643FFF99448F87DD8387816686437", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953079, "uuid": "8422a83f-ed05-4931-8867-2188eadc356b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953079, "uuid": "06088227-64fa-455e-88bc-37481b7328dc", "value": "12288:5e1asVKmZvTSuME6AUMPGGihI34tVThM:LsfZvTSEV2a8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953079, "uuid": "e4622c1f-1f7f-4562-a44d-dfa128f5dffc", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953079, "uuid": "6da6545f-0e99-4a17-a68c-3f8cfa193ef4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953079, "uuid": "b89e5e41-82e1-4be5-ada7-db588278d303", "value": "TNT Original Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8886edd1-8e05-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644891495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644891495, "uuid": "0b210583-9c80-4fb7-b6a5-df74eb8773b3", "comment": "Malware payload (AgentTesla)", "value": "5ca4f7f788181c3d75ef7ecb15b04728", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644891495, "uuid": "ee0182ff-a0a0-4f4e-bc4b-b0b51398c486", "comment": "Malware payload (AgentTesla)", "value": "0a64c72dadf7b8dc0de59c9a26986e7ef924b6b718b417c0f237d9f3cd3e7afe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644891495, "uuid": "b4f9c5dc-122b-46d4-bbf6-0344c5aca100", "comment": "Malware payload (AgentTesla)", "value": "e0b700eb65346d80cad62902306a65f7ca6b8e90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644891495, "uuid": "f0b2f681-e6d8-4924-81a2-6b7ff2efcaad", "comment": "Malware payload (AgentTesla)", "value": "53b0d9fe5ea16fdf2f99ee671e7b50f55814b000c1b406987cade2bb4a1bb6e000da807426595ba75ea9ab996e9449bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644891495, "uuid": "b6850a6b-fd31-428b-a9e7-1398f6bcad2a", "value": "T19AE49C2A41F7D8B1DD5B86FFE461C98C6F60E92FB002FEFA8444E4BDD06C6914646863", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644891495, "uuid": "62dd0dc7-6de0-4c73-bf7b-8418856edbfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644891495, "uuid": "7e92cea4-0e7c-48db-a85c-f7ec23c77059", "value": "6144:wKqnnasZHv/WnhkbzaGM2YfV+NQ0SNsmXGxxJfJFSLBxRh5RHM1XAVZEvsY:7MasV/WnCbBVE+y0SLs5Sph5dM16qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644891495, "uuid": "8e951288-5d52-46d6-aea3-549c0c4fafb0", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644891495, "uuid": "4d76036b-402b-4d1c-b2cd-773fbfd4b6e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644891495, "uuid": "409dd6f5-7279-4d5c-8fd2-589f33cd6d7e", "value": "INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498e6a4f-8e27-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644905993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905993, "uuid": "1ba9b51b-e79f-48a8-9b31-06788ffc21bb", "comment": "Malware payload", "value": "189811e62a8e8ec2202c03d01aa8dec7", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905993, "uuid": "52eea0af-a7e0-4f66-bdf5-caf183c443af", "comment": "Malware payload", "value": "0a8966f86076b8dca38cb987124681d11b354a1c27c30041e950e686f0261d1c", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905993, "uuid": "570ff2c3-682b-4521-804f-720032f1046e", "comment": "Malware payload", "value": "76613dce080983d9f369b893e656eb274bc27658", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905993, "uuid": "7f0a4fa3-25aa-462b-8ace-65bcfe56ca07", "comment": "Malware payload", "value": "e05bbaa59e88b0b97155024a746d204ba19f61a5e5be8e832d86385c08b12f80d05131281e4f25afd5277140834c668d", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905993, "uuid": "250834ee-b757-4e93-b92d-04c601c67700", "value": "T1C0D21A730D82BCE92F7E0D46E64A69C00D4F7E5B83649DA8FF89099554E4212DF6F838", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905993, "uuid": "7191f4bd-af04-43de-9137-8325e5e03ef2", "value": "768:bJywV4Nr68GQwAg9UA4WGA+PHyq0Bq/3RBv4Hf:VywV4Nr49uHyqzRBvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644905993, "uuid": "0e036eee-83e8-4614-821a-54b0f764cf8b", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644905993, "uuid": "c789fadf-137a-4f2f-b84c-05295b7a8831", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905993, "uuid": "a9197c26-9455-4de8-957c-5bcc6cfce774", "value": "trebol.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7c87d4-8df6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884850, "uuid": "0d19d2ef-643f-435f-86aa-20d06bab1ff8", "comment": "Malware payload (Mirai)", "value": "2ced8dc2846fbde5eaa0e2b94359448d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884850, "uuid": "a3bc7e88-8585-45ca-b26e-45ae3d09176d", "comment": "Malware payload (Mirai)", "value": "0b6e70639363fed50a6fabced56845414663b4d4cc4e30f1ce51de0aa0e39753", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884850, "uuid": "970cb7c1-f88b-4190-bd55-b4a218bb6c48", "comment": "Malware payload (Mirai)", "value": "446af8a2243223966df5326d689f02ad3aacc8b0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884850, "uuid": "4b4f4228-dcc1-4052-a933-e16880c6ac70", "comment": "Malware payload (Mirai)", "value": "02f1b2ecc23d8374ffc5d8159f39b1770c82ba1f023b01a0cf10d369c9944b5edfda0dbf2fe8ea629cdc2fab5864204d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884850, "uuid": "592d1933-3b74-4f42-971b-7644dde8debf", "value": "T1B7931885B8C19A12CAE4237AF56E00CE371063E8D2DF7217DD211F6477DA82F0DA7A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884850, "uuid": "3f1612e1-fe57-4d90-bc96-aa6ace2f40dd", "value": "1536:1yJJtQg/AWjEcog9VNfmSLaU5v1RrVD1pSmt46D2j9YvQEH7:1y3tQgoWjE4HFpFbD2j9Y/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884850, "uuid": "deee07d7-0f66-4b8d-b3af-b062add98010", "value": 91132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884850, "uuid": "c51f4ebd-61ea-4f78-b277-a772ae3862ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884850, "uuid": "a00f4f49-3738-4deb-99e1-b85f8b6b5e5b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5583399c-8e19-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644900000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644900000, "uuid": "cd11087e-3bc7-470b-bfe7-5a5dc972e697", "comment": "Malware payload (Formbook)", "value": "0ea6abad79e4fa1387c4fac485b71a9c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644900000, "uuid": "788e0b17-c633-44c1-8729-f8c2b2078a41", "comment": "Malware payload (Formbook)", "value": "0c027a844f31d694cfd90e8538a752272857136deda18a00ad60a161cb694b28", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644900000, "uuid": "36f9f773-c2d8-4196-8ce9-fc28d6a1e981", "comment": "Malware payload (Formbook)", "value": "68a09c0fadbf67f4ef284cd878b0dda19b1982ca", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644900000, "uuid": "ef671bb5-cd56-4acf-aaa9-9e35e238d7e1", "comment": "Malware payload (Formbook)", "value": "ec4a5f4288c7b6e6fb480f7b40caf655751aad212216891ba434af838ddfad2e18a6b6e90000e3019dc398d9f4c0c963", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644900000, "uuid": "54f50f5f-031b-4c5c-a8d5-7c546b3c45a8", "value": "T1E7E4232AE5C0E295F763EE9FD87BF4810D287E860C1914BED709E1E625CA8CF562DC41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644900000, "uuid": "21b427f5-a7f9-43e7-8233-8b721fc8cb68", "value": "12288:qLP2AKAX1hzWefqxqxZ/HpZcUlTk5IhhIf0LebcG+MlQ/lGedwpRp8BlS6uSJW2:GDKAXHWefvxZ/HwUlTcIhhk0LeovAQ/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644900000, "uuid": "60a77bc0-6c10-433e-9887-4610b539203d", "value": 703553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644900000, "uuid": "23125b66-9641-4a75-b026-9109e0080295", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644900000, "uuid": "7f5735b3-b6f3-4928-bf79-5f249dfc58e1", "value": "1644895061.Vfc11Ib6aff7M673565.dynamene_INV02746799.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08c3685-8df4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884288, "uuid": "f4a26acf-485f-49a5-9716-b8a39243a016", "comment": "Malware payload (Mirai)", "value": "da39d1e40f933713a2cc1a6c73c97d02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884288, "uuid": "b8298cc4-a314-4d53-8fbc-7cf7739ed0f5", "comment": "Malware payload (Mirai)", "value": "0e722a9c17bebf1a84754e4cef108a38cde9763749596d5a4672697ab68eaf67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884288, "uuid": "a2567d38-e82a-48a3-9df3-72a3350fddf1", "comment": "Malware payload (Mirai)", "value": "2fd74ef66eb7fed5e42a20585c5181d78512bfcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884288, "uuid": "faec94ca-05f8-4bd8-9d21-1b038e4b555f", "comment": "Malware payload (Mirai)", "value": "37dcbd052d70c5966a635a99f88532eaa56e67fd97728a3a5e47b3d13effcbff7547cb01676a0e4830882e0232498382", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884288, "uuid": "f5439ef9-f115-400a-bb14-8e30dce4679b", "value": "T13A23C516BF614FFBDC6FDD3749A9270524CD641A21A53B3A2E30C868B64B21F19F3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884288, "uuid": "d64ea304-5fe9-477b-9e31-295036cc5026", "value": "768:dVD2K2d0BYAFhfpD08cLeet1e0enPeKYnYHXi1V87IZ:3D2K2d0BJFT6dePb3GVTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884288, "uuid": "ff319ed2-169d-4094-bd6b-35849aa84927", "value": 47784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884288, "uuid": "00ce87bd-e9d8-474d-88f6-e23ba0360593", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884288, "uuid": "aac6aae6-8b16-4653-9f26-8ba521a31190", "value": "mizakotropistasl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2043496e-8eb2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644965623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644965623, "uuid": "86eb6ced-0d19-49bf-b9d2-6f94a91ca489", "comment": "Malware payload (AgentTesla)", "value": "e025ac2e6170ac5cf6a7110c75c39d69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644965623, "uuid": "d0bcc9cb-c03d-4507-b1f8-31d65370afa4", "comment": "Malware payload (AgentTesla)", "value": "0ee473632d22c09b5a9425802907d62606daf9ae63cbc884d4b75ab8ae528bf4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644965623, "uuid": "1540f4fe-951e-474e-a2c8-edaefdfe9660", "comment": "Malware payload (AgentTesla)", "value": "9ce4102c392b31e4bd9bb9bfc6f12d2683f49164", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644965623, "uuid": "c0271a0e-197e-4c10-99d1-ec532117bcf2", "comment": "Malware payload (AgentTesla)", "value": "abe402e8390e00ab8f86d61e52bd8055f476bd44f8e83c01ef661dbb98bb8d4a1e20b121fa046856e945626939e01cbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644965623, "uuid": "f9fc09d2-5240-4f06-98d0-74be1b8da976", "value": "T1F9051241B723B645D87C17B9B491C0B75BB66A7D7313EB7A4CE272CC04823E69638632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644965623, "uuid": "8b1a64b0-c1b1-42bc-95ab-82db4969a6c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644965623, "uuid": "49a52a7b-3a76-43c3-b2c1-31430ae96391", "value": "24576:jTGUiQ3x0vx6L5HG8VmpRWCN90jq6/IzK:diyGtDWE9E/Iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644965623, "uuid": "2625b25d-46b8-44c6-b5f2-8405566e8934", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644965623, "uuid": "f913525b-9cb8-44f7-ae38-8b3ad4ada1e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644965623, "uuid": "cf40a22e-9cac-459d-b675-9e324e1d122f", "value": "BUtrhWHBFQMKQlq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0beff803-8e7a-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1644941537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941537, "uuid": "f0cb78bc-c1d8-4061-8f2e-3401ca33ead5", "comment": "Malware payload (CoinMiner)", "value": "a01bddd8861349780a27fbd80decea21", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941537, "uuid": "4ae19649-8e41-43bf-811c-58de5dd6fe97", "comment": "Malware payload (CoinMiner)", "value": "0f0ff53fb22cf1132f91554c9515f57713674a1d60c3dea204fcb7d7976f337a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941537, "uuid": "421a8462-8cc5-4b3e-9788-f94c9f46ab3c", "comment": "Malware payload (CoinMiner)", "value": "dcb7a9958ac22e65f4f8e3580d78e128f4e9b4fc", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941537, "uuid": "a16a602b-b7fb-4914-82f9-ed9d4ee94b19", "comment": "Malware payload (CoinMiner)", "value": "05335fd907cb2e55bed4b04cb0378faaf812013a3259e7664088fc50a5dfa2590ce26edff434114b4af395a26a5dc42f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644941537, "uuid": "54460ff6-037b-429a-91cf-085284e06062", "value": "T104D2D01926AC189AF6385BBF0DD3335A07BEFAD72B12D26E98C0472D2D2174049E4DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644941537, "uuid": "71e5a952-7877-44a7-b135-c871ccbe35fa", "value": "768:m1kJDCTsK6ZSt98pbEy90WxjKz98xF9sh0pX:AVsK1t9I0Wxjq+F9sAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644941537, "uuid": "3b8072a8-d12a-4e2a-b710-e7dba77cf807", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644941537, "uuid": "642b6d17-3250-45d8-82e2-b0048f1fd1dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644941537, "uuid": "a7c860d5-309f-4946-8d29-e648d0fbd2d9", "value": "a01bddd8861349780a27fbd80decea21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5503be6-8ea1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644958652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958652, "uuid": "790c73e6-171f-4259-a5e3-e610add93d2f", "comment": "Malware payload", "value": "9c3a1c90e09adbcd91df603c2fb98c08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958652, "uuid": "04967014-b6b9-4cc6-b2ea-1ba167a884e1", "comment": "Malware payload", "value": "0f46e1c5fdbd54458ef74a762dcdf4e9a9c6caabc843025422ba903236348dfb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958652, "uuid": "4cf64fa4-ed17-4b97-8111-5cb378fbd793", "comment": "Malware payload", "value": "8d8aa78c4039815dcc7211f7e6fb10e1f7913ba1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958652, "uuid": "f47f495f-2cbf-4175-9b40-ed739bc85874", "comment": "Malware payload", "value": "d4245f4129f6da97b195ac57627bb5ae636571f25c10d9e9b7d2aebe5ac179a4dfe1cd588e1c4805b52020280194f79f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958652, "uuid": "5817b4db-e984-4c81-adb6-e2b667bf22fc", "value": "T167F40100B7BB6B40C0361BF998E595851FB1B50E5627D63D8D9274CE1C22BC48B7EA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958652, "uuid": "f4472e06-b952-4e3c-b22e-374c0a298551", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958652, "uuid": "ac5b202e-2695-4146-afe6-90d4cd75fe5c", "value": "12288:ZY5k+AZH6WMXHn2ogC+fGSw/8tHWgb/h97TlOLzs5bWfL9zGVZ4iGF9N:+a1ZaDEC+fE+Hn7/lwmezsm9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644958652, "uuid": "a821da8e-39c4-4e3f-91af-3418d1bcf64b", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644958652, "uuid": "5237bd96-a53e-4613-835d-dfde85491113", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958652, "uuid": "38d0b8bb-2477-44bb-b8ea-172d505086c3", "value": "9c3a1c90e09adbcd91df603c2fb98c08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e0d41c-8e5d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644929095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929095, "uuid": "78c7f2cd-a5b6-4987-a94b-9dfe2145b83d", "comment": "Malware payload (Formbook)", "value": "376f50bcc33f115ff257d0c05ac4ba1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929095, "uuid": "846e90f6-8a79-4af3-8c7e-02376700ed19", "comment": "Malware payload (Formbook)", "value": "0fcfde1ee285a35c722bfdd0b33f08771a26503d4bfc20541726456cf9351af1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929095, "uuid": "adab0055-83b7-41d0-878b-09a98511dfe7", "comment": "Malware payload (Formbook)", "value": "6a81172d13f238b8ca60850870070ce8f3b20488", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929095, "uuid": "40f84c7b-717a-4d49-834f-75f7d02ec7cd", "comment": "Malware payload (Formbook)", "value": "d8d0972240c0293f08b6db3ccdffb2ff89caf499b98cb9bf40b6a8c0b34efe79925b99b1f708a87b3de71309c0c65171", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929095, "uuid": "2efc8e03-ee05-431c-b88a-0731a5cc5f17", "value": "T1C7A4DF45F690D176FD69093205E7B265CDACAD8025140892A3BE3B9F7F330C58B0EADE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929095, "uuid": "c2574d7b-0e25-48ea-bbf2-11366f8ca4b7", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929095, "uuid": "a69e421a-6db4-43cf-98c6-6b3fc07315cd", "value": "12288:Fv/7+8zJeNKuQge/Om3qg2JrRMRMW2iNQmNNkI:F37CNKuQD96g2XMGcRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644929095, "uuid": "7e2e8bd2-0504-4863-8753-047b9c6feb66", "value": 467703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644929095, "uuid": "8926b60d-5a35-4fc9-bb53-f28077115148", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929095, "uuid": "d56aa43a-c1e4-4628-9120-85f4f74d571a", "value": "SC221420.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24755abd-8e0a-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1644893475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893475, "uuid": "99163b82-814c-420f-9db9-23d33bac64a2", "comment": "Malware payload (Amadey)", "value": "43461b949dde147e1ade07db8ba04fe2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893475, "uuid": "4e3b015a-e281-487c-98fa-2eeba6bea6b3", "comment": "Malware payload (Amadey)", "value": "1019125d97e08fa07e5d6bb4cd32909db168cd6d93ae493c5fdd3ce1410e05ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893475, "uuid": "c0b435e3-7a0f-4be3-9f66-d2be400ec03a", "comment": "Malware payload (Amadey)", "value": "299426fcf8aa996fac90b4d87049efdc25565dbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893475, "uuid": "5a4c8917-ffe7-41ce-b40b-d989d08fecb5", "comment": "Malware payload (Amadey)", "value": "3b90fc52449f853a40c5ed0d25c7727634613c75c67a4410140b71db9212fa2b5a3275d83f383b5eea90bd34cdbc3cd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893475, "uuid": "ba8f176f-4bb1-4b91-a464-addb23b2b4d0", "value": "T1EF658D01F101A136F8B340BBCEFE592DDA18AA61134954E773D8695F8BA2EF23D32157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893475, "uuid": "7e9f6f94-6fa8-4051-82ac-9f3a5faa3008", "value": "7ce51882e320fa9eb89d9a96d76add0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893475, "uuid": "3bf13add-e8a9-48c4-aa74-c93c6e05a1be", "value": "24576:1OQCvbvZs1LAFkJ1HRnvLJ5f/7/DPJG25HTci17h:1WvbvZgLAFkRnvLD/7LPJG2RTdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644893475, "uuid": "ee32ae76-37ec-46b1-b37b-2d69321b63db", "value": 1464256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644893475, "uuid": "9c738248-ae5b-4f96-93d9-fe212c892cf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893475, "uuid": "28bfd419-0b83-4c1c-8a91-484eb3c7e3f2", "value": "43461b949dde147e1ade07db8ba04fe2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32232820-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932153, "uuid": "a0791f7d-9183-4353-82aa-e71646041759", "comment": "Malware payload", "value": "761983ad3d8ad98164fce0f24adbb045", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932153, "uuid": "1cdb75fb-692e-4e00-9d6d-1b8c48cb17fd", "comment": "Malware payload", "value": "101e4a64e5ecce023e44833002fc9e8c27fc536752bc90ecce951c0c4ec25509", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932153, "uuid": "ed2ec4e0-ff0a-4d0c-917c-2840b2a63bf9", "comment": "Malware payload", "value": "1e6b78ebde24d6bf5a46f9fda05a21ceae903bf9", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932153, "uuid": "3e40bbf2-01e2-4641-8f9d-88d81e96a73a", "comment": "Malware payload", "value": "63206bfe74d081da94a5f08ceedfd3112caea4b46c7e18c8546b91822788ef9b51f41aabf17286de1ddac890b193b090", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932153, "uuid": "71f06eb6-ea2c-4a81-9bf5-27450e91d539", "value": "T17A636CB71315FCBF1F0A1DA4E10817411C7CACCBE6EC91A83B4138FA95865589ABCDB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932153, "uuid": "90587e88-abd5-46ff-b9de-5b76f3816662", "value": "1536:j4Ad3fjZ9Udv032Qm0yDzkfCgUC5hiOcEgCh+BlF2QN:jtvjoMmQVyPkf1LjTHh+BlM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932153, "uuid": "676147b4-a1c7-4805-910d-e09bb5b4b10b", "value": 70316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932153, "uuid": "6aa5231c-cf21-479c-89e4-648a0a1684de", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932153, "uuid": "1eab8ff1-f84d-4206-9fa0-71df2bd46174", "value": "proxlola.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe69576-8ebb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644969542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969542, "uuid": "831dedfc-fb46-4a07-b9b4-6b23465ac9f8", "comment": "Malware payload", "value": "5efe14b8d25bc05f2bf61ac98e7eb53a", "object_relation": "md5", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969542, "uuid": "04713b75-909a-4d14-8a15-04378bf71f95", "comment": "Malware payload", "value": "106005432d386d1ec080319b72f7ced2b72804ff31869772094a2db17ebd3cf3", "object_relation": "sha256", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969542, "uuid": "0b0c7648-f143-4068-be40-968c55723b33", "comment": "Malware payload", "value": "12a888a11292302d3bfa0041778405323ebfb980", "object_relation": "sha1", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969542, "uuid": "d5d52104-efb6-4f8c-99ba-bbde020bf2e3", "comment": "Malware payload", "value": "7a06178a4b746c87455d630a2babc226ec26061a3f2bba8617298ec70a6bbe47218221980a0926ef706f7c08541a307c", "object_relation": "sha3-384", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969542, "uuid": "36a843c0-65c8-4622-8473-c489c4353a39", "value": "T15D4523FFE54C52CAD93548B482E5F11DE8177E66AE100883BA937CFEA6B54A44F38017", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969542, "uuid": "f1bc8839-1c94-492d-a07c-fc96d87967e5", "value": "05b52ed39c6c35deb93da7d639404837", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969542, "uuid": "ec30f0d7-4666-4605-b896-8eb828e6ea74", "value": "12288:ZiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZisqjnhMgeiCl7G0nehbGZpbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644969542, "uuid": "13403e0b-4246-414d-a862-d81a47076f24", "value": 1255424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644969542, "uuid": "2888aef7-b967-4a0a-8ded-e0b7844f13c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969542, "uuid": "49114edc-2eb7-4b4d-b877-69302d8e5100", "value": "106005432d386d1ec080319b72f7ced2b72804ff31869772094a2db17ebd3cf3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39bbe31-8df4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884266, "uuid": "3cb07e0d-ab86-4a65-ac71-4798ea9620f6", "comment": "Malware payload (Mirai)", "value": "88c401c332356b722ee46dfb413dd7f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884266, "uuid": "9d1a22e0-0751-4e44-800e-3870f4200023", "comment": "Malware payload (Mirai)", "value": "110ddecda3ce0bd41206fe557550754b4fb21bcd663201253d57f9c291764440", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884266, "uuid": "907fd1af-1fc3-4f2a-ae44-a61c750daca0", "comment": "Malware payload (Mirai)", "value": "6243b4ca4e273c737edc23a6ad95860109c5ec55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884266, "uuid": "5888ccc9-2f11-4d92-b4ef-212d20503fa1", "comment": "Malware payload (Mirai)", "value": "c89c27fdf084129e3fd1b47f9cd8ce2c28d8b47fb50ffb9da9aae2a2dd89fddc926712ebcd8284ec98c571fe83529117", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884266, "uuid": "6b280f34-b958-435e-9b75-c42f9ef905a5", "value": "T104E2E89168C25A2AC2E4637EF6AE018D336173A8D1DF321BCD256F453BCA91F0D67B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884266, "uuid": "4888eca2-a785-4b77-b665-b4bae4f46097", "value": "768:ap1KBuXKCGE7FJtWkn3zpIvg0LKiFiVrN5eok677P:AguWWFJtEVFi5N5377", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884266, "uuid": "056107e7-a61d-40e8-a3b6-17ddb28a1c43", "value": 32716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884266, "uuid": "559f9613-0d1e-4a8a-8d61-2132fca4b449", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884266, "uuid": "f2e26cfa-2427-409d-91a0-62951a6a8796", "value": "mizakotropistam5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c801a06-8e93-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644952410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952410, "uuid": "459f0a72-699b-4694-a6bf-a9920191855b", "comment": "Malware payload", "value": "b745b270b0fbaca2cb0773bca2dae7fa", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952410, "uuid": "1f9ce769-1fe5-4878-9087-04971fbe274e", "comment": "Malware payload", "value": "11eebdbf0b2405b9a9160de3ec2987920250ee5ba4f679a250c89e10201120ab", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952410, "uuid": "e1d56296-3ce8-4f6d-8ec8-ff24439b9b24", "comment": "Malware payload", "value": "81090a2e8ea664d8d509db915cdc1496ecc5819b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952410, "uuid": "3e0265c2-316b-459c-a14a-2c7a08c143e5", "comment": "Malware payload", "value": "7f828d0dc24a72d72b0d8aa4fb52c5ce87f8a88a4faffdc488b3a6f5d48c3982a368d70a06c7064929bb034c5907445e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952410, "uuid": "60750f3a-f0a8-4b25-b87a-636182c2c1eb", "value": "T1B295A822B1317E87C3161461565FBE8A530CBD47B3C69F8C904DFBF92CA68E69302D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952410, "uuid": "200cd802-8360-4284-bfd2-981bb0730ea9", "value": "1536:U34QJaKXF34QQPD3iOya7I45AiS9SCHAD4pAs8A4eSoHFJ6oUsbaJu7zc1YiW7Ry:avYUYR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952410, "uuid": "da3fe2ed-3a49-4138-a34f-fd5c255c6aa3", "value": 2055471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952410, "uuid": "79703ab4-4b8f-4abc-832a-76a09bd1b083", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952410, "uuid": "27681a91-84a9-4084-aa10-4d5d96e20d45", "value": "RFQEMT5118F-150322.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa45c7e-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932202, "uuid": "249e42f7-1696-45db-af3e-65cdec930013", "comment": "Malware payload", "value": "2d896d7a51232f7c24a5dfd191f2ecb3", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932202, "uuid": "26960c59-1060-4156-994c-699c750e4383", "comment": "Malware payload", "value": "1232c83f5112821a281bec43bc9c38d84a20f728486164fa4c4326dbd6bfe7f8", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932202, "uuid": "b6b3f4e4-6711-439d-abb7-5aa9479d020c", "comment": "Malware payload", "value": "e6d394e8ed694820cc1f97c3134edfde5e55cd78", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932202, "uuid": "53667aef-5d0b-44c2-ae57-b9617d7cb68e", "comment": "Malware payload", "value": "918aca20139e681661f90af57148c248a2989f420ffd9a8940744abf7bc42e410e8f9c661d74e1e8440b0b140a31f4ea", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932202, "uuid": "9cb4b6a0-bf30-43e1-9dd3-733b620f503b", "value": "T1AD131AB30213FD8F56220E45D50C2111DC9CECB772D89DACBF4898E99FE55288DA8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932202, "uuid": "84e3a174-f3ce-46cf-bf6d-fab2832b664c", "value": "768:YGWLt7hW7p+TwKa4WabmOs2kfgnt/XpXc3y:YGq7o7ITw3ZayO/kfgt/XK3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932202, "uuid": "c7936fbb-0740-468b-a45d-d1e8c516fd67", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932202, "uuid": "50004a14-5174-4c5c-81ff-f1d007deaa7f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932202, "uuid": "9c93a96e-0b2b-4602-a30a-0fa8dc519951", "value": "soft.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b32e106-8ea3-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644959199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959199, "uuid": "93f52637-c8af-49f6-a370-d86673fead7f", "comment": "Malware payload (Loki)", "value": "8ab493363ea363dd3f4dd2f31543e32a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959199, "uuid": "d132b0f7-645b-4ea4-bb11-713810a3fd4a", "comment": "Malware payload (Loki)", "value": "132ab6bad9a67e89e621caa83db4baa17664e89d8d13a12fba8f2e8a1e72e48e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959199, "uuid": "1f8af3e5-e06c-4497-8fb7-8ab527e5a959", "comment": "Malware payload (Loki)", "value": "8cfedf0766583b6b3928cd5af14a4a61f7585239", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959199, "uuid": "170ba4e1-5b0f-4cdf-85bc-e0aced6bd01b", "comment": "Malware payload (Loki)", "value": "5400ba9b4023e4114539ab701e47da07e3ae82d4d1af578a1cee7a4d72c638eb1ca19f53225a53920d97d7b32c0affe1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644959199, "uuid": "cb87187a-192e-4096-bfa7-64be0f94c1b4", "value": "T130541399A8D2D863E84A87331662DF76C5B7D3460261068FE3D01F2F7B15CAB9C091CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644959199, "uuid": "3bb509d9-cc49-4a72-b166-e205a90c9001", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644959199, "uuid": "eee7a197-3639-481b-a981-f8fce7048f12", "value": "6144:owFm0/jHxWOlBAJrEORxT6cdgVNBgmzxY1vZ/Z9L9z2sVJW2v:Bx7xhbh456NVNBgeYVL9z2svz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644959199, "uuid": "238c2277-c960-44dd-a70d-a9d3f4e5095b", "value": 292586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644959199, "uuid": "35655b6f-91dd-4d83-a180-b9b094ebbc52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644959199, "uuid": "6d0b4110-5278-4424-8725-1f97e3f4299a", "value": "8ab493363ea363dd3f4dd2f31543e32a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7895d8db-8e2d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644908648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644908648, "uuid": "2712c23c-22eb-4fb8-ab7b-cf23cd05a6ab", "comment": "Malware payload (AgentTesla)", "value": "129188feb16f5ac6f3a69aa70933955f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644908648, "uuid": "9096b5b3-9565-4ab9-be00-f420cb647eae", "comment": "Malware payload (AgentTesla)", "value": "13e22246d7ab046d62946c11bcdd0d8968348beea1c5d854274c069770e1c614", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644908648, "uuid": "aad9871e-48c8-4816-a853-b67f4951865c", "comment": "Malware payload (AgentTesla)", "value": "ce6b9f34168dd26b8915d6a078fc819598fedb84", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644908648, "uuid": "761baa8f-d36a-46e9-b4fe-6cbc63df5d59", "comment": "Malware payload (AgentTesla)", "value": "48dd9242a63b1451c76ec6cf017c5b4b94806199877a81572c7628d087507be177ccccab6dbc3fd6558507feb31a8f26", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644908648, "uuid": "3225aef8-7c47-4d39-8de6-a7a8ab69ac70", "value": "T1188423E9F5C618D1E85C143C3CF4E6C4E90758FADE79E2089E54E36B6DAD08B26421F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644908648, "uuid": "48830067-f45e-466e-9334-152b834196f2", "value": "6144:pBjMeiaz+odi3dkwml5xIQ9mpuvaEjhxQowI7nZz6fzuvZpO8vm3tb153YomL1mA:vMWz+Oi85x3mpu5dx97n5wUZ01m3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644908648, "uuid": "06bcd658-2ea1-41cd-93dc-f844eafacaef", "value": 406594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644908648, "uuid": "080b15a4-3436-4d14-8ebf-1c2a464360b6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644908648, "uuid": "6176104a-9ef4-4039-a1b2-d6aa905044fd", "value": "Wire Transfer Copy.7Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab16839-8e69-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644934610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934610, "uuid": "b9e46215-3c86-47ee-ad84-3adc27342187", "comment": "Malware payload (AgentTesla)", "value": "940a518eaeaab39298b2b1d94fee4a19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934610, "uuid": "8711a0c3-e83b-4465-8ee5-462cd0c5407c", "comment": "Malware payload (AgentTesla)", "value": "148e205e87ffe35288c295f29fab41a092bdfeae179cbcea385ca3124c9125fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934610, "uuid": "3241934b-c812-468d-b19f-dd2d0b32f181", "comment": "Malware payload (AgentTesla)", "value": "2ced594801b0d56d7e0caea9e9726277b546bfd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934610, "uuid": "a9d84527-6890-45c4-b0d5-d0028c1cadeb", "comment": "Malware payload (AgentTesla)", "value": "bdbe48fe91554f666c0e9cf52de1bd11e0ff8a9f4d51b8f0fbf893c9b348c902c672bc584d40891894c6d568b7b502cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934610, "uuid": "e816fc7c-2503-45f8-9c59-854c7ea4cbcc", "value": "T13605021AB76BEE75C47436B500EF913017F09A4D1633DE7A7DBA329C09523620EB84B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934610, "uuid": "84e76cc8-ce29-4bf9-bb05-fb36f710e20b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934610, "uuid": "2bdd8843-be10-49bb-83c4-f95f182737bd", "value": "24576:e+dVmXqBfU1hCxWpyOeDznfOpSUYJj1C:vmaB+YWWnJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644934610, "uuid": "3460a8cd-a6bb-4f5e-a2fc-b4310bd1b556", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644934610, "uuid": "2455a56a-582b-415f-b8d0-e8987da07816", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934610, "uuid": "b779cfb9-43f7-48f1-8a9c-edeaee2ca3c2", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d7bc1a-8df4-11ec-9275-42010a9c0029", "comment": "Malware payload (Tsunami)", "timestamp": 1644884220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884220, "uuid": "404f6690-fa63-4bb7-a2c4-f19dddffa321", "comment": "Malware payload (Tsunami)", "value": "baba921bf845cd46161eb96544155e40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884220, "uuid": "76978def-b7a0-4b9c-aa5c-fa29a99925d7", "comment": "Malware payload (Tsunami)", "value": "15c7fe5a56b80a43544c3227a8589045bf67d0a65c2ebba2506102250f6da963", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884220, "uuid": "a182ce6d-fcea-4e36-ad4b-3f32fecb1be2", "comment": "Malware payload (Tsunami)", "value": "730f703dedcc0c4f4fe9ec78ff2c9238803666d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884220, "uuid": "bb3c990c-e225-4ee5-8542-d0a99272e4d1", "comment": "Malware payload (Tsunami)", "value": "16ad88b78a3aa08b50d6283b4dd54be513705221c124e5d8e37a27ac871c738e431c7df8afa37ca98afd33317a2d05d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884220, "uuid": "871cab7e-4f44-43a0-a7e7-0b9a1b9d9788", "value": "T1DEA34A27A652C3FBC0A35AF52ADF8530A923B4391B37221A37DD7E752B15EC85D19302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884220, "uuid": "b735462e-dae1-4f78-b195-90c278312ef5", "value": "3072:vGsgnjqp8867wvpYnYTzdQME3IC1tr/08mk46wknGZXw8R:tVQMwDz/08mk46wknGZXw8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884220, "uuid": "5d41f549-f8c4-4943-821e-486a130d295b", "value": 107312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884220, "uuid": "d0ff8175-e21d-49d1-bcfb-e9a07740c974", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884220, "uuid": "10abb6cc-716f-459c-b8b8-0a27b0e89400", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e679e34c-8eb3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644966385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644966385, "uuid": "61046ebf-1c99-4d1d-a5a3-fa48fd3501c2", "comment": "Malware payload", "value": "e4445105a776ddd3162ba690a3dec28d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644966385, "uuid": "3b6fbd6b-a64f-4058-b9af-2eda1e02c7d0", "comment": "Malware payload", "value": "1643ccc8a677c6ae9880bf8007162da09ff9af0b79f36f3af243a8f21d5dcd0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644966385, "uuid": "d3620cb3-c013-442d-9e44-9be3f617b7a8", "comment": "Malware payload", "value": "d4ec6190fff8a3af8e3f40625c13907a58f89484", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644966385, "uuid": "8f59f459-6b1f-4163-8ada-82b38b96ea67", "comment": "Malware payload", "value": "1692f21b5445d01abdc3f23418e3a3f60064f028eda628cb5d48be58bbbabd469c6dbd049010a2cba290b6135b5a1008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644966385, "uuid": "69f03417-a82a-4f5e-878b-39f6fa01f171", "value": "T1AC36338B4BC0D4B7C14A0F756765B448C6FBFA3C93EAAD9ED206040AC578126729D4EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644966385, "uuid": "84425c36-fc8d-4d96-8aad-d6e5c17e8c8a", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644966385, "uuid": "65089a18-0998-4c9f-a7a0-da108416603a", "value": "98304:NxaQ4Q1D+v1w4QYUq0dP7R3+9rlBG9tkim12eaIZdbEg30yaL:NwdjtEYUhdDR3U5BG9txm12ebZd4Cp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644966385, "uuid": "a275bb90-8166-4912-9716-cc4ea0f6b19b", "value": 4905472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644966385, "uuid": "3d1b2aba-bb95-4416-b43d-79d4331fb96f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644966385, "uuid": "0f547214-1bd8-4bed-9699-d5129909cda9", "value": "FabFilter Total Bundle.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b6048b-8ea1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644958675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958675, "uuid": "be9c3c11-e6cd-4c6c-90ad-5296bc1567e8", "comment": "Malware payload (Formbook)", "value": "cb5fbc9ecfc211e857c8ce2f5ac1547c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958675, "uuid": "3b9aca07-e19b-400a-87e1-056ff0f45950", "comment": "Malware payload (Formbook)", "value": "16956685e8f153db05d1eda237f9fde5ae23cecc8de57f891be024af9af05626", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958675, "uuid": "b6beaad1-e836-4bd2-8af4-db7bfb39644f", "comment": "Malware payload (Formbook)", "value": "bf0733aeadf7b2ce28093212dbdfb32220183f5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958675, "uuid": "e27efa51-819d-4a23-950e-088e31d9f0d6", "comment": "Malware payload (Formbook)", "value": "24b500cad9ad4077d32f4299f8212c6056a0518753011a2aa2957ef369efccbf1d4d3a1ee577bd6ebf1dedc436e969e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958675, "uuid": "fe3c575b-5c4b-4bd2-a21b-06bbf040f1dc", "value": "T184A4793171B8A8AEF38C963FFECDD16C5BA7BD358BD8060676667A5A2430051CF84346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958675, "uuid": "073dd892-02bb-4933-8765-776bf4f93344", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958675, "uuid": "11acbdf1-6f5e-4eed-91da-d99a578bea7e", "value": "6144:7w/H1K7QD/UJKdEEaPIfk6ee4rSjlO2lG5IjegjWJX83X2G:lETOK+PPIfk84r4regjWJs3X2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644958675, "uuid": "a7c6cbf5-c826-4b22-9ec8-2eef36cb2659", "value": 462420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644958675, "uuid": "a52a2515-be96-44b9-a8ca-589463e28a15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958675, "uuid": "dd33de1a-8c62-499e-8fa9-4b45ebfe5dd2", "value": "cb5fbc9ecfc211e857c8ce2f5ac1547c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046eeaab-8e82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644944961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944961, "uuid": "2b71678e-ba27-45a8-8657-b8d41a44655e", "comment": "Malware payload", "value": "6c692d0ec8c452c165c871b9e20186a1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944961, "uuid": "34a2f5f3-05f0-4717-a143-73396b94ce0e", "comment": "Malware payload", "value": "16c2b0c3a5d93912d7866547dacbc0b8536ad7f6104361704d64105b2fb8b6eb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944961, "uuid": "1c82447a-0c1c-4266-a285-2998e6947492", "comment": "Malware payload", "value": "42d4cb18f76562883642e22ba253d685332e939f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944961, "uuid": "ff553760-3b60-4fe4-ad47-351c15ea27ba", "comment": "Malware payload", "value": "0a11eba2c8d2f1c44821d18366c66861a540613cee7c74a122d4d947207a69962b7a73b9390b327f8cde3871de6f77f4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944961, "uuid": "61d0c219-09f1-4f94-bc0f-07e687e50fed", "value": "T12836337CA0F87DFF4248597592DFDF10706A4ACEB0A1875295ABE54F081633278FE628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944961, "uuid": "9819c980-1e24-4352-8d9d-0a316fd4f919", "value": "98304:tos909Qg6ecEZHyEexmLaI9MY7bxTE8SSvEgP3N2v+KmFLBLRs:td69Qg/JFeQ5x7bhE8SSdP8v+ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644944961, "uuid": "e8cc07a8-513d-420c-886b-0b37efe04901", "value": 5201920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644944961, "uuid": "ad0102b6-9697-4ff3-9123-a54b0b8218b1", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944961, "uuid": "a83be186-3c97-41b9-a4c8-2b9d4199b105", "value": "16c2b0c3a5d93912d7866547dacbc0b8536ad7f6104361704d64105b2fb8b6eb.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd00d35-8e30-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644910050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644910050, "uuid": "9ce49319-afdf-40e5-9ea3-5f786b0e29e9", "comment": "Malware payload", "value": "ad3dcff04bba02e6d40c4e43e73cc739", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644910050, "uuid": "1e1d482b-243b-4747-aed7-dd17cb97313b", "comment": "Malware payload", "value": "17eb3e9d657d99ee12cecd9144bc645a43e751086d51f28eb18f304058f08c4e", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644910050, "uuid": "70a5073c-9b1a-46d4-b12f-e4da6b3777ae", "comment": "Malware payload", "value": "a4cd2dc3e053e56ac40bc3d2cfccc6a3627a003f", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644910050, "uuid": "fd31a17e-aeed-4586-b83b-0eb9fe02354b", "comment": "Malware payload", "value": "6e339985f066d78322658d663dbea468e2c0a5da29dcde54a272e0b4789dc8cf5fd69ed58a1cedac5904812be9b8acf8", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644910050, "uuid": "7429dc6b-2969-47dd-8cc8-58f84cfe5701", "value": "T1E013F8B30213BDCF16260E52E40C3115EC59ECB7728999ACFB4888F58BE5114DDB8DB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644910050, "uuid": "64624a05-4eec-46e3-83c1-7d2123aa2989", "value": "768:haSx2rKYNfu++m8YueIumRK02kfgnt/XpXc3r:hP0r3fP+m8YueI1YXkfgt/XK3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644910050, "uuid": "f34a78a1-d656-4a77-9e91-fce81bcbe55a", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644910050, "uuid": "98707c31-2f9c-4aee-85c5-1b77d4f86b16", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644910050, "uuid": "aa2ff63c-dbe2-4926-b7f3-ea23b936fc99", "value": "9510v2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb327bb9-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644953106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953106, "uuid": "158295fb-8a22-49b1-b0db-0d6b4aa59a88", "comment": "Malware payload (AgentTesla)", "value": "7c86c36195540b2a59d38f1b13bbc870", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953106, "uuid": "dd6b9b56-412b-4ab7-9d4f-b41447a2558f", "comment": "Malware payload (AgentTesla)", "value": "19154dcf17632f0cf8509a93f6f501093e0ddf3055069b326cdd116ca0c6d601", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953106, "uuid": "eb5bbc29-461c-43cd-9051-70afd83f8c4a", "comment": "Malware payload (AgentTesla)", "value": "585e4e7186e93dae671bb5f363837e3009e33bdb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953106, "uuid": "3567ff8d-4ee0-4bc9-870f-1227fad5eaeb", "comment": "Malware payload (AgentTesla)", "value": "8dc4ea135d3dcee9d40ac61dea884333269411dbff08b6679585dfa9687092ea8fa1f2e6d6ff176ff4741de5bcb0de61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953106, "uuid": "936367b7-8c5e-40a7-bacf-f3286bdd1387", "value": "T12E05010077F37A81C07207FAA4E591861BB1795D1226EA7DC99234CD1C57B818EBFA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953106, "uuid": "9b418218-407c-4ade-bb66-f7704e54bd0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953106, "uuid": "0b4a4315-48f7-4c05-ba0e-9dbf6a8dcc40", "value": "12288:Bh5k+zLsa4eLKKit/3yrA/SM6nZDTc/veYAanBCwhvQY1OfKKTde:naFUkt/eA/SM+ZEXeYAanBnQY1Gjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953106, "uuid": "0561eb75-82ca-4ed4-b6a9-e0fe823a65d8", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953106, "uuid": "7a74d0d2-1df7-4201-8629-cabd39aa0558", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953106, "uuid": "28671bda-23c2-4df1-bdef-80b15914d463", "value": "DHL Tag number DB0011622801 17BA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268cc42a-8ea3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644959191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959191, "uuid": "68a361d4-778f-4240-bd28-80b3b6727727", "comment": "Malware payload", "value": "ab10a724cbc3c0b4d14b4dbdce3d43a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959191, "uuid": "1dda7b2c-2f73-4f9e-9cbb-f68bcf922b6a", "comment": "Malware payload", "value": "197f9af8a87a5870a0b950d3123cfa4c648f941b97cb7c16f392d26b61385d70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959191, "uuid": "dced311e-d79d-4407-b60d-b41456c21279", "comment": "Malware payload", "value": "66832887ae994d363d6ba6f3e6ac4b625b9653d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959191, "uuid": "17212ed3-39b1-4ffd-b0bb-d05f464385ee", "comment": "Malware payload", "value": "cd0abf933438f99b688e40685b0c112a62e040968a4263e766cb4e614d1a202c8b300a9547db14ea7836a29a8d62b4c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644959191, "uuid": "48e45825-15cd-4988-b809-c538f7dca7ec", "value": "T17CF4120076B72744C5360BFA84A992854BB5B65D5523E6BECE9230CD0C13BD4CA7BE3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644959191, "uuid": "30e67fa8-a286-4752-9880-efec2008b877", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644959191, "uuid": "44cf1426-8aeb-4a69-a126-a113dbc3fc25", "value": "12288:2c5k+TdUOIrIpjyFMAHe+myGGDI68gRsw8AWmRqhqjv1EX06GBxDnQP4p4:9aSjRie+mCI68gD8Uj9B6Ixg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644959191, "uuid": "5eb48b9e-30b6-44ca-9fc0-b377021032dd", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644959191, "uuid": "33494d07-8960-4942-b472-11ba31f46505", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644959191, "uuid": "378bff30-4235-4ac2-b682-edcb5100ad9c", "value": "ab10a724cbc3c0b4d14b4dbdce3d43a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a768b99d-8e6e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644936644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936644, "uuid": "79b4b4de-17ef-4584-bdd1-7c8a8f95eba2", "comment": "Malware payload (Mirai)", "value": "8caabfd62758997b7c61e69408ba47be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936644, "uuid": "66eed696-fce1-435e-92bd-7d951f667cab", "comment": "Malware payload (Mirai)", "value": "19f70ee697049adee92d2941818324de3b63afdcb9ac141359c255ddb8594ae0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936644, "uuid": "f3a4371a-ba5f-4633-a917-4f95f59ec03b", "comment": "Malware payload (Mirai)", "value": "f26b1e1295389fc2e2f22eb7e420e385d6ec2ed8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936644, "uuid": "6d781131-e31b-48ed-b5d5-086c65045e1e", "comment": "Malware payload (Mirai)", "value": "6227db5a78b9f2e257f9117d50a2fb394c23dcf384cca6dd05ee4f87d804f84ccb014601992304edb6c96ccf2e4eb29d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936644, "uuid": "331eff4a-6614-433b-9027-12abb3fac89a", "value": "T197534A02B2280A47D2931EB0353F5BD197BFEAC121E0F585799EDB5A8131E372586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936644, "uuid": "11016cd9-bf56-41ac-b5be-be44614dbde0", "value": "1536:DmK81nKc7cqAAF022ag+IcD/IbF55jAwPZ:lcwE4ag+b/Ix55PZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644936644, "uuid": "3bc24158-f72c-44d1-b177-fae51c2cd6f8", "value": 63636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644936644, "uuid": "50f6883d-152f-4e94-ae0a-bbe472ca94c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936644, "uuid": "bde9aa44-efa7-4de9-ab4d-aef63ee38ed2", "value": "8caabfd62758997b7c61e69408ba47be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c696b00-8e3e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644915822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915822, "uuid": "2261dc69-64fc-4b1e-bb6c-678d119fef71", "comment": "Malware payload (AgentTesla)", "value": "467a8e4546beb9015d98d00b749284fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915822, "uuid": "eb9cb41a-aebb-481d-9822-55d2b2f337fd", "comment": "Malware payload (AgentTesla)", "value": "1a8a5058ea6a364f307eb4f434ac4cb387039305efbdd6ae27876e8bbbb6bad6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915822, "uuid": "23998b56-3474-4cb2-9c21-1d5dcd39f887", "comment": "Malware payload (AgentTesla)", "value": "7da074a4c00f0c80ba1317b6115ece4f0517b447", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915822, "uuid": "893b2663-85a9-4494-ac52-f05be3e8ba55", "comment": "Malware payload (AgentTesla)", "value": "1b0a8c7fc5f8747739eed3a08c28607969b50e2e24b8efa7c24916dc559365dbaea68fda295fdef4058d596d9800568a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915822, "uuid": "9ebc9854-c076-46cc-acf2-8764a05353ef", "value": "T1FFF3F1003B50C8BBF497977159366BAB4AF9E92055A10F871780BD6E3D33291DE1F722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915822, "uuid": "1860147d-aab3-4a5d-80c6-8f6d4f750fda", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915822, "uuid": "8a03405b-e533-47c0-8384-97d1e866df14", "value": "3072:6bG7N2kDTHUpouDT/FjbnvpkD/v9fkgcXr7Ey0tACPNZ:6bE/HU//5nvu/FcRbt09lZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644915822, "uuid": "9fcb6f62-a216-467e-87cf-4746430a0109", "value": 161824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644915822, "uuid": "196283eb-2c6a-4e18-a28b-37fc153d3315", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915822, "uuid": "7c2eb1ca-0d8d-4c04-a170-c4ed092702ca", "value": "PURITY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bd79f6-8e42-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644917789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917789, "uuid": "b5644a4a-a664-409b-b9cf-57bf55ecb968", "comment": "Malware payload (Loki)", "value": "f708fd1d8db594b11ecbb34c362e3dd6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917789, "uuid": "cf57331f-dec6-4c86-b397-9c1ae7d730ff", "comment": "Malware payload (Loki)", "value": "1ba01ddf3d45d995560b6e9076ff0c0a312bf872c799923d59e284a6b59c39b0", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917789, "uuid": "09cefcd0-15f6-489f-8059-9a529c9c37f5", "comment": "Malware payload (Loki)", "value": "5ea2ed714407a6f89bacdfc5f65b26cb67475551", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917789, "uuid": "d1964b0d-064d-4af2-87cf-d1daa2587c7a", "comment": "Malware payload (Loki)", "value": "d8a3b6e14d5d2d0443db7f2fef457f4254bab054ac5c945c16fc203a7ab11a24eda76f4bfc05e9075b4a278149079f35", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917789, "uuid": "d58bc405-6455-4b8b-b504-19db3853e11a", "value": "T1DE1402AF3A8C9413F2B2153BD8AC49BA035ACCCCFC20FC6679C5355E45726A692F1925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917789, "uuid": "43215860-2499-4c62-b007-1554eb0b834b", "value": "3072:nnZUC7o6IHNLuUtrIL4uKfaY6ZbTrveTjM7boTHI4khuPWpEi+S3GYMxvqW4rI8s:n8rhAVKfaY6ZbTbeCboTHI4WIW0S3C7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644917789, "uuid": "9f116cce-3b4f-4db5-b655-4675ed5428b9", "value": 192024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644917789, "uuid": "55de1920-187d-4719-95e8-ce88bed23b66", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917789, "uuid": "c8074265-ed9a-409b-a65d-2a5981883c44", "value": "Sales Contract March 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f235a673-8e16-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644898974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644898974, "uuid": "778c90ff-fa18-4e93-9d0f-21ace76b8ef0", "comment": "Malware payload (AgentTesla)", "value": "d41f2f4c6802c3f276d699513aaa3249", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644898974, "uuid": "aad02d0b-a9bf-4d52-9a4b-7529a2be0c8e", "comment": "Malware payload (AgentTesla)", "value": "1c5ec6cecf984c0b011db6ec9bec21a169a69d188fc0f2f0b628f7f422d20ee5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644898974, "uuid": "1b331347-620a-4f01-8bbc-43dfe443567c", "comment": "Malware payload (AgentTesla)", "value": "c559b4cf06bc9d2de2b200001bdf69e41bb8e06b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644898974, "uuid": "294ddd7c-7a2f-4ab1-8b64-b502396cb71a", "comment": "Malware payload (AgentTesla)", "value": "9d1f925ee0235fbbd21860c011c02abc4bf9f0b2f6d09612691f3921737080b59b38c237c30b4df7f469e1574267fcc2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644898974, "uuid": "e55996e6-55c2-4663-a56e-3f78c8ebfb76", "value": "T1EE050117B72FEA75C43016B900DFD53603F4AB8C6573DE7A2DAB329809523A74A78439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644898974, "uuid": "72828f92-bc75-420c-8877-ec871ca5c82a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644898974, "uuid": "53838e30-616b-4899-a268-8aa775aa5a48", "value": "12288:VT06Nku9zBpqzVYtHXrBLlYllhAD4o1eVI56OfPnzD2Th/SKEoU:VT0hu9zPtHnOMrh56mLD2vEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644898974, "uuid": "986d3eb4-124b-49fc-a7ca-913acdd2cbd4", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644898974, "uuid": "ef1495ce-5cf2-4178-b6e4-c073a492dc07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644898974, "uuid": "1cc1a897-44c3-4701-a5af-60927ad2ead1", "value": "itUwRRwSGgIbxl9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b061903-8e98-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644954662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954662, "uuid": "2aac3fc9-dad2-4f25-95ac-4087cabd9cdb", "comment": "Malware payload", "value": "6797c3b1c8d067cfb2ad4ce6c6e96229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954662, "uuid": "56438e5e-95bb-4201-a526-d94a5b90e87b", "comment": "Malware payload", "value": "1c8e12906dea7170642ab6f74a112875f7e808ce7702fba326d39dc9079bc71e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954662, "uuid": "f116101c-1568-4c8e-917c-f2a5a04f61f7", "comment": "Malware payload", "value": "08583f396e24da555bd032ec4f15c365af0dbe73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954662, "uuid": "76193c54-f687-4255-b8e6-3d38ab4cb9b3", "comment": "Malware payload", "value": "974b6311cbb16115b9bd2983a3eea9672337197c3658f6fdf14364184ffcc415d2fe650265df82cbe74c9272b435518a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954662, "uuid": "6f513953-3350-42d7-b566-e387a36943b4", "value": "T17864F8402EB98D27F2DD67FAB82205E9EBF840579A8FFA4644432CE15E8D7D81C416D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954662, "uuid": "69a6522c-2302-4ad4-bbd6-b621e6b0245a", "value": "6144:rrtA0iKvsUQQ3r7AmXGi1pev9r/0aqnPOLHqlaTrf72HGTvSggV:dA0fkUL77Agev9r8aqGLKlar2zggV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644954662, "uuid": "e4499325-1557-42d4-a144-070f265d6b4c", "value": 309216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644954662, "uuid": "fef18c92-55d0-4bab-833a-e957f553d8a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954662, "uuid": "401e6954-134c-40f2-b6f6-8e2871625f95", "value": "6797c3b1c8d067cfb2ad4ce6c6e96229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2710ec3b-8e4a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644920967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920967, "uuid": "1e818d35-3fc6-4cf7-90f3-926de4f64de3", "comment": "Malware payload (AgentTesla)", "value": "16194ec5bb927f4237d8fabdb21748bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920967, "uuid": "2e3a9b39-1456-4504-b006-8dc95db130b0", "comment": "Malware payload (AgentTesla)", "value": "1cad8207588cf017dcd0a6f87de8996cc21d7f9cbb80556999a428c6a318b4b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920967, "uuid": "7d7e7773-1ea8-44b7-931f-8b1fa441970e", "comment": "Malware payload (AgentTesla)", "value": "a2c6cd6783541101a515c7a3cfeba574ff89dbdf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920967, "uuid": "c6036f74-cc51-4591-9f5d-07e716030a31", "comment": "Malware payload (AgentTesla)", "value": "12f164e067993fe9eec37648b4ab65deff544c2408b3a7eacc74184657a4ff1416365383ca8d85f59fe0ae0341d4ee3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920967, "uuid": "2da0b906-1a95-40b8-b493-2b6ba18de456", "value": "T15B050206B3B7BA9BC07501F454A2B2C69BF0459D055BDBFB4C9271C866C2BC76A340BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920967, "uuid": "3b638a06-cf4c-49de-b8d6-1de18cf45452", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920967, "uuid": "eee0e131-6abf-41ea-a76e-d52f1b964616", "value": "12288:qoUCXM17SSKomGKk9CCqT++hvjMzlw146Vz7VEDawBtXXYO24L5k+:qAk5KksCc++FjPiR1BlRRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644920967, "uuid": "620d1419-801f-4b00-b624-22887f429171", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644920967, "uuid": "b4c5704e-a775-4aa2-9fde-aa66d9413e65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920967, "uuid": "e999d851-13a7-40fd-a925-2bc0a16dad74", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b58805-8e11-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1644896772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644896772, "uuid": "38099635-72fd-434a-a65b-151b9b93c340", "comment": "Malware payload (AsyncRAT)", "value": "96ba4dd14d2c788c1f309cc318b0dd87", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644896772, "uuid": "5d662cd5-9e27-4e1b-b790-77d0901ed6da", "comment": "Malware payload (AsyncRAT)", "value": "1cc4dc57e23d0a76596119a73d4812d98ee45f208defb20b50e81dc08b4196ce", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644896772, "uuid": "9a9568aa-c05a-4977-9bdc-93aa4eac4d83", "comment": "Malware payload (AsyncRAT)", "value": "9c016ee7cc6cb74c02e752f8e5fe58a2502fccc9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644896772, "uuid": "7d4c7648-f652-41e6-964e-af576a5df3a7", "comment": "Malware payload (AsyncRAT)", "value": "7e50fdd5fb22e65e4d9ece50dbb69fc403fa1e4db9b66015a5231dbe6ae9646872f2bf1371ca42e65916c2381eed960f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644896772, "uuid": "a48f8bb5-089e-4305-800c-9c05839a888a", "value": "T179F4F1177AABEB38C46416B604DB913913E5AF5C2573DE7628BB73DC0D132A10DB8236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644896772, "uuid": "27010a3a-6977-4d49-b85c-5e482b6aff6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644896772, "uuid": "f42125a2-d315-4035-85af-b9735fa41135", "value": "12288:OeSIN7NkS66UyHT985s7JPBUAjNi1X4Hn0KCV1370:Oez6S6+H585mJ9jA1IH0LVZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644896772, "uuid": "1b55c7ce-e1b7-4c38-9b2e-9eb7c96b25f9", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644896772, "uuid": "c0d6aa7e-8aed-4ddf-9bbc-6982624a6eb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644896772, "uuid": "9b805fa6-3038-4598-b946-9ef29d8f6bd9", "value": "Payment Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e0c5e7-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644953156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953156, "uuid": "65623f9c-2f17-41db-9532-f86c829b157c", "comment": "Malware payload (AgentTesla)", "value": "2cbd4fd8c1e800175040e28ba877bcbe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953156, "uuid": "c69fee92-801c-4edf-a0aa-482762ccae69", "comment": "Malware payload (AgentTesla)", "value": "1d5145cd3a353fa36fe6c6583af1846336426a7cb94f5ed08f16ff7b7ebe4cb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953156, "uuid": "bfc70911-cbfa-472b-b9b5-300c4232937f", "comment": "Malware payload (AgentTesla)", "value": "38204ff70d3c87c62bc7ef4c3baf9119ba4375ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953156, "uuid": "b758222b-fd77-4c1e-9e7e-e3a5d13a880b", "comment": "Malware payload (AgentTesla)", "value": "ad0572429ad08454191dbcab02f774a84fcbc8475b4d65efbd2b6728d0f2ee56d34be7ba8a1ae178e736f06d50687dce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953156, "uuid": "c92c7b58-1a57-4112-ba51-a678880c4dc2", "value": "T11405010077777A80C07247F648A591815BB97D1E1527E73ECDA278CE2C72B918A3E93B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953156, "uuid": "6ef90bad-6e6a-4eaa-8340-07cf29123c70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953156, "uuid": "fa5739d3-82de-46d2-8bcd-cedc7b1d52de", "value": "12288:qQ5k+xICrKO2r7ZyrCCmeHahWpNyescOrfbrAgnvnZAomRBGnNHctZ4+AqXTnjdZ:lagK378r7/Hm4y2Mfbr3ZoGnNq7Vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953156, "uuid": "c51e3f29-90df-43de-8c9a-a55e87d73c93", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953156, "uuid": "6835adc2-3609-42b6-aad2-c083c593d81c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953156, "uuid": "549ac4a9-2e47-4d2b-8983-802e470ee8dd", "value": "Halkbank_Ekstre_20222501_073653_270424.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dccc705-8e50-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644923609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923609, "uuid": "c78650cc-d7f6-4d77-9a22-9af26db8fa1f", "comment": "Malware payload", "value": "997756d3bbe26611de8d1e9b85c1e1a9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923609, "uuid": "a886c1af-b250-409a-8d1d-3c1db7f7cb11", "comment": "Malware payload", "value": "1ed75cc99018d81cdcd8104efc5765b76b52b7f7a671988b8c747aac1883cddb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923609, "uuid": "763a77c4-2a41-407e-898c-965a619b1820", "comment": "Malware payload", "value": "c717ac7365b37ba3a0b09ea6e39f35e6e860b99e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923609, "uuid": "eb8ffce1-793e-44d2-8948-e341103c3131", "comment": "Malware payload", "value": "682c3012b18fd8e0286b8e7f9ae8f2cc0fc1a2c5481713b40f70c42ab5998af46182d7a679eed70b24c778e3ee500a5d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644923609, "uuid": "1f8c4ff7-550b-4718-8771-dedf75cb43ae", "value": "T10271090E8F85EA4C03C517C250BFCDDC6AB849D42641D2FCB169E28A378DE96C639378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644923609, "uuid": "fa654637-6ebe-4522-8de8-6a1a5e021565", "value": "48:it3TSLyFY35pfpruHgZWjBj2n8ZEGzddPsWZEB7m9/qSuOetr2D3KvD9Z3tgXPvV:i9SLAYpwIyB68Z9kWZ8QSG1DXTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644923609, "uuid": "6bb87919-63da-462d-af3e-bcc03d3b3d67", "value": 3667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644923609, "uuid": "0c05729e-5765-4e1a-9dba-9d6fa64952bf", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644923609, "uuid": "831853b6-bafc-4312-9ff2-72998c6699e8", "value": "H9Zhw04fTVZQQgvv9DUjePZmbeab7RExI76EE6_u1jg_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31f64a0-8e6e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644936637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936637, "uuid": "428c627a-5c4c-458b-9969-daa8a9c8f0b1", "comment": "Malware payload (Mirai)", "value": "32aa8cac5757dec5e6aea6cb178eb5e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936637, "uuid": "92d14f92-57e2-49cd-9857-cbe63a2f0200", "comment": "Malware payload (Mirai)", "value": "1fb9a90bf710605af4e555dc4619fc5cc8b0d84cf7b0233b88536d67c36d765f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936637, "uuid": "8ffb4cbe-be4d-4834-a49b-f70d88aafc07", "comment": "Malware payload (Mirai)", "value": "f192261f2acd34fffa5f30a21e7698df7331fa40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936637, "uuid": "61051655-6cbb-4afa-b532-e900b9ada75c", "comment": "Malware payload (Mirai)", "value": "b2c8467ebd251482fe717f6ccd48c97ffa2f90e4ebbf050c195e02184a319863730c1c59ed7a9e56707602e7feb363f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936637, "uuid": "b036675e-c57f-42f4-80f7-c7737323b39e", "value": "T138433BC0B5A7D9F5DC1202B0347BEF335B37E5FA2159E687DB98A5326C425039907A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936637, "uuid": "b3c9f731-afe0-4ed1-9199-60da521b6eb8", "value": "1536:TjkZoZPif+ODr/5K9IMG/plZ9DKDzSBa+7kiM4/cndhaSLMwQ+++++++++++++++:KoZ4+ODr/4IdpDgvSBa+7o4/YzI++++y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644936637, "uuid": "27bb834c-bc54-4a27-b10b-0243d244c678", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644936637, "uuid": "106743fa-836d-4974-9d9e-16208535ac41", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936637, "uuid": "62e6258a-774a-446f-8b56-769d75981c75", "value": "32aa8cac5757dec5e6aea6cb178eb5e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479bc1b9-8df3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644883655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883655, "uuid": "1390c593-06a5-4eb6-a0e4-4764c8353358", "comment": "Malware payload (RedLineStealer)", "value": "8054367dd62200f3d829c86c49b7da3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883655, "uuid": "1ea25e29-f70e-424d-a6a0-caabc3b29c55", "comment": "Malware payload (RedLineStealer)", "value": "1fbb53922880c53aff6c82545ab91811f4f0a3ea30c60b417c7980c8a9434d8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883655, "uuid": "f606da19-dbe6-49aa-907b-764b7dd10f57", "comment": "Malware payload (RedLineStealer)", "value": "57de3deaf6e6df091e1423541cef28a05ea3b518", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883655, "uuid": "7876e694-abe5-458a-a2ac-45b73d4f12b8", "comment": "Malware payload (RedLineStealer)", "value": "9b2b3660b9170439970bb0d178d78e60a265bddf4cdf26e890c9edaae533bce998b3e8b267e0ca801ff30a95ff531144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883655, "uuid": "c6055339-b77d-4b5d-a449-ffaf28b52f9c", "value": "T14B3633B713597D16F8CB16F6861CF88A2F1226F0BAE8F19FE074C14868744D43B1999D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883655, "uuid": "6e73251d-b609-49d8-812a-fd74f6fbb5c2", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883655, "uuid": "c973d509-27a5-4c13-9663-967995658793", "value": "98304:0j8LRoIemTGaB4wyszNjFiBA96cPRUH5eEE6S2zjAQ1nwkjciInaDJM02QnV3:0RmVNtZ8jcPR6AEZdJ1LGaDJaQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644883655, "uuid": "1fc84d8c-2190-4d11-b233-02ffbfdf7764", "value": 4868608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644883655, "uuid": "825b3976-215d-45e4-a82a-b1cb8159f2d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883655, "uuid": "b50ad951-3db0-45fb-b37e-593d404be143", "value": "MBSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595f51b4-8e93-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644952405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952405, "uuid": "16017ef1-0299-4203-9232-2e0a47fe5b64", "comment": "Malware payload", "value": "9ab9d7831fdf2c4e8399a1c23c1e4b0c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952405, "uuid": "f33b19d0-5e28-41ff-add8-df999e99a801", "comment": "Malware payload", "value": "1fdf52bb6de99c7987bdb46492ff375ff8601da7e57fe3ea230fae9623c76f23", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952405, "uuid": "a833f2a2-053f-4eb1-a90e-5bd929a74763", "comment": "Malware payload", "value": "d5cda4c8b08429e733cbdfcb71def0c510512a17", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952405, "uuid": "ee8e2ed2-39e7-4be7-8d9c-c4189b52b3d7", "comment": "Malware payload", "value": "77de510a8bd6db48f267cee4f856286d645a8020424680d2e379a9931cadf2e820fbb26be90957d19075cb6e018b9f3b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952405, "uuid": "7d41e122-f25e-4333-94c5-b0659f157e79", "value": "T13E95BA21B1317A97C3161461166FBE8A430CBD47B2C65F8C905DFBF82CA6CE79306D9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952405, "uuid": "3c948b51-df39-4238-a321-7240f775e817", "value": "1536:B234QJaKXF34QQPD3iOya7I45AiS9SCHAD4pAs8A4eSoHFJ6oUsbaJu7zc1YiW7H:vo9u0243", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952405, "uuid": "1b8934b5-1b60-4327-b16f-f8de2a625caf", "value": 2055477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952405, "uuid": "ffbadf59-0aa9-4c42-9730-1cd2c3f2f18f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952405, "uuid": "8273acd5-ea59-4f78-a855-37bdee150f0b", "value": "RFQ OFFER-309875 RFQ 5914.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bef89f-8e77-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644940405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940405, "uuid": "c0e10374-4b51-4d55-88f8-47ae3a94506a", "comment": "Malware payload (Formbook)", "value": "b6ffc3c270d3e9d0ae3ecbf74df51b4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940405, "uuid": "644dccb2-62bd-4416-b66e-d82faad832ed", "comment": "Malware payload (Formbook)", "value": "2084194e47482bf35f4b7c5724d6cf0db56cf4f10811f727a3517579c3985b2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940405, "uuid": "0963898e-ad51-46e1-8c4a-b0e03434766e", "comment": "Malware payload (Formbook)", "value": "1f0391802a9d1da32b08fe92554936c754b1a511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940405, "uuid": "145b6414-b643-4608-91d4-e2e6c6e32dc8", "comment": "Malware payload (Formbook)", "value": "30d23f012bfb23cfd27618e7a4a1f8376f30d74b9b7b92d74c9ff032af9b490f968694e387fd0406279adc090519683c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940405, "uuid": "f392710e-5bbb-456c-872d-a091c21962a6", "value": "T138F4020077F73A84C07207F994E695852BB62A5E5577E77DCA5230CD0C62BC08A7EA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940405, "uuid": "13d8156b-1526-4447-812e-a0764ae30d53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940405, "uuid": "6bb68e4c-8533-4905-886b-aead39cb5075", "value": "12288:6C5k+hNpNgJmX36D+o55Cmy6cbCEJ8BDFADuvpCzYxNIm0cmJxoZOSVuAEi1Z1fn:vaKpymn6iovJqSaDwp7ImdmJ+hX1rfqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644940405, "uuid": "83dc4fee-81ed-46d9-a80f-a8efb2280038", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644940405, "uuid": "0da5698d-df57-450e-b2b1-62be3ca66c74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940405, "uuid": "25aed0f6-e7b7-4933-ab8d-8fedcedefbca", "value": "itens que precis\u00e1vamos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9a4819-8e98-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644954689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954689, "uuid": "6481de06-c549-43f8-96fa-430e0cad6902", "comment": "Malware payload", "value": "e96e2bbe4db122abc73bcd5b149488f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954689, "uuid": "0b50ce89-9d93-4198-b1f2-d7c0b0f061c0", "comment": "Malware payload", "value": "21774b77bbf7739178beefe647e7ec757b08367c2a2db6b5bbc0d2982310ef12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954689, "uuid": "6d3e9f49-0698-4593-9af7-f6a53adeceb1", "comment": "Malware payload", "value": "ee355e409203386f92b57ba46dfa5e0ca2574831", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954689, "uuid": "c9330e9e-52df-49d7-bc1f-fa255750d219", "comment": "Malware payload", "value": "f2423badc5206efd2ba8497572cba57ffeb33f2c8f1e4cb77359a667f7bde28b622c043e285b6c2aee4cda8a1281953a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954689, "uuid": "19b38393-bf29-4058-99be-a4762009868f", "value": "T12B563B16F8A204E9C1BEE1358A52B332BAB13CA547317BD71F94A6661B75FD07A3D300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954689, "uuid": "1214da98-bc7c-47ed-8a41-02ac90251c0e", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954689, "uuid": "9aaf8b81-b566-49ac-8d46-1b8031bc71d5", "value": "98304:esQhU4I7nfmadySavKDe8lYhKg+N5qtM:DQhzI7nfmadySavKDe8lYd+NQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644954689, "uuid": "7bcc612c-3825-414b-9416-86fa0be4ada4", "value": 6178304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644954689, "uuid": "2c4ae752-bff0-4b4a-a527-cfeb02c411bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954689, "uuid": "da544464-73b9-4109-99b0-fbc782f62f08", "value": "msconfig.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed91928-8e82-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644945059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945059, "uuid": "a2c15b39-b1b1-462e-b646-2dfa6f1dbc84", "comment": "Malware payload (AgentTesla)", "value": "38b1e27bbfc651131631527e8857a3a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945059, "uuid": "3178d55a-e76c-4734-839d-d967a2fe4a03", "comment": "Malware payload (AgentTesla)", "value": "21ce604f6e8b2926f3da03eb7d8a5d5c26fd77a98534dcc359d6da1d9c41241b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945059, "uuid": "d54ca2b6-e6ed-486b-91d4-4639121272e0", "comment": "Malware payload (AgentTesla)", "value": "9c5156c897bb2e7abb0f94be2441f43c6439503c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945059, "uuid": "7ba71a33-ba01-4292-b911-1364b30b674f", "comment": "Malware payload (AgentTesla)", "value": "de7d3edc20e3dd8900b9d1f69cad91eb083cbc509f01aaf4def748f89b3685188a4c58c3fe94735c1a2a89cef43ee7a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945059, "uuid": "7a13eb54-ab50-41be-a6ba-cca2557bf472", "value": "T19C7423FA768BC2A2318DFD03BC8D994824CDC783618466D7A0D71D57DF282EAC49E5E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945059, "uuid": "ecfea6e8-4dad-4685-88e4-20d1ff4cdaeb", "value": "6144:uyAIEfa8K6MB4EuPcnwAbzhdxMXHMI38J8zobtvApOpdjFzpOJZrSKY9lSzsEUZR:uyAIl54KLzH2sYctUOpdjFzkzrSKY90u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644945059, "uuid": "b0baea36-1fc3-4a18-b351-6c8a25e10e6f", "value": 350872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644945059, "uuid": "01d0752c-5c13-4b1d-97bc-f206a96d492b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945059, "uuid": "3872102b-5eb2-4369-83f0-353183b04e8b", "value": "Purchase Order No. PO-109688.EXCEL.XZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25cbbe99-8e27-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644905933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905933, "uuid": "ca7d20ae-1eda-48f6-aa93-a018e9820a15", "comment": "Malware payload", "value": "f7a5fed7820de2951c00b8f4409cc49a", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905933, "uuid": "eb7140f5-d631-48c1-a800-ec18173f960a", "comment": "Malware payload", "value": "22562c62d63015448747d8eff8d0fbe8ca39d0a61ffd9d0fcf3f51c261a0e231", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905933, "uuid": "58f4f776-88c4-4e1e-8115-04646b332a57", "comment": "Malware payload", "value": "4d4a46e1229866f6b1190855ba5c752b61adee02", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905933, "uuid": "cac673c9-b65c-4176-9ee5-f59fd7a9c8cd", "comment": "Malware payload", "value": "5a0cd61160d66dff880ac41e07582babd0d7d4a3abd848679c7a9b14a336974a53352c3dd7bed3938600de9caca45963", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905933, "uuid": "1f3ae475-3e74-4a87-9480-eb739abfeb97", "value": "T1534129013F079BD3FA9BA2781D3A5261251724BCC302695ADE0041FFFA62648D8ECE84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905933, "uuid": "26cc1d48-88e4-4ef1-8b37-a7dca6139042", "value": "48:s1Zj78FLEBKgODpbLCtwSVJEM32YLlJ65FKIC9sUKDmGjTxkbTlDuFhS:678FLP7DpH+JC9IICsUKD/T6Jui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644905933, "uuid": "2275d601-7934-4d3f-ac28-d751161771eb", "value": 2260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644905933, "uuid": "7f2abe48-595a-4488-876b-9687226cfab7", "value": "application/x-bzip2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905933, "uuid": "35016dcb-7c29-4790-a7b1-c8abe6824793", "value": "INFORMACION DETALLADA DE COMPARENDO ELECTRONICO.vbs.bz2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216caac5-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644953170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953170, "uuid": "c0d6ac96-d97f-4fb8-8325-ca10ee52b72c", "comment": "Malware payload (SnakeKeylogger)", "value": "be44c30d3b7db78cb7b39f827f0dafdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953170, "uuid": "a18c2950-829e-42e2-b92e-65c08ae4aa62", "comment": "Malware payload (SnakeKeylogger)", "value": "23444cee2c83c498f4cde5a70428acabf34f83b7e0b445fa9a888959aa88b29b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953170, "uuid": "77a4d65a-0544-41b1-a1d6-69701aeba08a", "comment": "Malware payload (SnakeKeylogger)", "value": "60c69709d5a6ec0d06afe8182f314eb4ca7451d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953170, "uuid": "7de2d3b0-42fb-42ff-9971-8439ca6a7767", "comment": "Malware payload (SnakeKeylogger)", "value": "0a969a59a3b258a7a780b2acf0cf07fd41022b0e0b651c59f8211dfffda758a8d81bb0621f29136a8a76c5e12c24ea4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953170, "uuid": "7e9d570d-9fb4-40af-9399-bcd1aca69740", "value": "T174F4010BBB2BDF31C47422B544EBD57507F19A9C2137DE7A78BA32D819022620EB553E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953170, "uuid": "8ab509ed-2622-459b-abbf-fe9189e84dfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953170, "uuid": "b52f3bb9-0c07-40d3-a4c0-4de3b58ecda9", "value": "12288:IJxJ9aeaWtJlhkrNkiKdqk1/yzgUP3pkr6tf55jNnC9ILlFYC8sMCljX:IJxJ9Jirk1/Cd/pkrm5jNuIjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953170, "uuid": "6e0291c1-58d5-4879-bddb-449fcddffeca", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953170, "uuid": "816b5fe7-0d7f-4a70-8a49-32cea3dfb1b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953170, "uuid": "80ecef56-c1cc-4fa8-bd0a-da97242bad9b", "value": "Dekont,html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f7d2e1-8df6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884841, "uuid": "ff7aa7a0-2882-4941-8fa4-5e863640439c", "comment": "Malware payload (Mirai)", "value": "4371e0f7fcf88f7e971430f9ef90c272", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884841, "uuid": "018ca011-fe2c-4ff7-8218-46bc82dc6737", "comment": "Malware payload (Mirai)", "value": "252d263bd5dbd64d80852c76ccc557eaa4754b1b61004633ac211f2b924f0bc2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884841, "uuid": "40fd8cd6-4180-4e54-9c31-cb5a115371b0", "comment": "Malware payload (Mirai)", "value": "10608738460c3b0b2d24057d568aa96030bf6e9c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884841, "uuid": "d7bdb3fe-7756-4272-9efa-e6c46cf66a27", "comment": "Malware payload (Mirai)", "value": "707a0a163352ebd38c07a1668aebef5cc45b014e2b15645dd150fe69c6327dc99a5aaf76506e93685851c6e05bec4b7a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884841, "uuid": "dfb1e18e-8c9e-4c18-b05e-cd127bb9c3b4", "value": "T155F33C46EA818A13C4D6137AB99F418D333297D4D3DB73078D185FB43F86A6E0E63A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884841, "uuid": "aaa19b5e-4bcb-48fd-99c2-cc0d2376184a", "value": "3072:RAwo2IhPE+cA9swLpIarRxfGaoNYJrrStkueM/9J4O0Gk:RAwopi+ckbrRxfGa8YlStkzM/9eGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884841, "uuid": "2ab7f798-b00e-4289-896e-3371e1ee343b", "value": 164090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884841, "uuid": "c76db70b-c6f9-4e5b-9064-88b7ced50155", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884841, "uuid": "2e39f806-fb44-4f72-940b-3e2125f22f53", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76411383-8e98-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644954601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954601, "uuid": "cbec2e3f-8ab6-4ddf-a50b-281b544b0cd8", "comment": "Malware payload (AgentTesla)", "value": "00b0261dce3fd1eec61b71fb2efb3ab8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954601, "uuid": "1bf00ac7-477d-4f75-ad0c-970f83145ad4", "comment": "Malware payload (AgentTesla)", "value": "257015ec9c05ee37bf2492c0d41884a8d70347f02664850a55c77379b5a12c07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954601, "uuid": "f011dfd8-c546-4a15-b594-385f7ee7e6d8", "comment": "Malware payload (AgentTesla)", "value": "53f79c1e20aa58225ed2e9f5e14b58e16ed04d26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954601, "uuid": "345b900e-d6c9-44a9-94a8-765e6e5c96a2", "comment": "Malware payload (AgentTesla)", "value": "3bd78fd855ee609d961d2895324c3ee031b1434708b27c3e5cef478159424e216a940b6e300eb97e5a16726f7f993878", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954601, "uuid": "fc5d09b5-5eea-4006-987a-f80d6540c11b", "value": "T1A2051214BBB77A49C9BC57BAB0A2C57796A1466D3303DF798EE272C804233F18535239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954601, "uuid": "a0a76358-b5d8-4c13-beef-542f2a0ef7a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954601, "uuid": "a160926b-d297-46d9-ab70-1d7ea0939636", "value": "12288:6JkobOspvZWhohHKH7u9rRzrFm6xXmuQs+hROHK/7p7CUse8TZYPvGvQcr5Wf5me:6KozBWGhf9S1DhRHloZYPuvO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644954601, "uuid": "327cc3cb-f740-475d-99f1-579f9382a13f", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644954601, "uuid": "822870b8-1d2b-47bf-aeab-6569526480ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954601, "uuid": "e6257929-aec1-4926-bd39-f2ffe33bc0a1", "value": "00b0261dce3fd1eec61b71fb2efb3ab8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388a1088-8e27-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644905964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905964, "uuid": "1b88a8c9-a070-4ba4-bda8-2979a813837a", "comment": "Malware payload", "value": "7ede7937c54078951e5e7a25915149e9", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905964, "uuid": "e93b6305-be22-419c-b55f-f722d2004801", "comment": "Malware payload", "value": "25e28fbb7d7f7aa54c52b6c6d9cd06b1c96527408c665a65581f5c96cfe322e0", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905964, "uuid": "237642b1-5a68-4811-822d-32fed628015b", "comment": "Malware payload", "value": "d89d4f19ca6694fbd9aa29b7cd12c4f7644b2c2a", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905964, "uuid": "7c3935c2-238f-4b0f-9f74-ee09c74e43e5", "comment": "Malware payload", "value": "8ab07c41e3e1dd8e6949f00ddca5968c8d9179f0148ae209e0710ac2b0a73a5604cef7299be34f66df9972c8a394038d", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905964, "uuid": "4d192676-9447-489f-a63f-a5e4bf385ce5", "value": "T161350611146A030FB1626DBC9EC1B8B1899AE3FF160D94B520BE1FCF8652D52D86E737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905964, "uuid": "c3951206-0314-4f8e-bb0f-b58c5012d430", "value": "12288:c1wYbWA1+G9/1uA2KJUHG6zfGxRyxz980:+wYbWA1+G9/1uA2KJUHG6zfGxgxz980", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644905964, "uuid": "282feba4-62cc-4e8e-b296-03558f55bcde", "value": 1076466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644905964, "uuid": "510ac82e-43cb-480c-bbb7-358691749bf0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905964, "uuid": "529d51c0-cb3a-460a-923c-941e558e223e", "value": "eset.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26090d64-8e3a-11ec-9275-42010a9c0029", "comment": "Malware payload (Hydra)", "timestamp": 1644914093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914093, "uuid": "39f18b47-d9da-482a-bc1b-1f6316e28368", "comment": "Malware payload (Hydra)", "value": "99c0124bd826def2b7061ce7ff37b2e3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914093, "uuid": "bdfe37e7-5038-483d-997a-5a6327528b24", "comment": "Malware payload (Hydra)", "value": "26845b2bcec8c8d0bf31ca021ddc631c99a10fbeeaa4ddbbc9bdc73de1bb3a2c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914093, "uuid": "59edf0f6-bab3-4b25-991b-9345d1be763f", "comment": "Malware payload (Hydra)", "value": "0217ace39fe25d09fa3ffad7594b3ab954aba097", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914093, "uuid": "c6a35ad0-8047-4239-9939-352938ebc23e", "comment": "Malware payload (Hydra)", "value": "126babb9092d9652335fe8872fa23ec88d3cd73621fe80d20b582c5f4224aea49bb3a3b0a684eed80c130670498b80ea", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914093, "uuid": "d11e9e1a-a25b-4c88-81f5-27938181adb7", "value": "T1584633D6F921C4E7E7C297B0D360AACA5FB49C4AE47B1A3D910374977CF64A082094DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914093, "uuid": "1e5e78cf-565f-4d30-a759-7807f2981a95", "value": "98304:F/ejiVCMbu79aApO5exJac+2Pp7PXnGdcQai8KNg0RvWRngtCVchi2ag9P:sjou7Pp/AuprGdc+NgmvWC2uQcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644914093, "uuid": "ffe31d80-7770-4cd7-8166-17545838f12b", "value": 5811054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644914093, "uuid": "13c046ee-aa54-4123-b067-db388257330b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914093, "uuid": "2f3f4ee2-3ff4-4e6e-9886-70c61a0f89f7", "value": "a1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadd33ea-8e60-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644930771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930771, "uuid": "0c2323e9-f77a-4e7f-a59f-03e8d68d1958", "comment": "Malware payload (Formbook)", "value": "4c5cd630652c9addab758d6b5fd87eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930771, "uuid": "bd9a65a5-b181-4396-b29b-58d70ae39253", "comment": "Malware payload (Formbook)", "value": "26b71bbd2d7db3c56d4a9058a84233364b49150c3bb7b60edec35d37e34d06f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930771, "uuid": "7715e710-fd1f-47ba-afb5-f5d2af230e6d", "comment": "Malware payload (Formbook)", "value": "557276e8abda029c34fb8070cded3bb720ef91ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930771, "uuid": "229bcfbb-059c-4077-92e1-3e4e7ce81970", "comment": "Malware payload (Formbook)", "value": "10a27f5df9d5d4a9c1ddc1c0e4e630e94ae570367b0c0aef47cf873890f5e0bc5431a55a371f8bddaa582737e029149e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930771, "uuid": "729bf655-f150-4d91-82fa-cebd51368259", "value": "T11AD3BF097365C15AEA6ABA755C85E2B006B8BD853E17C307B45C3B2FFE711EC1E83518", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930771, "uuid": "30ec437a-06eb-4940-bc9f-9030ab9feda2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930771, "uuid": "0365476a-0cdf-4e03-89ea-d1a7a3df5cf9", "value": "3072:5OdV3NmFZen2/LEG+MzPRhYTpOaYmHzQVp3:5OdKFQ2/jzRCDDQVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644930771, "uuid": "3bf0563b-2b20-43d9-aa7e-31cea6ca70fd", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644930771, "uuid": "ef6ad2cc-245a-4ca9-85fd-017cc5dd6294", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930771, "uuid": "d1fe4d59-6dda-402c-b23f-a424f543419f", "value": "PACCHETTO DHL AGGIORNATO CONDIZIONI SPECIALI, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754d54f1-8e86-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644946868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644946868, "uuid": "a51c6eda-8d80-460e-b62c-91ca3a694f55", "comment": "Malware payload (Quakbot)", "value": "b9c56868337cbcec02a779d2d5f63d6f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644946868, "uuid": "c3ac889c-be32-436b-9a24-55988718a0ab", "comment": "Malware payload (Quakbot)", "value": "27314cafe0405af9d1138ba69e349ce669ffe212a6d7435889075f2942c32c63", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644946868, "uuid": "8dbd2a99-c542-4c44-98ee-8e25f5c94f4f", "comment": "Malware payload (Quakbot)", "value": "5bec7960ea90923bab32023cfedba31bc90b7eb8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644946868, "uuid": "2c5fbc13-d0cd-4e39-b1cb-91cc0ba2c0ae", "comment": "Malware payload (Quakbot)", "value": "882c554be62d5736437783976390018da147bc9e6408950c76fffe1e51faa6a0463d800bccac8235350cc7211d60eb7b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644946868, "uuid": "a41681c6-6dcb-4fb7-99a5-ae4fe3c55d83", "value": "T1F2358D3271C1D5BFC4B236BCAD6A71A988257D520D2CCC0DBBD84F4E0D7A691673229E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644946868, "uuid": "b7fe0012-9ce2-421c-80e4-f8b599164d01", "value": "220ea7972e993d1cdbf761cab8a71a9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644946868, "uuid": "7272728e-3bf6-44fa-bb04-8c87b655939b", "value": "24576:yuwgYKvPteX5lNEZYyjPKFYY22OlWc971Zkqtu2K0FCFra:dzleiPa122S9k2Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644946868, "uuid": "28022ffd-f02f-44dc-8379-9cb092aa6d3e", "value": 1097200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644946868, "uuid": "ca12d818-fd4f-4229-9b84-2bc52cc188a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644946868, "uuid": "9ca7cc8d-e871-4f1c-a311-af7d62cc2f8e", "value": "822330420929752(1).dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79f7808-8e8d-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1644950066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950066, "uuid": "36f7e94b-3651-412c-8436-041130104484", "comment": "Malware payload (AsyncRAT)", "value": "c2ecc2948f5d38a32023cf6e1ede8584", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950066, "uuid": "1d9713af-77c5-4990-9826-51ad9e2d2ef9", "comment": "Malware payload (AsyncRAT)", "value": "274422d8fb0a807ee41552012c99ca2573555c43a3314968554836c1646f4c15", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950066, "uuid": "7a8bf385-ced6-4106-8377-8564abe843a1", "comment": "Malware payload (AsyncRAT)", "value": "3d7007acc57cb47ab18a37f3b70ad2260d57f045", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950066, "uuid": "b0d7b08e-d7c8-40b5-af43-62c811edc80e", "comment": "Malware payload (AsyncRAT)", "value": "7a9c2d66595957518c9e37a67dee5b192a396f83788256e3f0fb43f42ea106cbb576b2bd8b11123299829a254f016ff3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644950066, "uuid": "f66dd81f-3148-49ea-9f74-79f699aaf2a4", "value": "T11D1305F556A45EE1FAF61F34BAA7D930300ABF278C93BB593F98F0D01671A0C8549960", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644950066, "uuid": "a143a237-f7da-41ce-b229-246ffa69ad7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644950066, "uuid": "6e145ab4-f7ba-4799-b635-512591570ede", "value": "768:butWv8UuSMztM0rV3tlgG9aoz+i9O4UNH55eFlSrm2EG1:lvvdAs8yBRI4rTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644950066, "uuid": "ff8c0f0e-7c2e-4516-8118-5af717eb8640", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644950066, "uuid": "a51d7f8b-9248-4361-a0e9-f660e5b7a74e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644950066, "uuid": "33e26945-35de-45ca-b74d-ddd787808c5b", "value": "VOICE_MESSAGE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e3f1a2-8e72-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1644938279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644938279, "uuid": "270ec7f2-67c2-4c77-b5db-a6d05026a247", "comment": "Malware payload (GuLoader)", "value": "301764731dd2e85d389dd1748bb790ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644938279, "uuid": "8a7b7c52-c5f7-4389-9de8-0b820ac99b0b", "comment": "Malware payload (GuLoader)", "value": "27a07b171cbe266f9cf4d99773e37f37c14161a877832de7ef28a0d3ad01ffdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644938279, "uuid": "ca51ce4d-e4d0-462b-9654-6be1f1f4e2b2", "comment": "Malware payload (GuLoader)", "value": "370e7c0795f8ec7f3c8202fa565f9ec50cc7e04e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644938279, "uuid": "d539cbc8-dd31-4544-b953-ddb668111868", "comment": "Malware payload (GuLoader)", "value": "51de78bc5206fe99f9d1f5ca313c1878cff2ff0a940c17fb952b7d40510f6a5c386d444d44d2bd03bc206fd02bdb7a96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644938279, "uuid": "e413f99d-bf27-4da8-ad89-d51aeb8c4122", "value": "T16A34E1047B41DD96D072097508A8C7BACAF7AF102628CD8787857E7CAD372D0EB3A756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644938279, "uuid": "a6568811-677e-4d38-99a4-c11a3961cc95", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644938279, "uuid": "7f0cab88-e2fe-4bbd-a663-e243ca64f986", "value": "3072:ybG7N2kDTHUpouNbIbMP+j7/7uvGmthDQx8DU9v0uH2ZlDPTZkNiiSePh:ybE/HUVuM47/71mox8AvqZlOEiZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644938279, "uuid": "13b76fdc-3598-4caf-b67a-d6cdda39321d", "value": 231232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644938279, "uuid": "84e571f2-23e9-461f-a957-187222259b0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644938279, "uuid": "ca70597d-8973-47d8-9fd6-0b16dcfc3339", "value": "Swift-copy_invoice_confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c19cab-8e02-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644890172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890172, "uuid": "12feea81-b004-4f0a-a189-be280a50d7c7", "comment": "Malware payload (Loki)", "value": "bd68f6a48cebab51f5acc7e4eead6e86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890172, "uuid": "aea51807-34b5-43f2-bf27-340631b28f05", "comment": "Malware payload (Loki)", "value": "27dc03963f5f376849aeca0b57287278ee93f79bec32a3786b921efcb8dc944a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890172, "uuid": "2ef7fdb5-0423-4f2b-a512-58e949e4ca9e", "comment": "Malware payload (Loki)", "value": "f353b148f6138ba478886269902a677056f9fab8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890172, "uuid": "fee44f5f-d930-4c11-9d4b-eb2dba412dee", "comment": "Malware payload (Loki)", "value": "9bea8a7e9f870b50a5f5fba600db734a69d0bcac2d87c77b45e99bf000ebcaf54883a7017ef9a9ce779bce95004381bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890172, "uuid": "f113274b-9e10-48b2-841f-389daaf12eef", "value": "T1E0A32A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A18215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890172, "uuid": "4c06b9d9-4f05-4bc7-bb41-750bc5af6f21", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890172, "uuid": "ab32e5ed-67e9-478e-b206-2c2efe24a310", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644890172, "uuid": "694847d8-11b7-4db0-a2d0-bebfc97dd73e", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644890172, "uuid": "2b9cdffb-259e-4db4-b42e-60f96f063fd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890172, "uuid": "d34b409f-9745-4783-9e61-cb8a0756f382", "value": "Purchase Order 339792675.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9957387-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644953452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953452, "uuid": "11ccec22-514c-47b5-ab7d-58790a053fdc", "comment": "Malware payload (RedLineStealer)", "value": "30784869c3ecdd13079a435f58adcd9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953452, "uuid": "7dadfc64-8e90-4da1-88fc-f7036ab1b186", "comment": "Malware payload (RedLineStealer)", "value": "28b37d67a0ba8991fbae8ea2048f44ee06d8c3df823750e585ca0322df10ef14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953452, "uuid": "c1e36abf-2a37-4d93-979b-825ce7d07d24", "comment": "Malware payload (RedLineStealer)", "value": "3754f851ba97700f49f57019c88772ccfe9d2f9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953452, "uuid": "4007ad63-22d3-4c88-9c3d-06721376eb8c", "comment": "Malware payload (RedLineStealer)", "value": "a097e17c5177aa9b643141dee1a23e0090ce0c2856072a4e05a62ac8790fbb811972ba18cc85d7d5a4b7517bc018e9b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953452, "uuid": "daf40743-210b-46ce-b725-e6043e8e2d74", "value": "T1B6D4127913F88C4BDAA51AB040E2D63616E04D91EC96CA02F0F6BDDB7635BCD2D091DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953452, "uuid": "f69416c0-cbba-44ce-92dd-6fdb5bc731a1", "value": "eac773fa60e36d5c5c3998e78642c7e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953452, "uuid": "30646fdf-6415-4357-bce3-1240090e397e", "value": "12288:hxwm1AUnvqtvsrD3UIXgdfgjwwR1mW96kLBzwOk3qOA:hWevqtv6D3XgdfM37COk3qV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953452, "uuid": "85301541-ea80-4acb-9a5b-4bdfe11e74a9", "value": 653744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953452, "uuid": "fb9cc4c1-69c8-40e7-b284-31b3a51fd30b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953452, "uuid": "6a2d5744-17dc-4efc-b81b-3936363ea76d", "value": "30784869c3ecdd13079a435f58adcd9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6414ec30-8e98-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644954570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954570, "uuid": "011a5653-df62-46d9-9905-88d76e55d035", "comment": "Malware payload", "value": "b06a726b219bc7462588fd19c0692082", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954570, "uuid": "ccb92545-4a2d-48df-bb20-e4a50fc4fdbc", "comment": "Malware payload", "value": "28c7cf44b3e807123147ceff617a2939f7a1c5ede1ba93044e93374d2a6e1d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954570, "uuid": "2ae20345-2f96-498b-b949-368ecc55ea7e", "comment": "Malware payload", "value": "48b12c3895870042f3ffc23a52b12377f1f77964", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954570, "uuid": "8742cff7-9395-4057-9fc9-7ed441806a1d", "comment": "Malware payload", "value": "b819aed970717ca29f8c89b0158551234bdd1ab00216000900cc65f86e61752a317755368775d687f34b77766780e595", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954570, "uuid": "06a204ae-89c5-41bd-b7ac-8a26f57053ce", "value": "T12CA37C0231D484B2D406447101654F739B77FA361B2FA983F764A9D27E60BF2962EF8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954570, "uuid": "e5f5bdee-ff06-4991-93f5-188b78c03d51", "value": "189b0e4751fb61bd6cafbfdc0138fd3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954570, "uuid": "99b75715-6490-4466-8d39-72b6a254a50a", "value": "1536:HlcfoGRYBmOTEnPisxF0oIV0dY5oHKB92GrPbKH+M4tVAZhZcm:HqovTEKsooIVu/Hs9dbKeRteZ8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644954570, "uuid": "85e14602-1e1a-48fe-b4ff-575ae5025bfe", "value": 106622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644954570, "uuid": "f02f0eae-6f78-44c1-a4ee-b100f4ec9c2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954570, "uuid": "cb25c512-7de1-47a6-8ed4-6aed5bb9ac75", "value": "b06a726b219bc7462588fd19c0692082.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7957f38-8e48-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644920351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920351, "uuid": "1df40564-3f22-4226-be9b-cc4c720565d1", "comment": "Malware payload (Formbook)", "value": "83ccc444bf7e44e2ed9142e5c975e1dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920351, "uuid": "1c2272e3-db44-42f0-a688-b7bebb06b8e0", "comment": "Malware payload (Formbook)", "value": "29d23710bef2e9821a27d4d0a74305d582ba41d206d3b48b6762e4f3d78b19ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920351, "uuid": "90feb750-d171-4618-92aa-b8a98f7da902", "comment": "Malware payload (Formbook)", "value": "584dbf9739eee88ad51030154c64844186d17a3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920351, "uuid": "07d86238-a506-4e51-8473-4b53041a0d25", "comment": "Malware payload (Formbook)", "value": "190ff0284a1149bb27910fb3f11a5c6ddb5fb492db1b3348876f36eb2fead1fe98108f4708f55f4d5263d093acabd3fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920351, "uuid": "7e375b53-64d9-4804-814e-db96a8f44fe2", "value": "T19FF3FCB4B6D0A917D030C23748924ECB12FC9D506AA21A1EED847727D8F5ECA7945EF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920351, "uuid": "37eb1a45-4e9b-4753-b924-afce134ef72e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920351, "uuid": "c794b6ef-b9fc-4eed-ab43-de7d19977b5a", "value": "768:ziQ+B1Y7pOdaPm7z24hMMUcwIeuatsOMoMpY62h+f6XgZPGM:ziQ+d20MMUDjaxoMegfGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644920351, "uuid": "025064b4-ba25-4f5d-8571-abec8a09614b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644920351, "uuid": "8ee7d27a-9ef4-4890-bf2f-8575f348e511", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920351, "uuid": "db14fbf6-981b-47ff-b4b1-80fea37491e3", "value": "TransferenciaInternacionalemEurosparaPaisesSEPA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e04c3e7-8df6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884847, "uuid": "2a246c8c-3dd0-44c5-b3d9-b6c513ca61b6", "comment": "Malware payload (Mirai)", "value": "6c452bab787543c55085494342165fde", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884847, "uuid": "ea5637d9-c958-441b-949d-bde3529aa57d", "comment": "Malware payload (Mirai)", "value": "2b3a0ab48d4832210cd69c109812ebe7cbf6d8cbb34afa71b8e2ad1a1a67f56f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884847, "uuid": "1c89225a-fcbb-42ab-9c71-23a5826cd034", "comment": "Malware payload (Mirai)", "value": "82bdc18cfae06cdea144247b4b09f54082c61921", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884847, "uuid": "493d6ec6-bf44-4c97-a1b0-0bda2319155d", "comment": "Malware payload (Mirai)", "value": "51ebdbce4ac506098ec3a3ec931fa43076f5dddb20f3ec795a04610f3eb57b16e04ba22f669835a4db930508d2831212", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884847, "uuid": "30136268-c3bd-4922-92d7-8b534dc5d2bb", "value": "T13BB3840E2E319F6CFB9D923947F78E21964833D536E5C585D19CEA012E7034A341BFAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884847, "uuid": "38ef4139-302a-43ed-91b0-b73c8edd6090", "value": "3072:UB6VkBKLclHRCroSafBazSVENsFqnee6ox:UeaKLc1RCJ2a2iNsFqneA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884847, "uuid": "6a1ba289-5be6-4842-92cf-cc83c0b8d5a2", "value": 113976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884847, "uuid": "8311d574-8c03-414f-9bf4-12a695b7aa87", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884847, "uuid": "542066e9-98e8-42a1-874e-1018cf88c7c5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968e1d3f-8e51-11ec-9275-42010a9c0029", "comment": "Malware payload (DBatLoader)", "timestamp": 1644924161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644924161, "uuid": "3b7584aa-cb02-4a91-b94a-5d18fb0a8704", "comment": "Malware payload (DBatLoader)", "value": "53c86188a87b8d0a73187e3ad6bfc30f", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644924161, "uuid": "dc5b8df9-8ab7-4b41-87c3-7165f119e110", "comment": "Malware payload (DBatLoader)", "value": "2c269830f25ce16896147da503148a0f223f79d05f27875e5beafbaba56cbf59", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644924161, "uuid": "4b1d4dc6-7fd6-4202-9e20-7a276745705a", "comment": "Malware payload (DBatLoader)", "value": "a38f2c353574b3d1deb4d7fd6f4d88f31166906a", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644924161, "uuid": "a2900642-16f2-487c-8848-c60ba566bb2f", "comment": "Malware payload (DBatLoader)", "value": "a7c9e6413bbae0fba76d37d2e564b89ddfafa149a2c43cfddf3434bf920a600a33589cdead89caedfbabb46cdd2d8ffa", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644924161, "uuid": "0e4f12c5-c0c0-4e39-99e5-c090b2d8fa27", "value": "T1A1157C12B5A08036D52A19B6CD0B93E07919FEB63D18AD0B3BEB3F4D5FB52807436257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644924161, "uuid": "585ba0dc-f466-41bd-b4d4-d361d6e62531", "value": "395245e59962be96e38956eaadbe8ace", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644924161, "uuid": "418c5710-48c1-4d42-8fc2-5cc307477256", "value": "12288:MHJF21eFz0BwfJ4VOTKQLzjgmXWr9ioR0i1K2KPRCT+SNR:MpFArifJz1z3XM9ioL1KPIT+SNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644924161, "uuid": "9d45a081-836a-4b24-8646-fb4197a187d2", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644924161, "uuid": "ca60691e-357b-4bad-a38c-1aeb1ecc1b85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644924161, "uuid": "b1c808d4-533e-464a-88e4-9b398746daa2", "value": "Silicone Pallet Mould MMS Request Order-015559.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a3a538-8e6b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644935249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935249, "uuid": "a7359136-89d0-43e3-9c1e-f1c0b00ba7c2", "comment": "Malware payload (AgentTesla)", "value": "4fcc37a981d36cd232aad14dd35c42f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935249, "uuid": "3ed5de64-b16a-4f7a-b1bc-bf35f7b608a2", "comment": "Malware payload (AgentTesla)", "value": "2d3d62a31f691814cac1c697e5db1562aceff3221ad4c19215e0f30275c53d9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935249, "uuid": "abe219cd-3db1-426e-a4d6-cd7ccc528b57", "comment": "Malware payload (AgentTesla)", "value": "7c76c6178f2592d86598d9503b52f7f5d23c7107", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935249, "uuid": "ca3a92ed-b48f-401d-bb75-e56ed8442bb6", "comment": "Malware payload (AgentTesla)", "value": "10ae29f5f8dca14358c84b446ea344f53d0a2a18244770c1d88222aaf9b734000d2e679db540b01bdb7e0fc799287c95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935249, "uuid": "28c98fa6-2d33-49ef-b855-5a28611a4201", "value": "T147150117FB2BEB34C06417B604EB912607F06B8D2237DF762EBA72D819512920D7953A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935249, "uuid": "e5a7e561-701a-40c6-af44-d67fe71e09a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935249, "uuid": "b2c6a2e8-060d-4afb-aca6-bdc2db3732a3", "value": "12288:RD6LS2XNkLSlGBCNSZ7kMIkeRNvEIfCHIXckgZ505WGDg9vTR0Mayh+vjv9:RD6LSBLQGBqIiR7UIs9ZuYGU9lfayh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644935249, "uuid": "8ee4bddd-0359-4192-832c-d02507582500", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644935249, "uuid": "49433ecb-d73e-4ac4-bf07-0524795a6934", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935249, "uuid": "190c36c3-0183-4cb4-b157-bef35207f770", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ecae18-8e4f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644923160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923160, "uuid": "750666d9-df35-4db9-a40e-f5d33ef0915f", "comment": "Malware payload", "value": "85fe6affdb218b2d09a59e08e80eb1fa", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923160, "uuid": "33a20983-9427-4c6d-b2a2-214f37ecf4ac", "comment": "Malware payload", "value": "2d9d95bed6a6108802fa7c750cb66f2acce7b124f790ba552ec009c4d1d20744", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923160, "uuid": "06d5580c-d9b7-4c9e-ba6f-e9454a416045", "comment": "Malware payload", "value": "724cda52f18c86272eb82444644e6ebf0a8d4123", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923160, "uuid": "a6f6f412-e715-45a4-82a4-5a0d125e2a74", "comment": "Malware payload", "value": "e385f29fa1b685cf01423007875ae2461de22431cd17ee6ce3ec05a1d7d75e525f7ceea7bc07761407ac947c168c8643", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644923160, "uuid": "cb216aba-ef8d-4ea1-abda-0e905ec52863", "value": "T1D58423000FBDB7B8E72054B2BA25D5C39DADAC8964865E2559FDDC209E4CAFB4D5C303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644923160, "uuid": "2251bc92-f22a-4831-9155-e1282daa9804", "value": "6144:ZCPh+TeGIZpLRq8Ss/ZDKv46+QYtvzHGk+nJRad60v/LTbq7d/:ZCXNZpFCYNICoOW7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644923160, "uuid": "7f36cf90-dfe6-4266-a93f-7e594095c106", "value": 400000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644923160, "uuid": "06aacc6d-a0be-46ef-8212-08891653c0da", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644923160, "uuid": "d4b20c5f-5f4c-448f-8cda-abb6ff6d8da6", "value": "2d9d95bed6a6108802fa7c750cb66f2acce7b124f790ba552ec009c4d1d20744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62425146-8e03-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644890572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890572, "uuid": "6e53921f-40e8-44ac-945c-a73b364724d4", "comment": "Malware payload (SnakeKeylogger)", "value": "a4882b76c9b4563a22d778d65f60faf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890572, "uuid": "4fb6254d-b338-4fa3-94f7-bb4d7b0cfabc", "comment": "Malware payload (SnakeKeylogger)", "value": "2ed270a1391886d1a9efcdd92080ec22c9a82e1ea3e8c711575407075a421e21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890572, "uuid": "a2d238fd-d3fe-4c55-a0fb-9531258e2a9d", "comment": "Malware payload (SnakeKeylogger)", "value": "358808efbaa923f786d75b466815eb65008f339f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890572, "uuid": "6fe58c7c-9d84-4334-a279-818d3f74a5af", "comment": "Malware payload (SnakeKeylogger)", "value": "ef56b8028bcabf251b9e5df5f8ff5f8c26e2ea67900234b975920c211b5751654be6950b43548445b448c55944bbb0c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890572, "uuid": "cba46851-cab0-44a2-b22b-c3abb9b791ae", "value": "T10445EF2F087E223AC5BCDBB18985CD2FB992CD563533981C299639D955367F230D222F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890572, "uuid": "f307b273-9593-46f2-800e-7d6e8c33c080", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890572, "uuid": "b38e46c1-3ca3-4fd7-997a-0641a14db4ed", "value": "24576:RtB27iJrdVta00Bqj1UEt8LHReOEX7MgYD+aTHGea9:NPUBqJUpLxREX7MgYDvHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644890572, "uuid": "023adad9-36f9-419e-9121-677f038164f8", "value": 1221120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644890572, "uuid": "fa0fb343-9387-41e7-b5dc-e9ffc7822e7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890572, "uuid": "73178165-4e39-4727-8a80-476495572347", "value": "a4882b76c9b4563a22d778d65f60faf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef5f579-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (Arechclient2)", "timestamp": 1644953515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953515, "uuid": "c89aa928-4ad8-4ddb-8d42-077695e34c97", "comment": "Malware payload (Arechclient2)", "value": "513063ab0a94d02246819037fc4ff367", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953515, "uuid": "220bac2e-0146-4c38-bb53-40fb22e15945", "comment": "Malware payload (Arechclient2)", "value": "2f36ee823b99fa267e18ccdacb35a8eff21625ae519ca32947e0d5823c344186", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953515, "uuid": "0a0f308e-13b9-4919-b9db-3f7853a147f2", "comment": "Malware payload (Arechclient2)", "value": "73b9007c46785c847d3a23108f9982b7e37548f0", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953515, "uuid": "a9dbf308-1fb5-4311-af6e-4bd8d978c28d", "comment": "Malware payload (Arechclient2)", "value": "fc3397ce53c99c900801d936b4511910ecab25e0702547c6682d0c2db65622b87efea36bdd6c688b64e2e08a627f335e", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953515, "uuid": "f8cf1db8-47b5-40c0-8c36-ffe4405f7431", "value": "T1D2B599C933A19013E8635A704F9387CA172DFCA2BE70719B7364F72E1A3A9D26D64711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953515, "uuid": "560586f7-ad28-4a27-b4d2-98100cea47ae", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953515, "uuid": "5951f09b-a043-44e5-b006-9696406b5707", "value": "24576:K5yQOnmS46pxfh0enOKyKMPFc+jCo8uDBMbNBScHNdESl:KsQOn346pUjvP67o8uVMbT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953515, "uuid": "b4a29f55-4bad-4f0e-aa2c-8d8b36598e43", "value": 2375680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953515, "uuid": "01339e65-1f14-4c0a-bfd9-67bd220b61a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953515, "uuid": "f82f7a24-1a5d-441e-82f7-857a59b13772", "value": "513063ab0a94d02246819037fc4ff367.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e3a279-8ebb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644969575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969575, "uuid": "06428fb6-c4a3-43fc-82c6-410c843971fe", "comment": "Malware payload", "value": "a0dfab58c7663d20a489e5948b96b01f", "object_relation": "md5", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969575, "uuid": "2d48fccd-b18a-47f6-a27c-d7231f757d50", "comment": "Malware payload", "value": "2f66e12d5f65fad1c9e562115fbf079e0d0dd9b960d8130d30c03e2eb7040584", "object_relation": "sha256", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969575, "uuid": "ec2914bd-fa8e-4d4f-a36e-5dcea361cd4e", "comment": "Malware payload", "value": "2e4a21e2783d1b611836c78c905e56658c5fe789", "object_relation": "sha1", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969575, "uuid": "80ba3c03-a71b-4d4f-b6a2-9abcbc322156", "comment": "Malware payload", "value": "158bbe424f324fde2849592f17ff05e4245650403d8040b32a9105ee99a6e11836b10778872f28f41b34a9ff3e275fdb", "object_relation": "sha3-384", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969575, "uuid": "af97bc0d-5285-458b-8b46-6fdddcb602b9", "value": "T121C39D1074C1C9B2E57219304960EBB15A3EF9741F21AEEF7788567B1F341C2862AD7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969575, "uuid": "134c749c-6077-47fd-aed0-4484d3bec0ba", "value": "277bb5bca79f7661398975c7af5ce7ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969575, "uuid": "94afbc4d-7cb9-4a33-ad33-ffb978f11448", "value": "3072:05vUIjgiKb54RAYC5B5mAwCEOaIx91R6CW454DOeMqxSXc:0dRgvb5wAN5mAFaIaRM0SX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644969575, "uuid": "bf02b80a-118b-4f25-8612-f9cd42c65414", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644969575, "uuid": "1c7c06a7-a9ee-48f0-b01c-d12079a7058d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969575, "uuid": "a69ce217-db39-4bf5-babe-f77cccbb6179", "value": "2f66e12d5f65fad1c9e562115fbf079e0d0dd9b960d8130d30c03e2eb7040584.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f2bc153-8e68-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644933839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933839, "uuid": "f39d86e1-972a-4e75-9ba2-b8d1cfa87e8b", "comment": "Malware payload (Heodo)", "value": "abbae5897716cdcdd536ffe895fbedf5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933839, "uuid": "a01642a8-81fa-43ec-9184-38ab32e1e602", "comment": "Malware payload (Heodo)", "value": "2fc353cd5cff465d3bfff18b327ad42205bd4f17c5a538b128291d7d97e50879", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933839, "uuid": "69d313b7-14c9-43ef-95b5-145db799ead9", "comment": "Malware payload (Heodo)", "value": "dae1da8cdb29c2715665f0793bc5f4342d9c639a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933839, "uuid": "be3d8a3a-dcbb-4505-9a41-9e27904149a8", "comment": "Malware payload (Heodo)", "value": "dcebb0ba4e6a29de4603282c25ed4a3b69b5d6c21b2f370f804b5df60da281f3e5c65ef3f35f2c97c0a4a343b17b98cd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644933839, "uuid": "2e45d56e-74ed-47f4-b19c-e4c6407eaa21", "value": "T1F0943B3C25619C30CBBA38F765F952E7C18F6C768BDC1A9B57FD01272D28E808938956", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644933839, "uuid": "6b610e4b-2405-4841-ba52-c450edbb5af9", "value": "81bbe15a668dc4ae3d5f7e44db90ba82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644933839, "uuid": "fc0d2295-df93-4c27-be55-d5bb05f95d70", "value": "12288:BKx9m9TwSW/eFj5PWWWWpUUUUUUUUUUUUUUUD69O:BUmhwSWW7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644933839, "uuid": "b7e0ebb6-937f-41ff-b958-58a993e83114", "value": 428094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644933839, "uuid": "d784e07d-8156-45b2-a8f9-ad01bd8a2bca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644933839, "uuid": "25f99eb5-0638-40ed-a632-eff60ef4e35f", "value": "emotet_exe_e4_2fc353cd5cff465d3bfff18b327ad42205bd4f17c5a538b128291d7d97e50879_2022-02-15__140353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1bbbb3-8e6e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644936657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936657, "uuid": "a48577fd-d65d-4ea9-9db4-4e5628578922", "comment": "Malware payload (Mirai)", "value": "96861ae5be30da5f963339a862301e41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936657, "uuid": "8269c5d2-5738-4508-9be5-3f20d3a66a34", "comment": "Malware payload (Mirai)", "value": "2fdb5cd3437d879641a8899a0c8efc948bc1441e63d82c83257356b93713b8e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936657, "uuid": "012cadd3-051a-4ee2-b3c0-82ebd116ab7b", "comment": "Malware payload (Mirai)", "value": "1315946a7416465daf7c027e3c865d1c799554f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936657, "uuid": "8766973c-f0b2-4d91-b31f-cb5a8338ed3b", "comment": "Malware payload (Mirai)", "value": "ebc892838ccfa5a37bfbcebd36c17ce02bf292f3187cfd55e9fca2e97eeadf8c5c43ac8f24076d8a561c394c427195f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936657, "uuid": "86def1b6-4b77-4cde-8cd9-dbfeb29fbf14", "value": "T1BA83C80ABF610FB7D85FDD3749A91B0228CC554722A93B767A70C928B64B24F19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936657, "uuid": "0cda0a2f-cfd1-4c48-8c05-78ad15287524", "value": "1536:B5nFmqc0m7Gp2CA0wSn58fzGl/WjZxb1g0/wP:B5n82m7fCXBWja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644936657, "uuid": "ec9c0b93-58a0-4511-afec-e6adff518e0e", "value": 85612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644936657, "uuid": "9b6fa917-b70e-4c91-a959-b803322e5079", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936657, "uuid": "4845d9dc-51a6-489b-a4e0-aea311003ec5", "value": "96861ae5be30da5f963339a862301e41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ec35d0-8e05-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644891300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644891300, "uuid": "75bbca9c-513c-486b-90ac-1179b5b99d17", "comment": "Malware payload", "value": "e3ba01211662f2a72b070ed82ba70dab", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644891300, "uuid": "c883f181-33cb-4c75-8b18-e9677d7be33d", "comment": "Malware payload", "value": "30980176792fc176767dfd338ef7fd0b73f04b66cd63e1e3b0bbf485bc064ed4", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644891300, "uuid": "82d2a470-6caa-4b76-bcd2-479a36e3539a", "comment": "Malware payload", "value": "487544a52db678bb99208df6c7a1bbbfd28caa31", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644891300, "uuid": "998a3bbb-6811-4713-9ffd-83c832669976", "comment": "Malware payload", "value": "30bda2a271c9d2a90bdbc14cd8dd61602113a4c1b5c519ee118a8ac69189ae7565c201d7492f7cb097ecdb22eb900b12", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644891300, "uuid": "81bb5323-42d9-4fcf-a3f8-27c3229a1498", "value": "T114C48D57F7C7FAB0E6BE827A86B1891C527774520260A78F674072896D23392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644891300, "uuid": "adcdf99c-4fa8-4a3d-88ca-51d83ae6bb62", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644891300, "uuid": "d2734d38-8f51-4465-adda-b69ce8b93bc9", "value": "12288:Un/zDvGHAykHSzLW/4+8bzbBSreMdsozgFK/UqW:2zbGHAzHAjX1WcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644891300, "uuid": "a0d2457d-75af-4fb5-9678-19613573a40e", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644891300, "uuid": "fdc35008-756d-401b-baf7-af538aed7e0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644891300, "uuid": "90621b3e-049c-4997-a4eb-844ec252bb75", "value": "scanned copy.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8038d708-8e03-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644890622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890622, "uuid": "3e64329c-68a2-4ea2-9ab8-fe4b7a654c00", "comment": "Malware payload (AgentTesla)", "value": "5f9fe1dbc14e3e1dbbafc7d7eaefa9ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890622, "uuid": "a07a2d16-4a5a-4797-931f-0c36d1e72b88", "comment": "Malware payload (AgentTesla)", "value": "32891022397f72d288c5949a023d9ecd514450d8116e9138dc03ea40533ae348", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890622, "uuid": "3966e367-3072-46e1-a457-21212bee3b15", "comment": "Malware payload (AgentTesla)", "value": "c113699c00cb4439a6e447a44f47b8d6b18a043f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890622, "uuid": "21b44555-7724-4a12-b253-8689d0d8b129", "comment": "Malware payload (AgentTesla)", "value": "9036556d1ebee3ac37f3c42535bce47ad5a52b7da7581b94f49cc79bd098aee2282661157ed56a696a2547c066a43fc9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890622, "uuid": "de1edc74-9b03-42ab-adfd-2db0f09ea2d8", "value": "T15E24D9B4684F0872C309DC1E25A8B655AE79FEE374C554B223AFE034CF5AAF29EC4541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890622, "uuid": "37bae393-c345-4d20-ab37-7284eaf727b9", "value": "1536:i7TDYAEUOyUlBf02seBYCocITlXZVmVoQRbxeN6dzFz76mAg5eeVhMDw5wfLU:i8iOHkRktdzFtr5RDAw5wfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644890622, "uuid": "8f36eef5-ce58-4015-9aea-b0249c210bd8", "value": 223434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644890622, "uuid": "06ce1dc8-c96c-4f58-aaa9-84252a5eb265", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890622, "uuid": "d9886682-596a-4582-81f7-4b696bf5e615", "value": "MV ALBY HAPPY.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18fee1f0-8e59-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644927386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644927386, "uuid": "e0c735eb-7165-4561-96b8-397c996b9332", "comment": "Malware payload (Formbook)", "value": "e9118b547a050efd33851860424cc7a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644927386, "uuid": "caeab246-2b76-422b-8c6c-0978afc302ff", "comment": "Malware payload (Formbook)", "value": "3356a1d5d011f9117000a3f5326a8eecc0fc0d9ba156af4f634891b19c63773b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644927386, "uuid": "c3a79df5-3d4a-48c9-b72e-3b32a72fad0a", "comment": "Malware payload (Formbook)", "value": "5ee407f818264b9312c0865ec50a0c34d9abe048", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644927386, "uuid": "2e7e8dba-3760-4a23-b410-af67a8acb92a", "comment": "Malware payload (Formbook)", "value": "be14b3fb28a51c3707b180a965cabf54b696ee107d171dd86daf15a6b3fa97690e3ff4617bb68a1d663e2f72eb365f4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644927386, "uuid": "8390a1d4-6418-46b8-9df2-ea4fb9e05ded", "value": "T120F4014073B77A84C47607FA98E5A4815BB5A65E6427E63DCA5334CC1C32BD0893FA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644927386, "uuid": "635c62f2-e8b2-4acd-9a0d-fabf02b8d846", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644927386, "uuid": "ad996c99-d003-4bcb-a95c-c460fb80d1e5", "value": "12288:G95k+9SZTjX/dAHaI17BaOK53Byfe6aRLgnEq0ilQIPMQL700eujtkm:AaJXmt7BaOY3MmRUr/l5hhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644927386, "uuid": "1750c922-c57e-46cc-aa47-86459c8e0d2f", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644927386, "uuid": "f72c6d5f-47d6-47f9-b469-c383bd1bc760", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644927386, "uuid": "cb6697f1-b9f7-49c8-83f4-cef6a5f8d9c6", "value": "hoR2pSSXDkkpsig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962e806e-8ea2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644958949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958949, "uuid": "e357a906-176d-4e09-a895-50acb40d0a3f", "comment": "Malware payload", "value": "735137b773f77a713501f041da6c7860", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958949, "uuid": "b1987ab6-a398-40d1-8924-54c744e5d143", "comment": "Malware payload", "value": "33719a7f91a441698ff58bf45bce7136d68752c42e884e361175182414ab6e06", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958949, "uuid": "e7bc0cbf-537a-4826-8762-7377b1ba43c3", "comment": "Malware payload", "value": "80c3c722401ca3ac77fa063a0277f8fedd53e933", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958949, "uuid": "72d3fc19-430e-46bf-8ea8-58f90e72eafe", "comment": "Malware payload", "value": "a54d2fa31994f30c2ebb7d805b19d81fd531f31f4182cd1aadce9e595bcd1641d7d70ac99d37d878bd4b0df22cb7a761", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958949, "uuid": "1c081b71-073c-4eb3-85bb-cbe6963faa3f", "value": "T1F903C5467E218FEDF66D823007B74A21A7A873C923E197C5E29DD5042F7028D585FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958949, "uuid": "4b399edb-f210-4e78-b05e-a507f02839bb", "value": "768:Y6+vg0yURHas+v79Umj1MVolsl1TmMy1nNe39JBIu:9v79FbszSeNJBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644958949, "uuid": "d50226b6-2606-4667-926c-9d30ab681d76", "value": 39420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644958949, "uuid": "23356446-48b9-4242-ba06-332b5a7cd342", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958949, "uuid": "b31e56e7-d92b-4752-8ec5-632de59600d2", "value": "beamer.mips-20220215-2102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6e6875-8e3f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644916574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916574, "uuid": "0f76aa28-7dd0-40ce-8dab-bbb684ecd399", "comment": "Malware payload (Loki)", "value": "ef562d56f591ed35aa754664b0e75d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916574, "uuid": "6e9ca85b-4ca5-4e29-9e83-dfe1f0302e67", "comment": "Malware payload (Loki)", "value": "338121875373a32ea54d916e9f5dc3e9c29cded9332a9c7784b486da541ea629", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916574, "uuid": "38ad130b-212f-4e4f-b475-f37b16816cb0", "comment": "Malware payload (Loki)", "value": "baea802a854cbf473588707460fe0983f11af5a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916574, "uuid": "9e6f671b-e057-43aa-b55e-0b976c06c49a", "comment": "Malware payload (Loki)", "value": "667acee4f6518f296224717fd33994573dd60dc4fa49b126c72cfae6624cba4696ee78b88b8dbdf8d697862822c549fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916574, "uuid": "f770b025-acd0-44c7-a27e-c35dc4e7af0d", "value": "T1C705BEAC7611BADFC827CE7689546C64AA6075BA470BD237A01316DC9E0E697CF340F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916574, "uuid": "8ba97d9e-0fc4-43d5-97e5-18ea1566009b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916574, "uuid": "42a7fa27-8dc2-4722-ab80-96cd55212685", "value": "24576:taY3Su9KAe7NjnP3+kuea/hU6C0jimLeVa:t/9KAmNjv+BeKU1mLe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644916574, "uuid": "8938a94f-102b-448d-8ee1-0b2137d7fddf", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644916574, "uuid": "f2537cbc-1cc6-4b72-b78b-533eb3fa5a52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916574, "uuid": "4251f050-2391-4d6e-9916-55e9601ecffc", "value": "e-dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d8e009-8e26-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644905470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905470, "uuid": "1fed5e6b-b821-4cea-98ea-f08d76ab162f", "comment": "Malware payload", "value": "49b0cf923a1d8ec31c0f53dbfcdafede", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905470, "uuid": "4e8ab4db-fafa-4b98-98cb-958a1e9c975f", "comment": "Malware payload", "value": "34ef4160dcf1036682891750db785abf873205465577f9911aed3f2378ec09dc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905470, "uuid": "6f208759-b278-4ce7-b51b-e7c00c21ed7d", "comment": "Malware payload", "value": "8a0c9d8fd5b1d940a02f50021905e9152ba10bb4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905470, "uuid": "6a2a326e-0007-4f0f-b15b-9d17a6f5763f", "comment": "Malware payload", "value": "b689a335c7a2bca09a0bf3584accbebfe1f4441e6b1daf70415d73ea43329700f16c2375b89274234caebe676b339f5d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905470, "uuid": "95800e24-1d06-4bc1-93fe-9739c30db0d2", "value": "T1B5524C3CE1588AD5CB49B1F05617FE6211EDBD1813CAE8D37BBCB3A19B6636F6211410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905470, "uuid": "b4ecfca4-d741-46b0-96b8-05e5022834f3", "value": "384:qT8SxsndfT7lcucYXOun7oIG0FRikrL+b:k0ndfT7lLn7VXFRikv+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644905470, "uuid": "34df628b-e983-4367-ac45-8465705ecb26", "value": 13755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644905470, "uuid": "1797a228-59b1-4c39-a53c-b09a15e167b8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905470, "uuid": "542eabf5-4309-420e-b051-55b228f0f1f8", "value": "SWIFTCOPY-MT103.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec475591-8e25-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644905407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905407, "uuid": "edc542c0-28a5-4c52-a591-7b9df8cc8a6a", "comment": "Malware payload (Formbook)", "value": "90901bdd2800d9c760dfcb3e6915ff09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905407, "uuid": "eb424b9c-eeb9-4bcb-8640-f81489d782bf", "comment": "Malware payload (Formbook)", "value": "35f9dd17bfe8b62676bead6a48638b65fd2372b9699cd7572b58e12192143849", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905407, "uuid": "de413545-9a24-4f45-8498-e835acf5af3a", "comment": "Malware payload (Formbook)", "value": "2cd63f2547cdc041004fc2c7fe18a0eb83e93838", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905407, "uuid": "79133874-4bcf-435a-ba8f-c48ec4a7a1c3", "comment": "Malware payload (Formbook)", "value": "a7b61133570bad6ecaa401c5dd20a59550c0a7fc962b69b7508cf231151ad822a9788c347cc4cd627c50d94f7fd0ad59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905407, "uuid": "12932eda-5269-4807-a283-3d6a84bc5023", "value": "T18E03B696FECC89F0EDD58B3E6CBBCD7415A2BDEA8539A41C25C93E2338732904111567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905407, "uuid": "3b1972ed-2a2c-4c3c-ad7f-64bbeda4a610", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905407, "uuid": "90f34d3d-1060-4517-bd93-35a4072b15e4", "value": "384:yWH9qatMOo0Nzsw5h4h0PMgCda6Sdd4ra1BX8mUCWy9XXHrzCH2:qL0Bz5h4/AbQGfXLuH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644905407, "uuid": "45e3ffdd-acff-42c7-ad84-74f9a7c787c4", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644905407, "uuid": "002c52cc-dc4a-4721-ace1-91001d9d470d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905407, "uuid": "f728c9e6-075d-4a41-b841-fcb9ac52944c", "value": "IMG-XEROX_130222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81298981-8e08-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644892771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644892771, "uuid": "12dfe104-7c6d-4435-ae51-9afab214e06b", "comment": "Malware payload (AgentTesla)", "value": "4138b12d085e1f11652cea9dfc72a58c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644892771, "uuid": "4ebe4aad-35c8-4e75-b4fd-4c6dd950b699", "comment": "Malware payload (AgentTesla)", "value": "3689d5dc265b2a5044a65af844f66e0ef5bbb37f19b96c59685c4ecea4091966", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644892771, "uuid": "82fbeca7-ac4e-4661-9431-7e6c05fdea6b", "comment": "Malware payload (AgentTesla)", "value": "b1ee4a94467ada671b8d88253ba2169f3426ec22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644892771, "uuid": "82effc54-6408-4994-90f0-bd478e91880c", "comment": "Malware payload (AgentTesla)", "value": "fae1822323a68142d1dbb25c8ca3637e7e3f0177e71853ec516d966fd0fc1d94e4125f46900b0e7e41fbc6971e24c91c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644892771, "uuid": "492869bb-9d79-45f6-ac04-bda639f67bb6", "value": "T12545CE01EAD2A5ECC97407F90CB5B3AC1C6C5D3918258EF73FB67199A0BA522183E53D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644892771, "uuid": "4339c817-5984-4c6c-aa31-883b8657f04a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644892771, "uuid": "d8f9a6b0-9529-4a39-9eb0-462d7a200543", "value": "24576:JgFj8VEaUcU8mwhSRjjyTqN30p88Y5OQVSVthdwnwW:Jg6VEa6iujjyTq1ssLArCwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644892771, "uuid": "96467d4c-4f5b-4398-acbf-164eecf6a908", "value": 1231872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644892771, "uuid": "2cb55bd6-1c60-4f51-abaa-5f0d8e5f6b33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644892771, "uuid": "40188f10-6c22-4706-a6b3-d769643985b7", "value": "4138b12d085e1f11652cea9dfc72a58c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4641f8f1-8e8c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644949366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949366, "uuid": "969a3777-61ea-4375-aa70-b9d3e38c7a0b", "comment": "Malware payload", "value": "1a92a2869d3264782ad05d7f779ce7a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949366, "uuid": "c5d7b573-220c-49ba-913a-2722a5bbb82f", "comment": "Malware payload", "value": "388ad186b67244b09eb4a14a0b24b24f83b51ac0b2df24aac5003e81cbe25b54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949366, "uuid": "ea0d5b2c-a2da-4fd3-91fd-3aab518846c6", "comment": "Malware payload", "value": "280b0d6e58efac7b2dd7e234557526fbe8380c75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949366, "uuid": "1c06bfe9-cbe5-4fad-8b13-4bb93b5fff4f", "comment": "Malware payload", "value": "16fc07c409df789ff6bdf52d2a2e6ae73cffb429fba92579b97925d4fa7c6302211bc89e97a162a58eef6b7e46c28d87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949366, "uuid": "c43c4cc5-7ed8-4cc1-a239-65d42a1bb8f6", "value": "T13805F6A871A3F4FECC17847A99505C58AE10E96B7307EEF69017E5BDD82C6828F150B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949366, "uuid": "a2bc2e60-c836-43e0-a62e-a1b0f8d5f073", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949366, "uuid": "2fec046d-72cf-4d4c-9c37-3b743eb1adda", "value": "12288:yWhhY+ABi9szifVIhCakfAX99s/UiipZ7Bjc0uS5ZYrS9E/EUYWUasV:yGVtiziBqN9Gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644949366, "uuid": "0dd35854-df9a-4417-9c60-4c9e8c0cb837", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644949366, "uuid": "4acefd41-5f04-4236-9e7f-a1901ffacbe2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949366, "uuid": "e55cc8a5-8d9c-44ec-979a-a011f4cc8f98", "value": "Purchase Order FEB22_76543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a17dee-8df4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644884273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884273, "uuid": "a171527c-cc85-4d9a-843b-353fe68dc5f0", "comment": "Malware payload (AgentTesla)", "value": "ba13b0dd8f95266e42a9e169b501c111", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884273, "uuid": "c4fd090c-5b0b-4abc-8072-fec8aba7f6a0", "comment": "Malware payload (AgentTesla)", "value": "38d02acaae50481ff6d73b2de186301fee82ebd4af08d57b0d096dd20fb8f62a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884273, "uuid": "2b29eb1f-8d58-4055-88a2-94dbc14a17ca", "comment": "Malware payload (AgentTesla)", "value": "ddcb5c3ef96ec026ba263f1ea6d6a0824f22f885", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884273, "uuid": "bfab7252-110c-4104-9021-306e8b554f75", "comment": "Malware payload (AgentTesla)", "value": "4f40d0c677cdbfc5cc1c0b233d5098ad558fdcb8c3a69c27ef24e13ba32c4bdd79465297067e1e2f0124740056a0c3ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884273, "uuid": "4fba8bc6-39e6-4d76-86a3-dd5ef0b29cab", "value": "T10D352200BB37B374C4B20BF94AF7853662B4AA1D1022DF7BACB735C91672224797547A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884273, "uuid": "c1ea2c60-b1f1-479a-a536-4080e4f429c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884273, "uuid": "8e548175-72c3-40db-8ef8-339bd528c3f1", "value": "24576:vgDw45v9tM0L54dF+IRKkHKc4hNpaJhMFb9uYF9Aq+:vgD19tM0N4dF+HyqLaJhMFRuo5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884273, "uuid": "909dd51b-e075-4daf-a38b-c49564d8c5b2", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884273, "uuid": "57b2a1c9-626a-4558-ab56-6c306e5447c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884273, "uuid": "06e5a5ba-bbf3-413a-9bdf-9038f5c341c6", "value": "JERJvJLKLeASMET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed5d997-8e6e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644936630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936630, "uuid": "f6ec2269-5364-42ea-9473-551a0528b101", "comment": "Malware payload (Mirai)", "value": "a14941fa113aa3cb16e60b02b4dbf63c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936630, "uuid": "3de64f6d-6f18-4267-b8cf-005478699725", "comment": "Malware payload (Mirai)", "value": "38dc728c481a6e421b2acc83e9d2a6ca0b62f4ed89b1e39b5ebca884e99fa3a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936630, "uuid": "f365c0bd-c35e-49c8-9f2f-e8bb04690956", "comment": "Malware payload (Mirai)", "value": "866a2782842bdfa9fe6c32c75137befb6fc9415e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936630, "uuid": "1096b829-14f9-4571-88eb-da1ec662513e", "comment": "Malware payload (Mirai)", "value": "b796e7ad2daab59ffa69ce2d53932328345ec1d7a77a643b8d4f8dbcf366746c049adf66d3f3df2cbef23ff340e0cb30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936630, "uuid": "98b69de6-d5ab-48f7-9ff0-ab737e28c492", "value": "T1F86339D5F401DD7DF88FDA7985270D07B93063915A930F23A36AFDA7ACB30849912D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936630, "uuid": "22be0585-fd08-47a7-9d86-94ca71cf62b0", "value": "1536:7kZnxvddC5Gxg80fpJ3x18KOWXY75qu6xHQ+08d:7kZxnsG7ApxWWRuEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644936630, "uuid": "efeb2102-3532-479e-b6c3-0109f65796fd", "value": 67616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644936630, "uuid": "e751a53a-0a9b-4903-a29b-b85f40069c8f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936630, "uuid": "83486ab3-19ed-4893-b6c6-1f63b0bbf65b", "value": "a14941fa113aa3cb16e60b02b4dbf63c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d535504-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644953270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953270, "uuid": "5e25cd81-e5fd-48b6-93e6-a3616c149c76", "comment": "Malware payload", "value": "8e91eac3159bc4800b614281152e1e14", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953270, "uuid": "3f1ac66a-a5a9-4bac-a63b-df3f99912547", "comment": "Malware payload", "value": "38fc1d3b1e5c4192bc4504c8de0bbd6fea9cb340fc7fe073f535d77e32999bbc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953270, "uuid": "7518d3c4-2fb0-4873-82f8-8a113891f337", "comment": "Malware payload", "value": "d05fd97865618c0e640ecce60c38d6b59d5b5d66", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953270, "uuid": "d3b545b6-be04-4210-a691-f27e31784683", "comment": "Malware payload", "value": "37bee479b0b7112bee8c9fe4869f5f6411e24762de4074e845d04b8bd511784d2ad4a3e53d2ad6eb9a5773521de66378", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953270, "uuid": "683219de-90d4-42d1-ae7d-35f7dccf5936", "value": "T188A1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953270, "uuid": "5ce39093-2309-44ff-9f16-738891de28bf", "value": "96:jRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:jRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953270, "uuid": "3c6f4afc-d0b5-4b1d-a910-1e6dc3648ec3", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953270, "uuid": "d788af25-9460-43dd-a0e3-567e3a91616e", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953270, "uuid": "e6ad014c-0a12-4df4-8b06-86fcdc097bb1", "value": "38fc1d3b1e5c4192bc4504c8de0bbd6fea9cb340fc7fe073f535d77e32999bbc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3427cd10-8e70-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644937310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644937310, "uuid": "85895f20-0082-4196-9cc8-18241cc34ae7", "comment": "Malware payload (RedLineStealer)", "value": "a96f462c7c58868b92c80fde5221048b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644937310, "uuid": "18e65361-85ad-4608-9809-1aee45ac7358", "comment": "Malware payload (RedLineStealer)", "value": "3946c0e38ab1b245e4d7b1774128f63c4209bb30a5f7ec2301575a5f2c93ee76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644937310, "uuid": "aed8a044-57c8-4394-9209-7d9bd3f1a7a0", "comment": "Malware payload (RedLineStealer)", "value": "93d979d35fae1b25fbe6bf36789d603d1bb3c504", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644937310, "uuid": "4cdbb187-c275-408b-a6ba-77d047b5b0fc", "comment": "Malware payload (RedLineStealer)", "value": "ba27d438ad2a88d0f637542e2893afa8c06df18fb8799332843149d4bdc944efa14df0b88a0016be03005319dc73f86f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644937310, "uuid": "68cfde1d-f10e-45dc-9aeb-834887851142", "value": "T10B65C00AB784FC90CCAD5032C96B4FC92777BC25596297D6221AF93ED4F3349881E58E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644937310, "uuid": "44d939d4-58d2-454f-bb73-fc6455b302dc", "value": "c9404e96f0a454f65d9107ec219b558c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644937310, "uuid": "6f144d0d-2d17-431a-ad20-d3c0fc4a71c7", "value": "24576:o5IvuxnX8udsI/gaZgaaS+dJoosERcHk3ElayYuFZJF:oYWjoZXS+dugcHsgFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644937310, "uuid": "d7f50979-42cd-4905-8775-ac8c2273eaac", "value": 1549168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644937310, "uuid": "e6c4ca9f-641c-4bfb-b37e-3767c5609b7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644937310, "uuid": "0121bf64-b570-4fdf-ba40-30ec7380804a", "value": "a96f462c7c58868b92c80fde5221048b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3240e28-8e8d-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1644950059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950059, "uuid": "a6074471-0f5b-4897-8dbf-6e92b2c132ef", "comment": "Malware payload (AsyncRAT)", "value": "1e939e209308032e6caa35e6375e818b", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950059, "uuid": "3c05993d-fa14-4da2-bb14-184d18bec7e5", "comment": "Malware payload (AsyncRAT)", "value": "3998ce9a86b09b1f2080c411b3152143a090fbc4a1e36f3e899ac3b9a79ac4af", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950059, "uuid": "2ae98b3b-5786-4f6f-a524-2db08dcb412f", "comment": "Malware payload (AsyncRAT)", "value": "29030c1641e0842e66bbd1e4be1f7ac60973197b", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950059, "uuid": "c6e401ef-2a00-49d0-ade4-f3adea76bd9a", "comment": "Malware payload (AsyncRAT)", "value": "7a95a1d56abb4f26ccbacb05a152d06a0d997416cd8fdfe4094ad55a382d6d13dd890f103de06d64be3b0f1acf5aefc9", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644950059, "uuid": "2bafad4b-cffb-4870-b8c4-ae0f10adc559", "value": "T18F93E3F55AA45AE5FAB61A34B6A6E930300BBF264CB3B7593F9CF0D01733A0C8549750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644950059, "uuid": "c5ed2eec-3421-4f94-82d8-15e8def96634", "value": "768:/utWv8UuSMztM0rV3tlgG9aoz+i9O4UNH55eFlSrm2EG1q:ZvvdAs8yBRI4rTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644950059, "uuid": "e6305043-5ba1-4220-9e17-280ff8596b81", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644950059, "uuid": "c91c1cc1-3371-4039-aa6f-673d71a71e82", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644950059, "uuid": "86d15d17-47fa-4433-9b8c-a8c648a12b8c", "value": "Voice_message.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45534d55-8e43-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644918011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918011, "uuid": "edf9f1de-e698-4531-924d-a0f17ac0cee7", "comment": "Malware payload (Loki)", "value": "ad23c5acd5ceff7a4937d7b8573b0e68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918011, "uuid": "5ed93715-1089-45a8-8c89-caf3da623443", "comment": "Malware payload (Loki)", "value": "3a54de0b1011ef669ea2fbbec688ae4d0ba04324cd35064df4824b6b47ae5ab0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918011, "uuid": "afb797c9-da6e-4bfb-a190-d53c53745736", "comment": "Malware payload (Loki)", "value": "bec26241689ebf9f063b0ac7f618cbb5e8ae18c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918011, "uuid": "3a098122-ae3d-482a-a59b-d9b70cafb31e", "comment": "Malware payload (Loki)", "value": "733b594c9abcdac5cb1a84b0b6027ce49d64dae8a5a0aff951a4425e25c131d855f2d4c83286036c3f20c957d2b2eba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918011, "uuid": "232ecdc8-00c2-4e88-bc7e-d6a01e259507", "value": "T1A054122B62D68C63D1570A7305F38BA5CBF9FB0423092A8F5FAC0F9DA4749D5E918781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918011, "uuid": "5c1d6f15-ffdd-4e06-a005-f96cb7065168", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918011, "uuid": "a8f3c7f1-9f56-4bca-8fe7-8b809823525c", "value": "6144:owoBdFfwguYuoWRNvDrf6lZqwLGF9amsIh+Q1yPC6Q:0B4iCvn6l4vRs42Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644918011, "uuid": "4ae6909b-97df-443d-b838-0dcd92cf9f70", "value": 289849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644918011, "uuid": "6e2ffe65-40ee-4c10-a440-0e227cd60c0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918011, "uuid": "35d6822d-6e25-48f8-bbc2-e423387bb9d3", "value": "scan_02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c60dd1-8e82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644945045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945045, "uuid": "45b39519-aba1-4ee2-a436-6d41a86c57e7", "comment": "Malware payload", "value": "eb0e16ceda1a23500cf4482f9a2144fa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945045, "uuid": "b7fbb6d3-a919-41e3-b152-b51da83fea08", "comment": "Malware payload", "value": "3a58f9ca1c4110271b3ba076c7811ca9306731d2f42ce5ac96266a62864b56a9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945045, "uuid": "2e4542f9-ea8c-467e-a4a7-9191f31e040d", "comment": "Malware payload", "value": "09d9c87b697476ef43f5a89dff615140fe4901a6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945045, "uuid": "e72e0ce8-9865-400d-9cc8-8e123664bcf7", "comment": "Malware payload", "value": "3ce3397751234b193a834acfee61cf69486320433ddcebdde7af19931868919d5ba58f0abb3080419ab305a8de41db18", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945045, "uuid": "f904e077-b822-4b28-b904-9d6d485d5357", "value": "T143E0ED7A1109AE53FBE675C045049CBA6503124629929AEF8B8024FBEDF3D240E3E625", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945045, "uuid": "75a3e807-25b4-4a31-b9be-efcde468eddc", "value": "12:ebFiNLS9UXdwIUJdNocT9dQsCdCUJd4Lg4Xd+IK1UJd+IKlGMvn:eb0LS9QHcT9d3rK1uKTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644945045, "uuid": "2d049d28-306b-4375-a7e1-c65b62bc8e15", "value": 428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644945045, "uuid": "812c8a28-2bcb-4dc7-8593-33f6ac575159", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945045, "uuid": "68e82f98-b2b4-47c3-9bc3-f90e648fcc68", "value": "tsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9712e9df-8e03-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1644890661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890661, "uuid": "09a1674a-db72-46d6-b226-2830a6230bbd", "comment": "Malware payload (ArkeiStealer)", "value": "633e62704cd15406b9f8723984ff50ed", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890661, "uuid": "fa4a4046-b5d7-4e9d-b8ac-0d3ec47cce05", "comment": "Malware payload (ArkeiStealer)", "value": "3a5be7e7aa34cdb679af97c502c1851bfd689d89c71780347d7223768c2d590a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890661, "uuid": "888454f1-27f5-49e5-abbb-d1d17c7e126a", "comment": "Malware payload (ArkeiStealer)", "value": "781d33318111e224ed820228bda3d3cd03187502", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890661, "uuid": "a8e987aa-eabc-4754-9529-a16039d400e9", "comment": "Malware payload (ArkeiStealer)", "value": "94f0eee0deed71ce20bdd4458f7ed9a77f34bd20be8dca1aac9da3ac22e3b078ba3041c0baefe8cc3daf95588aec948c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890661, "uuid": "ea66effa-8763-4772-ad5b-3d5d4fa4d095", "value": "T16AE4F1007AA0C03DE0B716F47966E3ADA52E7EA15B2590CF52D13ADF1A346E0ECB5707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890661, "uuid": "b5603f1c-08a1-447d-8d3f-bc2eea350f5a", "value": "84b5bb4cb9ca88c25fad25661626d326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890661, "uuid": "796c0c6e-e86e-4bbf-afc1-c022acd3cbff", "value": "12288:5wZhlLlQE40FxW5cttYTBagi9qP+ACc3BwnRvVHrQq2:uLqn0Fw5MtY9azXJc3B6RvV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644890661, "uuid": "f97d010f-7b40-481f-8e06-c959146976e5", "value": 693248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644890661, "uuid": "a8852815-2819-4e52-8277-9a59e15a3d1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890661, "uuid": "a093aa90-8151-4e39-b48e-9b767fb5d71c", "value": "633e62704cd15406b9f8723984ff50ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf4ac41-8df6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884846, "uuid": "f7adef4f-dead-4d46-af19-a3b76c98d69d", "comment": "Malware payload (Mirai)", "value": "ec614059f92c4ebc0ec5bdecfdc6e998", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884846, "uuid": "095d58cc-572b-43d1-add8-d6f1adbcbfd7", "comment": "Malware payload (Mirai)", "value": "3ad7818391db4ff0a44f12d9ad84429d1b4d1f40ae6834648d786357005a3715", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884846, "uuid": "835cf548-7205-4737-a1e7-9addbe8343be", "comment": "Malware payload (Mirai)", "value": "4c258949719481b2ae0ee1bf4761ccb1e8804b70", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884846, "uuid": "b1d0594a-ad59-44f3-9727-03dea0890636", "comment": "Malware payload (Mirai)", "value": "dc8b24fe32909dafc2fa74c14d002c2d26fec14822e03d3bb9d4a8cdf861acb9fd3934eea42a695a1a2804bd37870a67", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884846, "uuid": "55fba5ec-4828-4101-906e-940c6d6ae6bb", "value": "T1B8B3B50ABF641FF3E89BCC378AE91B09298C555A21A87B757D34C818B74B25F15E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884846, "uuid": "5d8db2a1-cb6c-4aac-bb3b-2cdf0587eaf0", "value": "1536:nZ93q/YUj/RINAYCHlkOP0WP2n8GmddxFJDZeyzdxaEH5:Z9a/YUj/RsAYCHlbPzP/JDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884846, "uuid": "95ae47e5-6c51-412f-b147-85e3133bd9eb", "value": 117212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884846, "uuid": "bd3992ed-cc84-4a60-afbe-529649851900", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884846, "uuid": "c198b7ce-8c08-42ce-ab2d-6e38fdf70c35", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37585b9b-8e1b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644900808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644900808, "uuid": "b3220b4d-e924-4b59-ac8f-e47ba3a24d70", "comment": "Malware payload (AgentTesla)", "value": "e3c0898db5d271a4ce6fcec4b23f3c16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644900808, "uuid": "a64f83d8-b81f-458f-809e-8ad5bb99000a", "comment": "Malware payload (AgentTesla)", "value": "3bbb6a481e4ed1d9a5eed266d76fe74cb2bb66787e525ad5c109300a51cba684", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644900808, "uuid": "dfe1ce7d-fc23-4ee6-80f3-5f7ca5c1969c", "comment": "Malware payload (AgentTesla)", "value": "100fefb4e91df67d89c3a62b4c1460b77805c65f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644900808, "uuid": "047c0d22-b540-4cf7-a686-dfbb969d74b7", "comment": "Malware payload (AgentTesla)", "value": "14290fb4b02373a6de8b2b5b1fdd0f9044771f31b41b29451ab9face7c6bc81e4474c2acdf372ebf375bf1a67d760ceb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644900808, "uuid": "91edd0b6-4d8c-4344-a475-cdeaf8bec59c", "value": "T1100512413759ABE2D0363FBCD5822230037171AB6D35EB4D4FCDA881A757BA4CE92687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644900808, "uuid": "4e1c736b-efe3-4c6f-90c6-e2546c82dfd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644900808, "uuid": "172b849c-e91a-4684-b9e6-3bba7f7c4840", "value": "12288:BnWXBypptX9KhikwXQyMZpGz9IRSXbfG1tApyYocjL3dTen1XknVr4JZO:MBypMirXQpwz9IRSXbfUq3dTen1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644900808, "uuid": "99c7a54a-3324-412e-894f-4097226066e8", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644900808, "uuid": "3e7c92b3-cdab-42ff-a9ca-5c35029a7ce4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644900808, "uuid": "5c5c8637-db2f-4902-8765-eae1ed5b80da", "value": "20220214 0 000100400400100 300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b96112-8df4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884250, "uuid": "cb689e0d-a5da-43c6-8e2e-61b13b6d50b8", "comment": "Malware payload (Mirai)", "value": "055faf6aea7ece5eaf4678efee492478", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884250, "uuid": "786b97a9-9bee-421b-8c79-aa093990e08a", "comment": "Malware payload (Mirai)", "value": "3c128d01635bf9a9b5d3d90ef4a56212554f7a44c579a74aff707455847eb515", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884250, "uuid": "1054d7b9-d922-4bb4-b2e9-f1394c99e76f", "comment": "Malware payload (Mirai)", "value": "e099ebf1a61481501ce8fa266cc6800882ca8457", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884250, "uuid": "fbfb57d9-f1b2-47ca-af18-f72c6256434c", "comment": "Malware payload (Mirai)", "value": "ac53a45f3ea7e71ab2e9ba4b01f4287a884df2facc159ef1854df0360f5a4d9ef268b9fcaa4662493814c6c3efba253f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884250, "uuid": "c03c7091-c1ef-4454-9755-931c7bc60c26", "value": "T1D0F23AD5F8026D2CF81FE6BD84174A0CF661374561A30F2A67BBFDA36C322545E62E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884250, "uuid": "2795a1df-8d90-42f9-b9f9-70da5683299c", "value": "384:e2SevpPE6VaIkMFhfBMHEI1n8usnxkFADPPh8FxUCbpE/vkZG58HAABqZMhY:e2SejVakhsXsxeADmTjbpE/sZG58rBnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884250, "uuid": "c0967ab6-39d9-46b3-8f82-b880567f701e", "value": 34952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884250, "uuid": "8ac113a4-d79c-4032-9505-5bf0a43c42db", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884250, "uuid": "26733950-3c81-4dfb-bc99-e6aac090c8d9", "value": "mizakotropista8k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28562a75-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644953181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953181, "uuid": "348851e0-5a41-44bb-9ad3-5bf6439613ec", "comment": "Malware payload (AveMariaRAT)", "value": "2cbff0e48057286c8cd879e01a63fe6e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953181, "uuid": "dcb541f9-9257-4ccf-ace9-a1abc1f394a9", "comment": "Malware payload (AveMariaRAT)", "value": "3d85d9f75611fb2c570cee711d85aab9fc7293afc70fdcbe3062e79d4975518d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953181, "uuid": "7622600c-6032-4a68-97ce-65e708bae9c1", "comment": "Malware payload (AveMariaRAT)", "value": "22c2cf3103ed21ede1715efb95dee11e46eae112", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953181, "uuid": "c0bd86ad-e267-4aa2-a09e-585922130a50", "comment": "Malware payload (AveMariaRAT)", "value": "1a7c41c7ec00f2f2a67571b31dd5197288cfc72ed299d150f7bf509ef7290d98181f3c8f97a6014afd608cb6bafbec6e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953181, "uuid": "eb2173c9-9630-4d18-bdaa-cdf943c9b680", "value": "T17F05E04075BA61C2D4760BF298E9E16117F4399DA19AD13FA98673C928B3381443FB3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953181, "uuid": "8c35c7aa-5a26-41a8-97eb-5e47467cf561", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953181, "uuid": "16e84fda-9053-4471-87db-8407a21559c1", "value": "12288:835k+bZ0ryNoyk03iM1v2Oxido71XqJqx+yXoNBeGQDpBtHhafc/nJWlyAKp:0asZiyKL03fwLdo71p+yTakslWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953181, "uuid": "06ac75ba-6374-483b-ab22-9b89b6fdddc2", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953181, "uuid": "058df9d2-c01f-4526-9cac-dfcc1dc446e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953181, "uuid": "7fa76a2a-3eeb-4a9e-98d7-5db45cb97dc8", "value": "Product Inquiry.pptx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b8d1e1-8e5d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644929358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929358, "uuid": "91478268-8161-415c-84b3-b241a0797ae7", "comment": "Malware payload (AgentTesla)", "value": "a48ae81e89ec55a5ccd35564b8312c94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929358, "uuid": "c5e0fcd7-8e89-4f21-9031-48afa7c30f7d", "comment": "Malware payload (AgentTesla)", "value": "3e3c65d9214cdcdf6bb00dfa213bd53009f16cf9b2e0eb6b015596f767cdcd63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929358, "uuid": "9b4a41ba-2202-42da-a365-cdeeca6372fc", "comment": "Malware payload (AgentTesla)", "value": "dae5a8472e1f65ad70593ecb8dce6205f6ce0a46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929358, "uuid": "10e5097c-079d-427e-835c-7fe8fcf6ee9f", "comment": "Malware payload (AgentTesla)", "value": "360e881a508da130debb4cede2d821dfcd04a3024d5cba48f6178452ea2a8cf963116075868afd30b98e564f4743e952", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929358, "uuid": "99f3fbad-383b-4091-9aee-15cc0c951ac9", "value": "T193E433C69F0D470336F68E990E103D4395518BDBB4A844ADD16A2FB766FF097ECB0189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929358, "uuid": "f1acb92d-e0eb-4856-a1c5-6ff800421979", "value": "12288:3Pl+T4D9VrG8cv/POSDu4+lT1CplxeeER+9q2VXcH7f3UARLbzKck7TA1zZ9QAM1:79VrCOSDu4+lMpzhVXkf3JhHKYJFM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644929358, "uuid": "49a4e09b-7df1-45bf-bfe0-17287bd45490", "value": 719127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644929358, "uuid": "7dd72d90-67bb-4182-b472-0eafada13ef7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929358, "uuid": "513d3104-d7f7-49c4-a776-1d611b5b435f", "value": "NEW REVISED ORDER.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db04028-8e81-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644944788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944788, "uuid": "fea4ac03-426e-44fe-9a6c-a3329630b496", "comment": "Malware payload", "value": "f0c4047157097dc112a75ca3c34f325f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944788, "uuid": "c6a25826-feba-420b-ba2d-5b15645609da", "comment": "Malware payload", "value": "3e4270c62fba4551a124875d078319ad57337f9014f3a4bb1ebe6f9ef2dbf9f3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944788, "uuid": "3e903ff2-c295-42a3-850f-7c4f323c3113", "comment": "Malware payload", "value": "f09ee00cdefc2a6ec35bcec94de44a56565b2e58", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944788, "uuid": "20c7345e-2f92-4394-9481-b13c3826e227", "comment": "Malware payload", "value": "9954ece6792283a14d537b04a35fcde61b328b9962d8fb17c5bac9094d5391d52cc9d7a9cb2725c3ba8cd88da1ef45b6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944788, "uuid": "4213fe21-90d3-4bea-9cce-347133aab33b", "value": "T11665330822FA7CD4F9EB063937621C94C3A932F1C045B09527981CA656772FE539FEB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944788, "uuid": "031fdf69-2a10-44b4-9392-b448cb26bb91", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekANJLLT1mtPQwNDk2XD1h2VYRflri++:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644944788, "uuid": "de0faaf7-894a-4391-b409-1fc97429dc58", "value": 1490944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644944788, "uuid": "20332633-9207-431d-bff6-1604bf9089f5", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944788, "uuid": "5004fa32-f642-4165-a65a-8a65cfa72eee", "value": "3e4270c62fba4551a124875d078319ad57337f9014f3a4bb1ebe6f9ef2dbf9f3.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876d82ce-8e48-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644920270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920270, "uuid": "b99c6f8e-b0f3-4c19-b751-77146d207570", "comment": "Malware payload (AgentTesla)", "value": "e820afe1d47879489bc1a4969f4491ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920270, "uuid": "b8ba4e00-a7dd-4c5c-80a7-0f0437c00bb5", "comment": "Malware payload (AgentTesla)", "value": "3f83264949aebfcc477b89b73f3775845fb6bbd5689504c398e4255740597684", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920270, "uuid": "cab12ebf-40b1-4c5b-8025-0466407bc6f1", "comment": "Malware payload (AgentTesla)", "value": "d69842bbe38408dd8c2718e02fe7e10574b648f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920270, "uuid": "132fe4ba-21e2-448e-bdd4-a78810adaa48", "comment": "Malware payload (AgentTesla)", "value": "c541e9e815e236ef358b3f4bcc16668352498716459ed83d175bbac0f97073411cada67072acc149415f5870f137195f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920270, "uuid": "42c2ad60-a6de-4dbd-b474-0b428af50ae5", "value": "T10BF4330F8B46B7C1FDCC1F4CCBA62763E5D2171241C1B86934E49CAA8A65C61C2ADEF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920270, "uuid": "6ca2ce71-9fde-4ac2-860a-d5e5d0e259a8", "value": "12288:c+0lfcYs8iRP9J+gQb1nvvWmEYaJEki47q7PF5AsWRYxhs8AgmQPp38JXm9fLLzd:cRlJ2J+Nb1vOmE9Tr7qrfRxhbAgmQPpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644920270, "uuid": "f0b5f649-ff0c-40a1-9c7c-8884e4339152", "value": 768190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644920270, "uuid": "300e39c7-5abf-4dc4-af9d-90bcd68a03b3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920270, "uuid": "3a8062a9-cfa3-4d82-b4c5-9e414bdebda6", "value": "PURCHASE ORDER DOCUMENT FOR YOU.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735ce033-8e1c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644901338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901338, "uuid": "707f59e3-1d02-4dc1-a2e6-60d641dabc5a", "comment": "Malware payload (Formbook)", "value": "f30fa6cb4fed98d285de228c6b6a5aaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901338, "uuid": "390ed41b-fa8f-4f7c-9304-105f4842c10e", "comment": "Malware payload (Formbook)", "value": "3fd7b914185575863f75d5ac1950236aa9cb4aece2fce6ef2a5cdfecdb0860fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901338, "uuid": "acc5f07b-c64a-46f1-a421-a78ac8c45689", "comment": "Malware payload (Formbook)", "value": "d8c48a17efcb7cda5f7448532359ede359a20450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901338, "uuid": "a906e76a-9b87-4443-9fad-af5f56e58651", "comment": "Malware payload (Formbook)", "value": "dfa35331f0be733ffa57ff352aa265ac83673fc67aecea3964ab9a64565300c8a4f35042a864e79c8e882a87068d575d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901338, "uuid": "0bf29412-efed-4a30-b083-791bde5dcc89", "value": "T143C4E0857D889B4BC2DC29308E72E7B70F221C5E6D21865362F93F5BB6FD0931809B65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901338, "uuid": "af993745-b775-4b57-b6f7-a414e8b350c0", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901338, "uuid": "f9570fb3-e8dd-4713-976b-35736a901241", "value": "6144:fwGZaFqkYB56f7Z/5fTxWZGr/0Q8SgGTrO1zYwIJykuT1AcSgghbp4VmgwUNstoL:5kYM7V5fN5cyORko1ShbK5N/2+drX7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644901338, "uuid": "d2077472-b7c1-469f-9dfc-c617f359617d", "value": 587206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644901338, "uuid": "b7aae216-2b44-4a3b-886d-7e558711acdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901338, "uuid": "22ae1501-f9d3-4292-9e50-254146f399e5", "value": "Putzmeister Pump_PDF___________________________________...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8604c918-8e4d-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644922415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644922415, "uuid": "c34cba2c-cf11-42bb-9f89-974f8a233446", "comment": "Malware payload (AveMariaRAT)", "value": "66f05965a1ef062489c78a571b83977c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644922415, "uuid": "c4e68722-4fee-47d2-bd9b-a584e49fde21", "comment": "Malware payload (AveMariaRAT)", "value": "3fec869813c6b624ca0b373c58a7874451e101b97a2800c7078a4683563172ba", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644922415, "uuid": "010b45c8-b8ca-46b0-9bad-fec016eda1d4", "comment": "Malware payload (AveMariaRAT)", "value": "6bfd89ef02d3dd6654cab762518dbb7df9273069", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644922415, "uuid": "5b76cfdf-eecf-4aa1-81db-8d0c4c144978", "comment": "Malware payload (AveMariaRAT)", "value": "717838c37c208c7c31c48e711c9828369fe42c57573d3d2a1a4a2234e8a8ca70d0c10b416a2d502b65c9a8d896ba2028", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644922415, "uuid": "62cb2fb5-c56e-48bb-ad7d-162d29c8f5af", "value": "T1A4F4F117B76BEB35C57412BA00DBC13513B5ABCD3533CE7B6CAA329809527920DB523A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644922415, "uuid": "c9de3df7-fb64-4f20-ba7c-db6d04456fa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644922415, "uuid": "f510d914-78a0-4e99-a582-625bf8f8ab42", "value": "12288:PuQnNkTZk820CYkSLQI7UJkJ9g7WeQ2PSHVRWWyfX94c+kJH:PulT2VYkehUeJ9gye7U+V3XJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644922415, "uuid": "4adc8bb8-eb8b-4b48-b2ff-20e8d97e2264", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644922415, "uuid": "8561dc80-837c-42c4-990a-3565464d3f04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644922415, "uuid": "4082d479-4a44-4600-b17e-a4c4d3893a1e", "value": "Doc_SMG_2022_15_02_890765556679008766.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99de63d2-8e5c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644928891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928891, "uuid": "1128dfec-4a07-4bba-b477-825c414176e0", "comment": "Malware payload (AgentTesla)", "value": "01255cee10acc237fd010b0977f72c07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928891, "uuid": "0d1205e4-905d-4276-9ff5-6d78370a7676", "comment": "Malware payload (AgentTesla)", "value": "408ef2de309c90e53c1684c61e00a6ed4af344dde31ab2e5e68370af9f9c0e60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928891, "uuid": "1cf76414-11f4-43c6-8a3a-96490fb157ce", "comment": "Malware payload (AgentTesla)", "value": "dff2db05eeda161fbbf2717f3483a516b0cd89cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928891, "uuid": "153f61e0-b319-46e7-9df7-fff6eee23f6f", "comment": "Malware payload (AgentTesla)", "value": "c8927b1ecfca21c137e7521affc02508ee2a0d68af699668cf6c1fcdd441128475888e05e08239a53bbf033c2f0137aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644928891, "uuid": "28288d60-12fc-4a43-b64b-fb2b5536178a", "value": "T101F423492ACBFB7441BFB356850F69A60C57168B7510030B2DFB356D87EFF129AE9808", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644928891, "uuid": "17a2fe71-0922-4faa-8388-8c366259c604", "value": "12288:v2GofwcUg2+K0r6YWGKhFcZzKgpYhYKd5tGpFfEP/HrwrdpoAtrQZDO:v2jwcUg290XKzcgh35kEErd/qO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644928891, "uuid": "519caf4c-2d73-481b-8cad-82205d5e11c4", "value": 730662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644928891, "uuid": "fec3050c-e87f-4e3f-a6d9-ba30fad62799", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644928891, "uuid": "5e96c354-6bab-432b-907e-6a9c0750f7a4", "value": "Arrival Notice & pre-alert .r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655191ca-8e2f-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644909475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909475, "uuid": "50a187ac-7745-4471-86fc-88be3ed58e37", "comment": "Malware payload (AveMariaRAT)", "value": "981e646e21c6ccb8ee2a5332f9caefea", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909475, "uuid": "598f18e8-f3f8-415a-8e72-66f35f190965", "comment": "Malware payload (AveMariaRAT)", "value": "40901dc70e02ccd60768da1dcb23556f9ab77cafd4bb074fba8440eb0470af21", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909475, "uuid": "b24840d9-a4c9-4636-a8ca-cba995906307", "comment": "Malware payload (AveMariaRAT)", "value": "9ac4131b4389e59dbae90f9b5594f3dfce3eaa39", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909475, "uuid": "545e0bb4-65e9-43b4-941e-5a79a6e519d6", "comment": "Malware payload (AveMariaRAT)", "value": "5b625832311f9d37b9ff7266d9d8054571c3a93fda42f84a6cb3ce6cb123972b1dc9bbf75b9e9499293c4a0eaf208468", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909475, "uuid": "13f91196-1444-4864-8cb1-5099bd890b1b", "value": "T148158C1375A0843AD52B19BACD4B87A0A809BEA53D28DD4737E73F4C5FB92817437263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909475, "uuid": "9b43f29a-5b90-47ea-9628-cd16cbb43110", "value": "395245e59962be96e38956eaadbe8ace", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909475, "uuid": "1243d46c-b889-4664-ae44-ca66d272b292", "value": "12288:MHJF21eFz0BwfJ4VOTKQLzjgmXWr9ioR0i1K2KH666666666666666666666666B:MpFArifJz1z3XM9ioL1KWIT+SNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644909475, "uuid": "60d2951c-58dd-433e-bc32-6f67c51bb143", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644909475, "uuid": "48ee14e1-5bd3-4f07-b996-5d55a9f90d40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909475, "uuid": "6f40f52c-bf28-43c9-9012-f382f2008c54", "value": "New order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a74e20b-8e93-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644952326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952326, "uuid": "1fd2913d-3af7-4355-aeee-be5f8989567d", "comment": "Malware payload (SnakeKeylogger)", "value": "8bedd4ae954cc216e6e7401bac730486", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952326, "uuid": "d903b2b1-f302-4dbe-95bd-7a2ae79c445e", "comment": "Malware payload (SnakeKeylogger)", "value": "409ce82f0a4f59e236cdb197dc26dc4c9940a02a6feee6095e36e247b1940c5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952326, "uuid": "74b732b1-cd39-48cf-9faf-5e03dd4e06eb", "comment": "Malware payload (SnakeKeylogger)", "value": "7b73233999758ed8d02b959668fcb366c9bb40c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952326, "uuid": "d8e88ef7-2ba4-4c31-8f49-c76fdce735ca", "comment": "Malware payload (SnakeKeylogger)", "value": "b72a4978187b20424f943c91d5b2d8427da61f63b895c964e0c64f159167bfceb77c690b6525342db987cb395a8cda6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952326, "uuid": "dc7469c5-bc23-424f-8da4-95ea5da7bf7e", "value": "T11CC48A2A41F3D871DC5B86FEE511C58C6F60EA2FB142EEFA8845E4BDD4AC7D04286523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952326, "uuid": "2f98550c-919f-4291-9058-ac64aae2aa53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952326, "uuid": "fa6879bc-fe12-4728-b6e9-b7d7d646d40f", "value": "6144:GGE8ZasZHviEnELdtUusk1RfWYF59618mUI10fIINB4lbkD1RW:dhasViEn+dauZVWa5EqGxC4y5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952326, "uuid": "1faedfa0-ab77-4d1d-9c37-27361057fef8", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952326, "uuid": "a73f3df4-c9e7-4ec2-aed7-98a197a93d5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952326, "uuid": "1be5e2ac-7b5c-4a71-9fa7-7ac6729e0272", "value": "RFQ no.311.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66eb8fa0-8e93-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644952427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952427, "uuid": "e8a79a62-048c-4ad5-aa1a-acef076e1e8f", "comment": "Malware payload (Formbook)", "value": "68bb54c35a5f82aba426df726fa24533", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952427, "uuid": "e0a52607-ef87-4622-97c0-365fc95268b2", "comment": "Malware payload (Formbook)", "value": "40fceea462792a9c1117fa6a794987d6b4d6f273ebef3bf421d61e56c1170305", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952427, "uuid": "d9146cd4-2743-4fee-9842-3a74f7229f53", "comment": "Malware payload (Formbook)", "value": "fa957f54b5a98ce0461483362e5d69029b013204", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952427, "uuid": "6c2f149d-40d4-4fbd-a982-9ca1a43b55cd", "comment": "Malware payload (Formbook)", "value": "bbd828c1013631ade39f05832e639a55bc034279cd824abbe31a521edc2134422e6b69e7a2a6ff57ca9f81a5e1465349", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952427, "uuid": "15f592e8-0bf5-40c7-acb1-3ffb3d40e556", "value": "T1D195BA21B1317A97C3161461166FBE8A430CBD47B2C65F8C905DFBF82CA6CE79306D9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952427, "uuid": "eb10a279-6947-4361-b686-45ff8d8bc92c", "value": "1536:d334QJaKXF34QQPD3iOya7I45AiS9SCHAD4pAs8A4eSoHFJ6oUsbaJu7zc1YiW7w:Po9u0243", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952427, "uuid": "f6e52eee-3323-40ad-8f20-18837aed2e56", "value": 2055373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952427, "uuid": "7a9e681d-efab-46aa-a170-b472b04d7ac8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952427, "uuid": "4f91dca6-02cc-451d-896b-32625cd07d6e", "value": "Order7656 SOS M...OS LANESLOG SNC.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9c6376-8e4c-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644921944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644921944, "uuid": "304e38c3-31fd-4979-a13d-a1e90f9fc1d6", "comment": "Malware payload (Quakbot)", "value": "374f73c36c913cc0f091c0ca77193027", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644921944, "uuid": "4eb97b8b-289b-48d0-a723-0e5af83daf44", "comment": "Malware payload (Quakbot)", "value": "415d7022841d3e4ee546295bb3bf061bb5dfef99dc55fa99a23ab8f69666facf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644921944, "uuid": "6d4df987-b15d-4e6e-a9fd-7941d628959b", "comment": "Malware payload (Quakbot)", "value": "f0a130b075fa0bd05f49e1a539ae1c62c9763830", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644921944, "uuid": "f63a1b26-eeed-4ddd-af48-5ca6aafd5b6d", "comment": "Malware payload (Quakbot)", "value": "3b01229f68261f5be4bbe0e4540ec15ecef6baf34f13842533dd259f354b045c032e9b7ef640516139c74099545139fe", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644921944, "uuid": "00b868c3-f866-4c41-abc0-224bf59cbb18", "value": "T1F14402564900D722FD09AE3DE89659CEBE34186F7011642F4C65AB83CBFF5431FE9226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644921944, "uuid": "c45bcd74-e9c2-4779-9bbc-16610b8b6bbd", "value": "3072:xwGEpaPSSOtJOM8NpvCEbOQCkICXgNeyD7+ndIhZKF2UxTp+SZFM60EpPtuq0hG:xobO0e2k7Xg4yD7HZexUERpPt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644921944, "uuid": "2dd02812-fb32-4764-ae4a-1159f8aadaac", "value": 264749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644921944, "uuid": "41e9d83f-58a1-46b5-a511-2b370501e5fd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644921944, "uuid": "7df1ca94-cd71-4bfc-8798-805eaf21b973", "value": "FH-1490185837.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45795a3d-8e27-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644905986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905986, "uuid": "d7adad36-3bfd-448d-880d-4e897d627748", "comment": "Malware payload", "value": "2ec530a4ed8ae6076179d7668edb1695", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905986, "uuid": "961e9a29-0e67-4b66-9c61-44c5c2a633ca", "comment": "Malware payload", "value": "4256cae7190341af33c1fed6181452aa254aa05b7d62e560b49e70876a05cebc", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905986, "uuid": "5585ef34-9312-433e-8fa1-532dfe93d69e", "comment": "Malware payload", "value": "58e43034f61c74c3e4627dc9d797cbf407e93c05", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905986, "uuid": "96c3c219-21e2-4cbd-a1b3-6b230265e41e", "comment": "Malware payload", "value": "6fe25c625ab18c2ac3c3470b54858d72c77322b763572b417b401d8cb1ece1d0b40213cdb6d9a95e5a162de744163271", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905986, "uuid": "3c220513-5d78-4864-b8b8-d5b3c37a2da6", "value": "T1E4434B372A02FCE46FBB1C8CD94535D11CC93DAB47608DA8BED4058D60E9A21DF699B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905986, "uuid": "7a22131e-44ea-4041-96a1-75a5779fd8a1", "value": "1536:HCYZ3R+9sMwi91cTMVNl9E8fjfSdmHoN2WRWokXe:5hXs1cTMVNl9E89fW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644905986, "uuid": "ff308680-6951-4e3a-acda-63007face0ea", "value": 55296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644905986, "uuid": "afccf8ca-55e1-48d2-8775-3fdb264fe0ed", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905986, "uuid": "72a2d89e-c7f8-48dc-8298-876562de10a4", "value": "simbols raros largos.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051a7693-8e30-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1644909743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909743, "uuid": "e74a3e5c-2807-4788-a7df-eb17d23cd9e2", "comment": "Malware payload (AZORult)", "value": "74dc96185fa606bf5d5389962ace53a7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909743, "uuid": "fb03012a-f519-42bc-b3d3-c1347557dab9", "comment": "Malware payload (AZORult)", "value": "429968106fd270646e6c7b13c4c0376604f9346902618e0574c566044f3c1549", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909743, "uuid": "b425c37a-295f-4ec8-996a-5e2cc1638466", "comment": "Malware payload (AZORult)", "value": "eb05872d8612a3a2007685fe3a18ad1e91340663", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909743, "uuid": "0e8a83d3-5778-4920-ac08-54f843109fc6", "comment": "Malware payload (AZORult)", "value": "5485e9fc82cdb15e6adf276addc4bc85c66165fcc44c836db19deb2a1e3f694994a04caada6482cefe51806dbb4ccdb9", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909743, "uuid": "e974095c-7b12-44ce-97f5-c809a4db06bf", "value": "T16CD48B2642F3C8B1DD5B86FEE921C88C6F60EA2FB042FEFA8445D4BDD46C7904646563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909743, "uuid": "942740b3-1a8e-48e4-bc4f-6f04ce1dc85e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909743, "uuid": "a9d06e20-c70b-475d-957c-97a705e76c8e", "value": "12288:LCWwFyOUasVUnRmM1RekH19e8xqSMdpdMHPg7ybr/:WrdsqnRd1Ve8xnMRMYuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644909743, "uuid": "0bbe072e-0409-4d2b-895d-859b530815f4", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644909743, "uuid": "08010353-0141-48a4-9982-4795d7f7df9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909743, "uuid": "8bc1d90c-7cc8-41fc-b18b-1a476717bcd2", "value": "Proposal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b618d85c-8df4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884270, "uuid": "fe85d56f-2973-46aa-9d4f-ed0f738cbda5", "comment": "Malware payload (Mirai)", "value": "629a4b0987fa6515ea7b954bad5e8437", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884270, "uuid": "9b4bcbb1-ab9a-4960-9895-782ee40bf7f9", "comment": "Malware payload (Mirai)", "value": "447e208fa47057567e828912b23a0927b0c74220e7336e2243ff1541b353157e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884270, "uuid": "48655cb1-9a18-43ce-a7b2-f19742d4f09e", "comment": "Malware payload (Mirai)", "value": "a001a97d0de323b44b37f1825565ad714989d38b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884270, "uuid": "307d3928-8753-4307-9c8a-f1036b2b47e2", "comment": "Malware payload (Mirai)", "value": "203fe7eb6860d0e70ceaca9b8cccc1cc7f38ab799cb7fb88d166d8d6e1746e8b354c147ba46b1f022fb568a1425447b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884270, "uuid": "1601d6fd-6b20-4135-bd30-d159349dab4c", "value": "T175330A96B8818A12C5D413BAFA2E018D3323677CE3DF72129D116F6477C692B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884270, "uuid": "605ebc32-e3cf-48ae-b87f-1a68a7406287", "value": "1536:EdnEtnvos4Hpetv1KQDlPvIri8tEapwrFMl:3QRJWv8EapOFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884270, "uuid": "9e0eb7b2-2d90-4792-bae1-15cfa209ed1b", "value": 50304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884270, "uuid": "5bb35c56-ea35-4ca0-b9dc-253aebc18cbe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884270, "uuid": "bfa7089e-07c0-47dd-9778-ef0516a03f19", "value": "mizakotropistam6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee2d3a8-8e16-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644898700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644898700, "uuid": "c916e09e-437c-4d21-b576-7c03d3f591a5", "comment": "Malware payload (Formbook)", "value": "87ed6b3442eabf43293b4e1d4e8af3f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644898700, "uuid": "0660ea05-1664-44ab-87ca-cc01cf93d6e6", "comment": "Malware payload (Formbook)", "value": "44d74d198ab05ed038d6ca78530988c46fc81911a5e22bdc286049e70563d208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644898700, "uuid": "e07951f1-e5cf-4594-a779-3c0b2f630f8a", "comment": "Malware payload (Formbook)", "value": "b324f85dcfecdd5f36c7d6fd1340d2b5cf065dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644898700, "uuid": "0ac2b438-662f-42ff-af8a-8f99544db798", "comment": "Malware payload (Formbook)", "value": "cc9d55692c702fa4364d368c1057ecb87caed1cad5a0694cc282449bb39cce9a44268f3f192e9c3bb9358125248a83e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644898700, "uuid": "8ff2ab79-d3d7-4d6c-9b38-0eb1dd75029b", "value": "T101050207B76BEB35C12427B540DF923517F19B8C2A33DE7A79BA368C19113620EB9439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644898700, "uuid": "5e2c0279-436c-4331-9a44-247cbacb1ffa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644898700, "uuid": "6700d0aa-b10a-455c-868a-b3ed54eeb71a", "value": "12288:ILUNkaYfdhNU6vyuZ8v7j8gODKH0Jws4ozwAaQOY6G5oIF+528zBRJv:Ira2FvyPbOmWpzw5QOYZNI5/zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644898700, "uuid": "718123bf-8fe8-4aa2-82c2-6cd52ba34c5b", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644898700, "uuid": "d1bd003f-f3b0-49be-86c3-9a18ee627e75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644898700, "uuid": "347cbf09-53a1-4edd-81bb-1db1bc3b732f", "value": "INV02746799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b820e2a7-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1644953423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953423, "uuid": "5961e68b-ca76-4a11-ad32-5476eb05f49e", "comment": "Malware payload (RaccoonStealer)", "value": "9e8849bd4c937da24b986877572c62eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953423, "uuid": "4c703d18-67de-4350-a7d9-6eee070922b6", "comment": "Malware payload (RaccoonStealer)", "value": "451f3d1b5f2823224e244d06c52423f0e68df54937a8cff948f28f307afe9cfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953423, "uuid": "27badb7d-c0b9-46b5-946c-4d9f0b2e1096", "comment": "Malware payload (RaccoonStealer)", "value": "ccdbccce46c7b4c6954794c4280c30be8c7ae5b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953423, "uuid": "89a07941-d46f-4eff-b83e-f34d19b01892", "comment": "Malware payload (RaccoonStealer)", "value": "239a7ef0a09e8a55b0190629cfe7fa176fbc1d6881641b49e3f0f2b7f204d04cc3273c4878fa5f3c9efde346015b31e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953423, "uuid": "dbd8964d-7061-483f-a938-fc1317f8de56", "value": "T1C2B402803992C179D16A45BD9C05C6E18AFB78B04A32EACB7790535E5F312E19BBD332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953423, "uuid": "98297dc2-71f5-4375-9a94-f7cc64fd921a", "value": "a8313245d507ee53d75f6adf6bc3944b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953423, "uuid": "255fe808-15bd-4937-9d1e-6fd94d972cbc", "value": "12288:BCueOq2yahgLSEchbd4t3gc03b82Uu5AC3PB8d:BCueOEr+EchuB0APd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953423, "uuid": "a1b47c51-ccf5-42c9-a8a6-28efbb4b2146", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953423, "uuid": "d0c5ba15-421a-4d20-9ab1-84a5155d8f79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953423, "uuid": "d74a26ec-ea15-4739-8bfc-e2880237ca90", "value": "9e8849bd4c937da24b986877572c62eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fe51e8-8e27-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644905940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905940, "uuid": "3d38f6bb-7a97-4e8b-8fcf-27790007947f", "comment": "Malware payload", "value": "5077cdfe48f6833476173da0def9257d", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905940, "uuid": "05aeb23d-b39a-4f67-94e2-5de8415d1a5b", "comment": "Malware payload", "value": "457661d9384b204d9ed1db0743c452e19ec38b8d6236dde8688abc3f022cced0", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905940, "uuid": "6c3bf1f7-7d43-4bd1-88fb-a7600204b9f1", "comment": "Malware payload", "value": "7bfa49cd7ea6ed3410bfc16492d0d63e43d03e4b", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905940, "uuid": "b467c224-799e-4f96-b4fe-b1d01cfb0213", "comment": "Malware payload", "value": "308eac980b391a42235e5e68b359a35b3a0a6eaf5a3c7b05ba8b2827e467bb478dde8c0fa07e71e8d71ebc6bce2bfcbe", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905940, "uuid": "cf9718e6-135c-4fb1-9935-3952f52fc117", "value": "T105D58D1A9477FC3828E9D6890988E4D1CADFAB615DF1AC65FC2FBD027507DA0C88D760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905940, "uuid": "7e33eaef-b8f2-4575-96d1-577c22122414", "value": "3072:GvOhu5hJtzFe5RQuz92tzyGpvVst470jjIiq38h4Iyq6KuQGVOjE/+Fz4D8Ur4Tz:Wg3wuXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644905940, "uuid": "d0a16b3c-c376-4414-b9ec-f7728cb06f5d", "value": 2964572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644905940, "uuid": "19447ced-4b1f-4d96-9f7e-ea059ce89608", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905940, "uuid": "25411e28-dc52-45a4-88e1-d26f568155e5", "value": "largosSimbols.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcc2463-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1644953489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953489, "uuid": "89b0efca-eeb4-44dc-aa13-40f76f7b64dc", "comment": "Malware payload (ArkeiStealer)", "value": "437a5bbb064ff7ae5df20a064a8f3eec", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953489, "uuid": "a06827ff-17ec-4680-a54b-738d373b8efb", "comment": "Malware payload (ArkeiStealer)", "value": "45fff1aac281bbe83e69c09c3f66efe3c38e16433a822bbd2fb16daf13ff8fab", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953489, "uuid": "6994c46f-2910-4d39-8a72-18acf1e33064", "comment": "Malware payload (ArkeiStealer)", "value": "1b4e74406494650a6ba36bab2d1a60ff7a3a3236", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953489, "uuid": "1746bd76-f651-4c38-829b-5bc2fc695e3e", "comment": "Malware payload (ArkeiStealer)", "value": "57c27bc78b6f7a8d02d9f198cfed61584cd80e4970b56addbf4946b523403d58eb0243632c00cf3cea72aaa1b6bf8c38", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953489, "uuid": "87e6f6a9-e67f-41e3-ab81-7e4ec057654b", "value": "T12F749D007BA0C03DE0B752F47975C3AD692EBDA15B2551CB92D52AEE1A342E0ECF531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953489, "uuid": "a4c0c770-cce4-4e38-b825-2a64670a1647", "value": "67b6bcc3e2c0beebb488c76e5b5389ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953489, "uuid": "0904b6c6-7975-48ff-a468-6b98f4937699", "value": "6144:7cPynGhrvaWpoW6GzNY9SMiYtwIJxzo0yCG2gCnLoJk:74yir1qBGzNeiYtw+zoLCG8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953489, "uuid": "f936ad91-026d-41e9-bc73-afd448121fce", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953489, "uuid": "51530046-903c-415d-acce-370e801016b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953489, "uuid": "f8ea02ed-e7f0-4586-b409-239d1d68a011", "value": "437a5bbb064ff7ae5df20a064a8f3eec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185457dc-8e6c-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644935545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935545, "uuid": "aa6b7283-60da-4200-9fcf-06ab4c3e66df", "comment": "Malware payload (NanoCore)", "value": "6afd56eba5faff1a98ab0f3af510774e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935545, "uuid": "326d99f7-cff9-42d8-9684-140a4cdb348e", "comment": "Malware payload (NanoCore)", "value": "462757689ac3c1498cfc5160eb8e160c27668ab5b9a8546af645d522e93e21c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935545, "uuid": "8242316c-608a-4468-9d60-5b55048acceb", "comment": "Malware payload (NanoCore)", "value": "a0ce920bb30e9d2e1cc02578e2ef550931cf610f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935545, "uuid": "e13af65f-4fad-4a18-8646-a1c0e270bb96", "comment": "Malware payload (NanoCore)", "value": "018e6b751e853ffd1f86cd7b1cc4cf5d0c206399da453bb5c2b46744cd94214064aed5dece33a045d7d647c26aae6910", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935545, "uuid": "9739bc44-fa7c-48c0-997f-b303dc1ac8ad", "value": "T109D23F96FFD449B1EDE68B3A2C73CE741527BCEA8531282C28C93D3779775900222667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935545, "uuid": "a64c0287-12cd-4526-990f-9092eea65d7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935545, "uuid": "0346a103-b719-45a8-ac0f-b7d60ae09e8d", "value": "192:t+BzZyBrVuVoZjggXbIeNi6xekPw1jHXjjIEWi92+K1D3SHxhU:aZKr0VoZEaIeNZwXXHr0CHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644935545, "uuid": "d53bd1f5-52f6-45fc-b144-f0913a69743f", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644935545, "uuid": "5e662eaa-6969-4916-beda-d00f09f967ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935545, "uuid": "55eca820-2ea2-409e-b1bc-ccbce61dea5b", "value": "PROOF OF PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b42222d-8e2f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644909539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909539, "uuid": "b9c52935-3d31-484c-9e2c-525e964fde7f", "comment": "Malware payload (Heodo)", "value": "4eff46f14c73fef267c4d91344c87724", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909539, "uuid": "724274a0-e22a-4beb-9eb8-42ba236a4613", "comment": "Malware payload (Heodo)", "value": "46a375f46e4333f391bba9720d10edd620179bd8f2312b2f55927fc9dd7b88a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909539, "uuid": "e21d2115-ea08-4b71-9037-1f5e943ffb9a", "comment": "Malware payload (Heodo)", "value": "8ae3d211e9b31e4c2cfc482db085bfc05a2b40b0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909539, "uuid": "bc23676c-ad01-43e8-b675-0f8a481918fb", "comment": "Malware payload (Heodo)", "value": "f6ec01ebae58cfbea8553a35900687e8b90dcad6059a389672f553d2dc8e06fb4aa8efad8cdfa4d010e1d24126d65f8a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909539, "uuid": "2bd80ecd-fb6c-446c-b0c5-e6973859c535", "value": "T121C45A319343B031D0B70B70A3619171E52A7F2967F44B676284BE9D2BF45E28E31B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909539, "uuid": "e0ba8c39-dcb0-4382-bcce-1e51ab635f48", "value": "2b6922387e1c25e6cd6dc456e5114682", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909539, "uuid": "06a2e98c-1c70-4800-b372-3bc941e9a917", "value": "12288:W+JYobIU5CLB3GW6RpXqM6k8E/lnn7NAdLT1:WZ3GWm9Ck8e7NA5T1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644909539, "uuid": "c1362356-c1ea-496f-bff3-8eed2649ab69", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644909539, "uuid": "4447d20b-ef2f-4120-bfd6-5b1f8fa75502", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909539, "uuid": "f87053a8-e023-4331-8adc-d4dde1365aa2", "value": "emotet_exe_e5_46a375f46e4333f391bba9720d10edd620179bd8f2312b2f55927fc9dd7b88a0_2022-02-15__071853.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea1e133-8ebb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644969593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969593, "uuid": "95779410-8827-4143-a4bc-64a380a37a13", "comment": "Malware payload", "value": "4e57cd35bce75af33b8195d5e131a33f", "object_relation": "md5", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969593, "uuid": "5a0dd379-b52d-479a-a247-960f42f7a8c1", "comment": "Malware payload", "value": "46a70716ba5d34c2c529d426789a5498f674df305d95fe5af914eb6920f9f823", "object_relation": "sha256", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969593, "uuid": "8453ac19-f06d-49c4-bd46-72baa2bb01ef", "comment": "Malware payload", "value": "d3166cf7a146d71b86005fce6cbf29d5f2d5188b", "object_relation": "sha1", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969593, "uuid": "faa8cbf5-0d1f-4f3b-b77c-e46b98400130", "comment": "Malware payload", "value": "6570e8f2639d4cc3ee0c62a9b87aaa9de1c89311ace949b7e9c795e901a91d38a9292c7f35059d1489eb7d3f195b86b1", "object_relation": "sha3-384", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969593, "uuid": "e2f4e4e9-11c0-43e6-b6f3-fb8ef24edbaa", "value": "T1CDC39E1074C1C9B2E57219304960EFB15A3EF9741F21AEAF7788567A1F341C28A2ADB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969593, "uuid": "9b4a3882-fe36-44da-af65-f857885ade54", "value": "277bb5bca79f7661398975c7af5ce7ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969593, "uuid": "57ee6b26-fef5-4b53-8afb-73092ce6e2fa", "value": "3072:OUwy0IdAzKbZ4RU9qlB5mA8CEOOkxVZR4B454DneMSLrSXc:/3DAmbZwUO5mApOkJMSLrSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644969593, "uuid": "98ebe442-62a6-4b91-b4d5-0142506edf32", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644969593, "uuid": "b11399f6-d4a2-483f-8a50-56a276ba0a58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969593, "uuid": "e6cdb1ab-8842-49ab-bcc8-13356036cc05", "value": "46a70716ba5d34c2c529d426789a5498f674df305d95fe5af914eb6920f9f823.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eeb177f-8e3d-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1644915370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915370, "uuid": "6cf08ab1-d019-4e58-9519-7455b76889c4", "comment": "Malware payload (AZORult)", "value": "e4aa0507e96b2c9d245206c55d67f6f6", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915370, "uuid": "3e56628f-d6a8-4b6c-aa3c-41b1c87357b4", "comment": "Malware payload (AZORult)", "value": "4809996f4451d5539275ac7962711a9324911310498693767f21c2091d04b86f", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915370, "uuid": "f43345f3-4994-47bb-b95a-1fddf22a294c", "comment": "Malware payload (AZORult)", "value": "85cda3cac085945b6b9f22d8cf104012ca7b1a89", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915370, "uuid": "6893bbdb-7425-439d-be1b-c9d66eed299b", "comment": "Malware payload (AZORult)", "value": "7bb207615fe48a8fea6844954bbfa90213fb369ce02eb1d5980c29286a8eb418b89cb38e5c545f1d4c7a82fbed10e786", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915370, "uuid": "28693ba3-3a70-460a-bcec-79f17d36887a", "value": "T141C46A2602F3C8B1CD5B86FEE511D98C2F64EA2FB142FEF98845D4BDD06C7A04686563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915370, "uuid": "9aa3b7c2-0b51-4755-9a6a-a5ce64e7a570", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915370, "uuid": "d8c8a6e7-6ef1-4a39-9f59-6d20c6869d0d", "value": "6144:K6qqcXyIasZHvvYb6tl5q8VBCI53ukjFN+450rgRTHv/wbriiRCQOasy/B:K7qcRasVl75PCijFJmERTHv/Cnbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644915370, "uuid": "fdd1eca9-33fa-4200-82ea-285cd1b2964e", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644915370, "uuid": "d3ab33b5-41a5-4a66-b4cd-713c97230192", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915370, "uuid": "1e07262e-bd55-4672-87ae-909f428ae50c", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8cb2015-8e23-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644904434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904434, "uuid": "ec65f76e-e233-4262-a9d9-31295b134c32", "comment": "Malware payload (AgentTesla)", "value": "07bae9427c2e413c538a72f40d3a2020", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904434, "uuid": "65aa64b9-1193-4f5b-89d5-526925cba84a", "comment": "Malware payload (AgentTesla)", "value": "4818072cf1bdeac34bd071cd422b30435d8d084430d2078f7cc46125fad8629c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904434, "uuid": "ef7a7f2c-fe90-4f07-a107-70b9feafeecc", "comment": "Malware payload (AgentTesla)", "value": "7647e21df91049688603303ff1728ba0f696a831", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904434, "uuid": "cd5dddc7-4fd6-47e2-8207-232c200867d4", "comment": "Malware payload (AgentTesla)", "value": "fdbdaeb93da4844a1a5e6212cf9785fc66c116aceb1b4b5c52a9ef1abdf8e0574d2a437d96e27b41700e86ed43558257", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904434, "uuid": "1c579adf-e039-459c-96ef-44d31c4133f0", "value": "T14005021BB71BAF25C074167140DB91B513F56AAC1233DE7BB8B632DC0E113650EB92BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904434, "uuid": "c601f20b-f425-4d55-948c-83967f9d65e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904434, "uuid": "ce0424ba-0b8c-44e9-9fb5-335013114314", "value": "12288:5Cbfz8A0YgNk7XGaV1Vq61bjujpbBA3cmQxEXj+nq5n81/06Fm7ZRiPT:5U71Vq61UbC3cH/qq1/lFwZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644904434, "uuid": "1aab7938-efb5-4049-a355-29337c02d3f2", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644904434, "uuid": "41236a29-c48d-4d09-8045-caaa602a0abc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904434, "uuid": "26f65456-7f37-4e96-861d-3b96745072d3", "value": "NEW INQUIRY DATA SHEET 00024252.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1026fbc9-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644953141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953141, "uuid": "5f23e755-b7bf-4d17-8b6c-488b661aaf09", "comment": "Malware payload (AgentTesla)", "value": "a1f4de033b45bf6560e3af15472b23cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953141, "uuid": "31381863-f847-43bd-a199-79647f5c47bb", "comment": "Malware payload (AgentTesla)", "value": "481c620827746b2f086d705ab037c82082b401c7bfcd7562997ca28ff5d24c9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953141, "uuid": "ce0c0edd-6931-4517-8a15-224f4a77147b", "comment": "Malware payload (AgentTesla)", "value": "01fd3e52235907023208a9d9d8c9393b42b1147c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953141, "uuid": "e0025c89-6d41-4705-92fe-2a2a0a1aafe6", "comment": "Malware payload (AgentTesla)", "value": "b5df40f2494c6e3f28a90cd31059bfaf8edcc4dd2799012d523e699ee5580f53dff393f3af3a6e69d2f8083cf27126b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953141, "uuid": "7b88809a-39e4-4ce2-9497-87e58e20018b", "value": "T161050117BB2BEB61C4B826B500DF917213F19A5D1137DD7A3DBA72CC09923920EB6139", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953141, "uuid": "099df5b6-aac1-4fb9-9330-7f1b137b59c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953141, "uuid": "0a5d315f-9b06-4d09-8a9e-603d56275cb2", "value": "24576:Pz5i7uRXAAeELKHmr+tDCQprhpTVLzKVw6:L5i7uqoLKHnDCErhLzKVw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953141, "uuid": "c37be86b-dbe3-452e-b14b-b23ad3ad2d59", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953141, "uuid": "a4228b9a-9eea-48d3-95ba-a7985e29cf8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953141, "uuid": "52a96f45-7f86-4c8c-9179-c879bb40b0b6", "value": "DHL EXPRESS CHINA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbe4b0d-8e81-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644944819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944819, "uuid": "5a119921-5958-441d-b131-165a3921240d", "comment": "Malware payload", "value": "ddf61a9c2a23ed0adf80579040783756", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944819, "uuid": "84049de9-9175-45ba-b1bc-c478607e7fce", "comment": "Malware payload", "value": "4a76060425f466d9160d3ec71895ec1b45d4b4c11c0279211b9f971fac606815", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944819, "uuid": "87d6f2f1-19fc-4254-aa80-68e60d540ede", "comment": "Malware payload", "value": "8c45687628a82a5f6b218307e9f40f6d2d3fd4a4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944819, "uuid": "92b077d1-9dd2-465e-9c90-5e99ed4015f0", "comment": "Malware payload", "value": "2c721069efdb855389ee4faa0a5548bcd8e01ea2406a675f07525fbda9b1f608a4938d8330d0d0e771fb3ffb68eaa218", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944819, "uuid": "add88ef7-838f-404b-abe8-8e5347dabaea", "value": "T1C1E4333DA2E225EE717E95729DFECF3A101AFDCA8077CB9055778148700A93BB66460C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944819, "uuid": "1b73d048-b4ab-4ec6-8aa7-88f41cd15605", "value": "12288:jJmL3cFcmubZ+xOObus1fv4J/c4km1qfSzFUeDHyeemxuPVZsnD7RQawPG3gvmjg:tNF0+xOOasdIE4Uf8FUeT0mUPVanRHwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644944819, "uuid": "69b2f1f1-422d-4b46-ad9a-f92c6eb23247", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644944819, "uuid": "28a423ef-5c0d-4324-9729-d604f5583395", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944819, "uuid": "d8259020-a457-40ba-a608-8c23f1600df9", "value": "4a76060425f466d9160d3ec71895ec1b45d4b4c11c0279211b9f971fac606815.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081a7197-8df6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884837, "uuid": "bbe9c37e-db55-4fe6-a8fb-cc306668857a", "comment": "Malware payload (Mirai)", "value": "f0b7a2580a5a913911813f98fe017873", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884837, "uuid": "2792d268-3ba3-4772-82ab-bf81de4b1216", "comment": "Malware payload (Mirai)", "value": "4a8ad041d90c8504cb6fadd895606e8ae10838131365091516bfe480df8cb163", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884837, "uuid": "93c3df9b-a002-4e5e-a6af-bdcbee4c1216", "comment": "Malware payload (Mirai)", "value": "9d81bc0027e6e8f8291d881c7f405a8096d38296", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884837, "uuid": "b5a08de8-89aa-4830-8e9d-937f2d353da4", "comment": "Malware payload (Mirai)", "value": "9626cdedf66052ae2a82049d28d5e17b0fc4fdffbab936c7d99e829a8f52a238dad6651e58c92af4657c8ec479c97de5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884837, "uuid": "6c893ec3-9a45-41f9-b923-4b56f0581972", "value": "T10B834BC5F443E8F4DC4616342177EF3B5F72EABE2119E687D3A84632AE42B02E50265D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884837, "uuid": "92337310-18ef-48a1-954e-223929cae825", "value": "1536:2EnSyw5t+1LeAvKwjPYZEnhuBcnWYfHGutkf/slX+/ALeyWlfwhE+yi57EH:XSypKAvBjPYZsh8cnWYfHGuSslX+/AL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884837, "uuid": "53ee25d4-d084-4bf1-ab24-1ea362eb42ed", "value": 82704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884837, "uuid": "a66eafee-8297-4b50-818a-c2dbd162ea8f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884837, "uuid": "dd36ee8f-53b9-439e-9064-ee3028d65c1a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2414c9-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644953002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953002, "uuid": "8d9cc2e7-2026-473e-b960-a23a86f8206b", "comment": "Malware payload (Loki)", "value": "be8c98a404d085176f6e374d97280f87", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953002, "uuid": "89214518-7678-4d90-a19a-b4303c05595f", "comment": "Malware payload (Loki)", "value": "4a8ba00d8732f32a8bc9052703539bcdb8d41e3526fe320d4c50859902ac6dc5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953002, "uuid": "fae2f5ae-72b3-4395-a851-ba1a0fed4aa2", "comment": "Malware payload (Loki)", "value": "a7178bc1bb98115c3990bbaf22712afd95c3ee18", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953002, "uuid": "49d6cc55-f204-49a8-b01e-12976d65a375", "comment": "Malware payload (Loki)", "value": "e7e48ddbb83416ef34a17e43f676d7d641044cdddebff167fa87000f44a9d94b97bb74b487369df438c7b3531c2471fe", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953002, "uuid": "2fa70c9c-a4ae-431c-861d-f033e9979ab1", "value": "T12314022FBF25BD19E1BE183C071F7A187479FD62498D9296A143BF922C3137D4895E08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953002, "uuid": "0ba85c45-201f-485d-8a9f-124fa15fe7a6", "value": "3072:Wbw27X8IyPUvaIqh4KGRJkJpThut4kq+vPgy5vWAK/DwxinjDYbJ4gFdWb3:u5rFNZFvPD2L/jDYbJ4gHI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953002, "uuid": "12ee1a79-ec08-4389-a0ed-3d156fca7b15", "value": 191928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953002, "uuid": "d98ebe45-b287-453a-a683-b2a98c93b91f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953002, "uuid": "aa87e377-c0a7-4f17-8541-8092f5f246f0", "value": "LISTA DE COMAND\u0102 EUI894BU4633.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f34c3b-8e7f-11ec-9275-42010a9c0029", "comment": "Malware payload (RunningRAT)", "timestamp": 1644943707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644943707, "uuid": "1a3040f6-891e-465c-8df8-94daa4bdd4f2", "comment": "Malware payload (RunningRAT)", "value": "e3ca4aeabe1a66897e064a9a1bcd61f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644943707, "uuid": "df6a8be6-d3d0-49fb-b8dc-6f259899788f", "comment": "Malware payload (RunningRAT)", "value": "4a954f2b0d13c4916fb79c5b78e60979871b1ded51c0fe80bc9e636585a5bd06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644943707, "uuid": "0a12b042-1cd9-43c3-ab7c-a00f8747acee", "comment": "Malware payload (RunningRAT)", "value": "6c160bc11c5e45e317012b4832a7b48d6478bd9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644943707, "uuid": "8ddca17e-d927-42a0-86c2-4ad3c512f169", "comment": "Malware payload (RunningRAT)", "value": "4dc71101a33383f3776826c98e948a598c79a9a3f9e1e4f450133b0f7aed7b1e4a8b6d462c490276feadde918ddb3d07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644943707, "uuid": "0d68330a-9c11-4158-8d04-e841189894f8", "value": "T12D635C027780D07BCA0123B22C61936E596EBFA56BDC2987F7E9CB0F07359D17919923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644943707, "uuid": "dd42355b-98a2-4dcc-ae7c-e46dd4d985a8", "value": "1b365823829e2ac9bfb0aa5d328240a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644943707, "uuid": "8cda4452-3f1b-4347-960f-46eb8477a90d", "value": "768:BCB8S+OR7dOahyoHokBtqN74W7bZZmYb9PyzcjRlYlwa6NVdkPnJJMIgV:BHJaAoHoc2x7bZoYBAcQlwJdMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644943707, "uuid": "34f341ce-6ff3-4a7c-81e8-3c03ab38fb0e", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644943707, "uuid": "daa69e9a-3c64-4781-846e-e4bc3fb7573a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644943707, "uuid": "a65d93f5-5093-4c64-af59-dd75ecbfb746", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449b5218-8e52-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644924453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644924453, "uuid": "cf3f04e8-65dc-4c9f-a9be-39b039cea56a", "comment": "Malware payload (AgentTesla)", "value": "17c0fb1c098804d7d522698588f7e1f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644924453, "uuid": "2ee514bd-1e2f-4b44-87e7-b1f2ec38df28", "comment": "Malware payload (AgentTesla)", "value": "4aa9bd091e5ddacd7a9ed4a38d81b8602237f422a98313ad25012cbd6fc93e92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644924453, "uuid": "cc7eba95-46e4-4852-9aae-5b24871ead28", "comment": "Malware payload (AgentTesla)", "value": "cde8e982680ea00e6814763ea9cfff7134245184", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644924453, "uuid": "50bca843-ea44-4a1d-ac70-3e27ebb6e9c3", "comment": "Malware payload (AgentTesla)", "value": "7154fbf5ddf7479966b4c7767f0f6170b8d2b7e12eae04280601d1912bafdc3ff2a543b8e19d17c1432d58b830885c5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644924453, "uuid": "66e71094-c87d-4024-bbb4-1384d30aff2f", "value": "T11815012ABB5BEA31C0742B7404FF913507F5568C1533DEBA6DBA72EC09013A60DB91B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644924453, "uuid": "3f7f92e2-9db7-421d-a447-d99ed45969f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644924453, "uuid": "8cb31f55-bc58-4eed-8edd-55d5f9dc74e8", "value": "24576:1xO4AGiq+DeWDiVDyoFjJyMgL0TWOX/h9v:zO4AGr+zC2otJgL0Ka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644924453, "uuid": "0f31191a-e580-4350-8439-fc93e7f092e4", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644924453, "uuid": "9b91dacb-cd0f-460d-ac6c-266800d3153b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644924453, "uuid": "3a2942e8-498b-4e2a-86c4-285ed38f9c63", "value": "PURCHASE ORDER DOCUMENT FOR YOU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2f303c-8e4f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644923445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923445, "uuid": "81cc3ef4-2f09-4bc6-9024-d57e516d776c", "comment": "Malware payload (Formbook)", "value": "131eba555316fa91b210bd7aaf3652de", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923445, "uuid": "25daf565-63ae-4890-8612-177542465dcd", "comment": "Malware payload (Formbook)", "value": "4af64f70d43783dddcdc33be8087371f02a0ea787a65981caddfb071de03deef", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923445, "uuid": "a19527b5-ba06-414e-9006-c430cea46e03", "comment": "Malware payload (Formbook)", "value": "c2c22bb8f95e67fe19f329f1c60fbdd434205e16", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923445, "uuid": "6985445a-02d8-43e3-a232-e3841b63aa9d", "comment": "Malware payload (Formbook)", "value": "f2d5081ee403cdca0936b646e1a06399169e4f989d3af08ddcb0c5c7d50597c588e83ca7ca9d039bab46ff9b4834cec8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644923445, "uuid": "ccc128c7-65a7-4bf8-96f4-0a321434a2d5", "value": "T13A3533678717B850E3BEF43593C50D41FD39D615B2E58ADEF0E2A8C164AA242874FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644923445, "uuid": "35b6cc24-8bfe-45a6-a372-c74db39b8974", "value": "24576:AfNdTSD/TIASbvCeTheNhtLIluvIHvwtbijQRIP+Ju2p:AVdOnIjLveNLJTlxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644923445, "uuid": "72217135-9b47-4bfc-8e21-231c9e03ce34", "value": 1082336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644923445, "uuid": "818bb10e-0149-4289-bc7d-2905aad1cb3c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644923445, "uuid": "871ddfdc-25e2-4536-821f-659f1db7e385", "value": "Payment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91060d1-8e48-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644920434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920434, "uuid": "2dd80a35-d55b-4130-91a0-28d6459a6ca1", "comment": "Malware payload (AgentTesla)", "value": "2964918d50b05b33cbcbd80a5ba88b68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920434, "uuid": "0a87373a-917a-421b-997d-c030733edadf", "comment": "Malware payload (AgentTesla)", "value": "4b583dd518cd3af269e4d7a0ebbcb04016cfb88e873ba31dc1c7e4f1db663345", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920434, "uuid": "51e97657-500c-41e6-af50-28ee0e709db8", "comment": "Malware payload (AgentTesla)", "value": "d45e7d81ca786af1039e392115489f70368f467d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920434, "uuid": "5491be13-da0b-4405-ac57-e2265f1f123e", "comment": "Malware payload (AgentTesla)", "value": "a491bfeb8172213eb4706ce83404943d6a80b4cbda90e1a015f15101ba80a133d00ce9ed6278443a25d5e11a29bb959f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920434, "uuid": "9eb4507a-0ae8-4c96-ac4a-0d1cf8b7ed77", "value": "T1F815010BBA6FEE25C87417B944EB913607F19F4C2633CE7A687A32D81A413720D79539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920434, "uuid": "1bd09cb0-dacc-450c-bced-a056a79b82ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920434, "uuid": "557c188d-ab40-4461-8e78-38bf4d9fc820", "value": "12288:R1PgQ4NkiUb7AxD4YmC3iMyothzLOaGwPCdhcloqjsVPodj1wL5kQdDNZ/j:R1PtiUbsHV3i1otRSojsVPoxq5vN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644920434, "uuid": "6c0d387d-1f9b-4da8-9583-acc9483af109", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644920434, "uuid": "00e504db-4832-4a9b-9721-68350364e932", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920434, "uuid": "b21eb3f0-9a65-4b2a-b7fe-471b65bd6bd0", "value": "QUOTATION_REQUIRED-TTHl4OQVoJKWpph.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be83c814-8e81-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644944843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944843, "uuid": "37cd483e-8ee5-4e29-a9d7-8937abd17fab", "comment": "Malware payload", "value": "d73fe37d1582982ab6708fff8d03b835", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944843, "uuid": "90efaf26-912f-44c8-bcb2-5c521549e659", "comment": "Malware payload", "value": "4caaa1b80f48383b05d76e7afa87acb931f69cb12cdbf94db472538bc8e7b389", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944843, "uuid": "93eced00-a9ef-427f-9f2b-7518f8052a2a", "comment": "Malware payload", "value": "e32cf59336beb7be0cc737ae5ac4810cf82e7f49", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944843, "uuid": "a00a33b8-4a99-493d-b4b5-9330cac5bf1c", "comment": "Malware payload", "value": "3a2a4a11489a08107c0bd58b33a11a7e447774346fbf5a7f5bf0563e0ea7e4294992bf2e742185d838954b03da171c02", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944843, "uuid": "4e4cce41-4a3e-4c96-9a73-fbd9642f8523", "value": "T1EE75330822BE7CD8F5EF162927624CD4C2AA32F1E445B49666881CB25A771FD03DEDB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944843, "uuid": "80aad0a6-3632-429c-861d-8a203a1505c1", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8f:IDSTOhnXSI0Wk5jG2nfBtkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644944843, "uuid": "8b3e61a4-d1f6-4275-94be-81beb83ad1aa", "value": 1638400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644944843, "uuid": "4724af12-a81d-43d5-8900-3c48353ea388", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944843, "uuid": "7b2fa182-bf23-4000-9f52-87c5676b11f9", "value": "4caaa1b80f48383b05d76e7afa87acb931f69cb12cdbf94db472538bc8e7b389.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d70c74-8e44-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644918714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918714, "uuid": "3f9e59eb-b1c5-469f-a65f-ffa18bb16394", "comment": "Malware payload (AgentTesla)", "value": "67401c6d9af39147878e35a54b8ce21f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918714, "uuid": "d1921b62-90bb-4097-ae49-c35cc4ea42e5", "comment": "Malware payload (AgentTesla)", "value": "4dddf65a4208903c0672ef3d5c6f2507cb0b0a46e6d997b8323097639c2f7f41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918714, "uuid": "26e3627d-e2ee-4f6c-9a55-ae872178e88e", "comment": "Malware payload (AgentTesla)", "value": "c5e01bede5a56a6942db3456264d75de53b9e371", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918714, "uuid": "1ca67692-c75d-4bdf-892f-f37c017cda03", "comment": "Malware payload (AgentTesla)", "value": "a8c125cc26500f25679c13fb828db65866ed7b68c13d25367f45589fc34b2fe9bd2090d333560f3e5effe3dcc00ae47b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918714, "uuid": "45a8cc96-9e7d-448c-9b32-38d8acf00ea1", "value": "T144F4334B2A30B585BF57D4AEFB058D7F419532DE4009CA87AF4B0298AE2CE2072DDDD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918714, "uuid": "be6c24ab-3a1e-4295-bbdb-46bd0260ad0c", "value": "12288:opnSCvLXGVssDqXB3RQJIPp0Heuf+vC8f9B/PsE1oIoXrWm5O24ghovRC0xstYNH:8dvL2VsJB/EfCC8L/VGDX5O2T/xiqDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644918714, "uuid": "35fe6a36-35b2-49f2-a021-0f2eb88a6f7b", "value": 792512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644918714, "uuid": "116b71b1-867f-4979-899c-86f642bb1d7e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918714, "uuid": "c4889476-fb2c-458c-a837-c0eb7151739a", "value": "PAYMENT RECEIPT.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35775b8-8e6a-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1644934946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934946, "uuid": "e83c24ac-6ae0-49ad-a623-0f16b7a33c32", "comment": "Malware payload (GuLoader)", "value": "4614eee76db37aec39afb6d9fa36b014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934946, "uuid": "082cf3f9-58e1-49b5-a397-4a801a368b82", "comment": "Malware payload (GuLoader)", "value": "4e1aef578a546e95fab1bce4d73f79a0c0264292d596a3a6f399b7a31440ae16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934946, "uuid": "72030c0f-f827-4710-a628-cc4baabf3a33", "comment": "Malware payload (GuLoader)", "value": "e2eaeec16998eb2169507511178c306ea26b1f09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934946, "uuid": "c85d1086-c246-4b6d-8fd7-def458f709e7", "comment": "Malware payload (GuLoader)", "value": "b94ef7d41c208b7054fde19b6ccd491cbfa9daa534809cee74da0ab61af389ab688ea5839d45e7d92f4992d47bfd8035", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934946, "uuid": "b95c3521-af5d-493f-b672-a3aa98cbc81e", "value": "T11A34E1057F40CD52E0B50A7909A89AB5CEF6AF112618CD8787853E7CAD333E0EB27756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934946, "uuid": "9d74e8f9-102e-44c8-9f88-121536663955", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934946, "uuid": "9f291807-a113-4ae4-809c-5e158956f7e6", "value": "3072:hbG7N2kDTHUpouNbIbIMHMTEkesshiPEDU9v0uH2ZlDPTZkNiiSePq:hbE/HUVuJEEkes4AvqZlOEiZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644934946, "uuid": "6dc0a129-8fdb-41f6-993d-751e75da7126", "value": 230448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644934946, "uuid": "0163eb82-2537-4455-8bc9-df0c6444181a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934946, "uuid": "c2589326-98a8-492f-b935-1dee2e441a03", "value": "Stesil Italy_new order#150222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6770530-8e81-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644944884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944884, "uuid": "be9b1c14-9e58-468b-a7ed-aea7827d74b7", "comment": "Malware payload", "value": "e919e4398eb2292029070443e70a50c7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944884, "uuid": "7834c952-4efd-473d-8a74-4f75504b8a30", "comment": "Malware payload", "value": "4e72a7a4059c18d93819c223d878cb3397712c28f01616cefcab2674afad237d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944884, "uuid": "0460f863-2413-4afb-aa2f-4f53309b4fc7", "comment": "Malware payload", "value": "d6ee1ab304464d86b9df5701ca20c093a2b6c659", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944884, "uuid": "97bc6e2b-e8d4-41d0-ab4b-0be86f79bf7a", "comment": "Malware payload", "value": "7072b539de8aac22b97a7816c5cb2ee9690ea1199d5d0552d7025bdf6ffa372c58ed9018a57a1a8052cbfbaa7d1586f3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944884, "uuid": "d5405754-f8e8-4de6-bb44-2c97defbcaa8", "value": "T1BFD5330C13BBBCFDF99D062837238DE1C5A951F0E58251A2DA2819985C3F5BE17CFA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944884, "uuid": "865e8084-81ab-466a-b31f-66a51816b413", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4H:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644944884, "uuid": "53741b34-7ad4-41c8-9ead-06101fa05558", "value": 2842624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644944884, "uuid": "a554a69a-3257-42bc-b73d-bdddc025071f", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944884, "uuid": "00ad3a56-7c66-4f1a-81bc-ce7b05c3aef3", "value": "4e72a7a4059c18d93819c223d878cb3397712c28f01616cefcab2674afad237d.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daad9ae4-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932006, "uuid": "f6dac5c6-0260-4b65-8767-b217061aa7fa", "comment": "Malware payload", "value": "cd1d3055ae65c48b95c9fcbff2e0dc62", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932006, "uuid": "a5d59b95-cf2d-40df-85f5-428e36ebc4cd", "comment": "Malware payload", "value": "4fa1cd80f2433d8b27edf86772234d891e3fd0e0e12c9a6853ab8e3d77619a13", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932006, "uuid": "22636e41-975e-4a82-9de0-05d3472f3b60", "comment": "Malware payload", "value": "bdd5b9c5b5c19247f9611fd5b6fe3376b867b5f6", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932006, "uuid": "1388d5fe-d82b-465c-8ec4-3e7f265c7360", "comment": "Malware payload", "value": "1ec6aea1ec6eda1c892fb8402cb5589bace4fa150239b211e107cb83d20be70819649a3af13ba4b1360c6a2475a56ce3", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932006, "uuid": "edf08804-fcb4-40a4-a717-043c74ab0e1c", "value": "T1761328F30613BDCF57270E41E50C3161DC59E8A772D899ACBF4888E58BE4118AEB4EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932006, "uuid": "68d86d42-a55b-43e5-a2a6-707707905758", "value": "768:363xSIKaeqDA0qjDfUa+P6tEgn/8uumhG2kfgnt/XpXc33t7:39IKxqDAZ8ag6eg/8u1hJkfgt/XK397", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932006, "uuid": "7d1dae0b-d1f0-49b3-ac7c-b9e79a58e49a", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932006, "uuid": "e67c813e-e7f6-4ae9-a4f4-e778525851e7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932006, "uuid": "2e54b987-262b-4f45-94eb-b2f846e05846", "value": "gustav.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23eced6e-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644953174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953174, "uuid": "a1c13a74-c6ae-41d4-b227-b1dd7048f785", "comment": "Malware payload (AveMariaRAT)", "value": "f8c2987f13293f1bef09e31cc07439c5", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953174, "uuid": "1963018b-0e3e-4a5e-bfc9-0ba3d32f70ae", "comment": "Malware payload (AveMariaRAT)", "value": "4fbdae1ed769e399d666e7e96aca0e9883951d13927c24f471f7ce8d2b85207a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953174, "uuid": "bfd19fdc-cdd1-4645-b759-1dc8bf623448", "comment": "Malware payload (AveMariaRAT)", "value": "b0817211f2639a3ae33a11c382ac94122d2b153c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953174, "uuid": "0e55832a-dbca-4613-8a63-a443f793201e", "comment": "Malware payload (AveMariaRAT)", "value": "b6369fb1d2f38f3b62b892b73e30e66339a585c3782ccc3ba2a27b8b16538a17693851c1012fc373744a211a0ff4b01e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953174, "uuid": "c971089f-cd27-4145-9986-420d7ab1d428", "value": "T1CCE4010073B73BC4C5721BF954E084850BB5AA9D652BE67DCD9234CD1C62B90CA7AE3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953174, "uuid": "c64e3cc1-2b3f-4106-9451-dc462de51de7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953174, "uuid": "3e827569-9c1e-4fa1-97d7-95c636565007", "value": "12288:SS5k+CGEN+WM3bhQ7KZT2CpDBgauL9Z7lW7W+pYxfA+vzhq/l5JN:babFNNMLiKRp9gD9Z7lW7rYxfA+vzhqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953174, "uuid": "1d6b2eba-53d9-4817-9007-37971eb32c1e", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953174, "uuid": "37f565a2-fb3d-4fa9-8a3d-20ba368c70ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953174, "uuid": "973adfc9-512a-4bec-a85a-872d84a17092", "value": "Sat\u0131n Alma Sipari\u015fi FEB22_76543,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a372cbf3-8e8c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644949523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949523, "uuid": "836bb3d3-49af-49da-9833-05d673ac6480", "comment": "Malware payload", "value": "16b6b94e8689da5804f0659ab72ebdbc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949523, "uuid": "404c9a74-3e72-476c-b912-fc168a08ac42", "comment": "Malware payload", "value": "4fffd9bf4ad82ea1f7785926f7fe2395d5bf7a004e9764d09228c4074a9550bf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949523, "uuid": "db7da9bd-5c2a-4bc7-86ef-0631caed378f", "comment": "Malware payload", "value": "db086363636e126cea5ca8a92dd1feabff9b095b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949523, "uuid": "0594e569-7724-4e49-a3e1-2a19f87645bd", "comment": "Malware payload", "value": "8f852163498ef9e49cc42c181a7d52bc288288130188dbbfb6442ecac2f3174ccf9af9467c8c80e23170e5b7639eef21", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949523, "uuid": "889b894c-3a5a-43ce-aac6-76b3bd27886b", "value": "T16513F13CF046AD23E6274934924D1141D3282057E74ACFA805459E8D6FE4A7F26FE35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949523, "uuid": "5b46445b-a1bb-40a7-afcd-2c949377e102", "value": "768:ebwfw3RucLAS+c2LgfOt+ECmabjH7vDyPyew2ykjw0at:iwf+R8Xc2Lg0babjHPyPyew2hA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644949523, "uuid": "64fdeb7f-e7b4-4450-9f30-c0a081f4e37a", "value": 44955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644949523, "uuid": "73df7c07-4065-44ba-91a8-a3756b7cc777", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949523, "uuid": "94b9fd7b-fe8e-4f26-a092-0e0972af363c", "value": "aaron_resume.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab180d1-8e25-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644905323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905323, "uuid": "1766ab88-3c98-40e7-975b-631c02a35c0c", "comment": "Malware payload", "value": "c04b13b73c3b5128d0d07ac3fddc16d3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905323, "uuid": "72bbcf6e-3c3c-4d61-88f7-6f122a2d4cfa", "comment": "Malware payload", "value": "50099701ba9788f6e879c8064d1336ba5119ab93225faf05b7f7aa741fb066cf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905323, "uuid": "417b13c5-dbe0-4b98-b52b-aaa20c6f3a25", "comment": "Malware payload", "value": "bc99ec4cb863553ce42d0def5c879edc05cc31e2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905323, "uuid": "043640c9-0660-4003-bbb2-85fb67ac9549", "comment": "Malware payload", "value": "7aca9a8f300a330cd36607196cee3bff0fcfa44c211d4ca49a77f08441fb6a5e85c3b80412e63639716e97ed53611700", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905323, "uuid": "945ec1a8-4848-4e83-875a-5e98927db26e", "value": "T1B195A832B1317A87C3161461665FBE86530CBD47B2C65F8C904DFBF92CE6CA69302E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905323, "uuid": "3efa5dbb-e1bd-4d95-a0de-f2bc66d9dd43", "value": "1536:k34QJaKXF34QQPD3iOya7I45AiS9SCHAD4pAs8A4eSoHFJ6oUsbaJu7zc1YiW7RX:hK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644905323, "uuid": "28fa3d5b-6510-4ad7-b58b-3cdc4d11f3d1", "value": 2055467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644905323, "uuid": "72721607-53ff-4e5e-ba22-85cda42bb14c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905323, "uuid": "9b9e3ab5-f3b9-4756-87c6-1e19de9a7547", "value": "RFQ_150222.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa898501-8e59-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644927630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644927630, "uuid": "a0590670-0d6f-45de-a0a6-bc33aa110bcc", "comment": "Malware payload (Formbook)", "value": "c54e31cb358e68f6c0a33a62c0e57b76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644927630, "uuid": "8f32e35e-4217-4bc6-ba71-fe2bcba73cb8", "comment": "Malware payload (Formbook)", "value": "503afb59d8192f6adb3e67db043eeb6459e8ec3fc117ef8e2f6690d5f0c4a12b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644927630, "uuid": "5045cec4-7514-4616-a8c7-be87403ae968", "comment": "Malware payload (Formbook)", "value": "ab97e2b2fed3f4afa265a4ee019fe1d80bd18465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644927630, "uuid": "5ae7edad-f819-44cb-804d-112cfd8e6c4d", "comment": "Malware payload (Formbook)", "value": "0ff68941348bb5ba784768cf6c3b746dc34c19cf83ea808f741b32368fe0924a41da98e4f93f56cff24de97c1316091b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644927630, "uuid": "f6c88982-a289-40a8-8ce0-ef5605818823", "value": "T137F4014072B72B84C0761BFA84E6D6850BB9795E5127D63EDED230CC1C62BD18A3E637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644927630, "uuid": "8921e355-0116-4dce-b5d6-8d4d07b119b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644927630, "uuid": "543ad66e-8d77-4d51-9e78-9d37f23d334d", "value": "12288:235k+LCgpZpCqLqe+a426OBunzDeu31NCvQdZcUkAsgaRZszwxg7QLL3y5K:Wa49dCqLqe+a426O0zhFuQ/vLaRZDIQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644927630, "uuid": "004d095c-9ec4-45fe-8241-6ef6603ec495", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644927630, "uuid": "961d9381-6b66-43a1-a86b-d83f715b472d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644927630, "uuid": "b76429f2-9135-4808-bd32-b6710397cbce", "value": "advance payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6fd99e1-8df4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644884299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884299, "uuid": "bded94e2-1874-4ecf-9140-1e9be0749325", "comment": "Malware payload", "value": "d7950838b4e3cd959220530b815192d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884299, "uuid": "79dd28be-818e-4053-bf7d-55e5c4d3d459", "comment": "Malware payload", "value": "505902448c3c57d0f0b0df3a55ef380a580739f5bde1bb5d3a8556128bf62023", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884299, "uuid": "7ab2b8c0-076b-47b6-92ec-9f0f70fe4ff7", "comment": "Malware payload", "value": "25efa2233f5fc3aa842614d790faeefd64adc7b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884299, "uuid": "bb17db2f-d631-45c6-83ce-64776324c44c", "comment": "Malware payload", "value": "0cc1f4cb804b8b9e3af08b6b1a0131eefd843ed6d1fb6986c5ec9abad33ef6565e78d6f221ac2c1a9f4daa28cf4d57fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884299, "uuid": "afc04f0d-730c-4510-94b4-e7c8ae5da8db", "value": "T1A482831AB290C93BC4C293305DCBC6B5A5B0A4F0EB375317220477B979113D8AF5E697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884299, "uuid": "8aa820a9-2e42-44f3-85e0-17b38a455d46", "value": "192:R/H98/tyMcgzWkEHLZiahKVvEso38FB+rZdRELVpHXh/mCt69ySiR:MwMvWlL0ZEN38Fw36xxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884299, "uuid": "f305e0b7-a9f7-4f8b-b334-e7a7b2afb09c", "value": 18480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884299, "uuid": "a5643d36-3272-4728-b0ef-66ec13c522c3", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884299, "uuid": "0ea9a83d-9b04-4527-809a-df5dd3f74479", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4007f7-8e6e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644936651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936651, "uuid": "4af2a2eb-3706-4d93-a116-6a733a978c05", "comment": "Malware payload (Mirai)", "value": "7e0e2cdd2dce3e4b302f875032d1bede", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936651, "uuid": "42a291f1-c1aa-4dff-abb5-c9c11237dbb9", "comment": "Malware payload (Mirai)", "value": "5079a9881d28b78ef34934dc547e058cdc75876abb388abca21551e977183c49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936651, "uuid": "51e2073b-400b-491b-8208-251381843e55", "comment": "Malware payload (Mirai)", "value": "4cfc501c714f1cebaf9e883bee1848b09ccec756", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936651, "uuid": "77123a5d-3205-4342-a79f-bfe1cbf6ba41", "comment": "Malware payload (Mirai)", "value": "edf5a674e2b9e59bee1e5df561913ad63f200b8b6f040c4fde98a8c86a36f6c79ac0733f3e30380e57c51266bdc6228b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936651, "uuid": "bf5c491a-e380-48a6-aa85-a3755a36997c", "value": "T138632A91B8928A12C5C513BBFA2F568D3B2653D8E2DF3203ED251F643BC691F0D67981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936651, "uuid": "c6d0f14e-da31-4ae1-b223-3abd505003e3", "value": "1536:ou5J9TxrPqnHzTN5faYxXlAl3i5/M0P2wk5m8z68V5HwAwP:ouDUplxxX6lS9R+wk5he8LM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644936651, "uuid": "e68134aa-4e53-44dd-81e2-0909c98bd0da", "value": 66868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644936651, "uuid": "e7fca4e5-2175-4b44-91d9-03decbb3b69f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936651, "uuid": "08aee3a9-af55-4af0-b2bf-4a526477f58c", "value": "7e0e2cdd2dce3e4b302f875032d1bede", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394266e9-8e65-11ec-9275-42010a9c0029", "comment": "Malware payload (Hydra)", "timestamp": 1644932594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932594, "uuid": "b92bc3da-3061-40fb-bfd8-d2156ef79b5b", "comment": "Malware payload (Hydra)", "value": "4212125ef94304e3dd9659186204fc5c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932594, "uuid": "b5415751-ee05-4ee5-b823-03425cf2afc6", "comment": "Malware payload (Hydra)", "value": "507f55a17a03490978c09690fc2f11a900b52ff7bc4a73f8af9ea9c586b83d75", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932594, "uuid": "803f74b6-803f-4e2f-9ef2-a97b3c59e117", "comment": "Malware payload (Hydra)", "value": "c807313be5dd0fc754ba913d1b7e6a40bd8a663f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932594, "uuid": "d5f8fdf3-9c02-4738-998a-e7e40485683e", "comment": "Malware payload (Hydra)", "value": "3e39de019cf65f19b6dc885510f7e0d151b4c1a6eacac792dd8e0f6b134da4d3197a0b246fd3b22a7f08d684a85b1869", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932594, "uuid": "dccbef59-047f-4cee-a97b-dd80ba8854ca", "value": "T1B46633C98F82450EFBFB6A7059384A5D6B258D12D701E218167DB37A28321D79B0BFC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932594, "uuid": "efe6caa4-6078-4e20-bf2c-ee757b3dbea3", "value": "196608:UNjgiFP76o4d7GwJAKTynv5f/mz6a1QW/Yp:4g2D0d7G1Uk5f/mzZWYYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932594, "uuid": "e2ec526a-e123-40f8-a360-5fb902478fde", "value": 6523758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932594, "uuid": "14a0d653-c1f8-4e61-b804-17f751207558", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932594, "uuid": "a6be36ef-1b97-4515-b8eb-dd65d7ff8f55", "value": "bawag.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac680391-8df4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884254, "uuid": "3d37d977-c464-4357-af90-5b9454bb5407", "comment": "Malware payload (Mirai)", "value": "564ca7048cbb6f635a47ef647da326cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884254, "uuid": "e53f4b59-65cd-499f-b9f1-415cd0265526", "comment": "Malware payload (Mirai)", "value": "50fa1f2735f018b22c86fc6ce546a8c6b9ca730e78d23f5a986f787191398c37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884254, "uuid": "b6b08e64-de08-493a-84a8-45ab47ea1dbc", "comment": "Malware payload (Mirai)", "value": "1771932af6a747f003f84eae0e94c69999bf3b2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884254, "uuid": "de473982-cf7d-41fe-8469-62dcd2475cc2", "comment": "Malware payload (Mirai)", "value": "c255a9e800b19c024dac1a669c843d5f193b2392dce4bea36ea46c14e39791465b76fca6155f44fed21c0a9bdf7ac18a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884254, "uuid": "9c37968d-85e2-4727-b65f-447011fb5159", "value": "T171E24AC4A953C9F9FC2606752573F7339B77F03A252CEA67C38DC626A852A01A5071DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884254, "uuid": "12d7b72f-9b3d-404a-beaf-41933f1fd550", "value": "768:4r8QABTfJEUC66bU2km7QX/rb7RqR1c9LZ7MyFyVSo:vQmTfJEUC66Y2km7QPnER1c9LeyF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884254, "uuid": "80953903-4218-489a-a92e-dd0d28f07eab", "value": 33564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884254, "uuid": "1e954075-c09d-431f-ba16-3caa6303826d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884254, "uuid": "842b1d53-2e5c-4ed6-9752-0569dcc42b88", "value": "mizakotropista86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2b923d-8e27-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644905970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905970, "uuid": "4db4f792-6a9d-4241-b165-d6169f3514c6", "comment": "Malware payload", "value": "99dc8e83304f2cd36d52096256e5db61", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905970, "uuid": "1a9a0ef8-c10f-49dd-b003-6bf9b25f9946", "comment": "Malware payload", "value": "51a711383e12ed695707baf4ca26e413d422cb2cba846b7423b9a8dad869417b", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905970, "uuid": "f28eb3b0-89f0-434f-a99f-2f03eebe0178", "comment": "Malware payload", "value": "8c41668e5820033cfc7f367d06cac4f519412c99", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905970, "uuid": "d66f920b-3e2a-48fa-890f-cce0f4653d4b", "comment": "Malware payload", "value": "1781a285e725b7b6b676883b0eae902fb223f61cf38c70cc557a26469325a3504e566fdd6d2569882f8da33e5d53e2bd", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905970, "uuid": "c44b1bc9-44aa-4be5-96f5-e895151ef090", "value": "T1EBA41712146A030EB1626DBC9DC1B5B5899AE3FF120D94B520BE1FCF8752D12D86E73B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905970, "uuid": "ac03a19c-dc32-405b-ae57-7ffaf2dde61d", "value": "3072:NclXXFZdJmypPafabsy00ILHEFguXi/YkH9nEzh3vpUWLYLNsKYow1bJRV+I36KW:iXrGSkaba+/Ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644905970, "uuid": "ba9ca50b-b6fc-4e30-8d5c-614c56848c54", "value": 487002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644905970, "uuid": "d79341ba-cedb-4f4a-82a3-488f4446ff8d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905970, "uuid": "d7c9875c-d9ba-4b3d-94b1-b34f9e731ed7", "value": "trebol(1).txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783ce58b-8df2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644883308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883308, "uuid": "5c88d781-74d3-43c9-85b5-9961dd53832c", "comment": "Malware payload", "value": "8a34639447043e3f0a39bef3884df64c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883308, "uuid": "2ff1508c-ff1f-43f5-a240-e019945c5152", "comment": "Malware payload", "value": "535c65cdc13b658b4dfad5c968a9b255821ff1f54b3330b5ec2d2c3d93be27e4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883308, "uuid": "85658c15-e549-4c27-8814-249bfaa9ed3e", "comment": "Malware payload", "value": "c717fb5c273cc790fc09599ee585ffb93cab9354", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883308, "uuid": "b9c20949-4b0b-4226-92e6-14c06d1d31c0", "comment": "Malware payload", "value": "b46444f9da645027ff1023f16b227c4b61e7e298339bbfddd20ad2d6a8df75833df4b44d72f3b12b7fc969b4a04b02e9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883308, "uuid": "b965f6fc-9384-4ebf-828b-3e0bf662993a", "value": "T1E7C42308A3F238DDF1BF597853631998CBAED4B25096A65E13881C9410BAF7E73473D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883308, "uuid": "11c6afcf-12bd-4472-810e-ea39a3bc811e", "value": "12288:IV19zIoFyUS1omjXhObEq88LhnnE12foZIB2RPYGei/28JhK2:IVbRYvjxOgOhntwZIdc/th1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644883308, "uuid": "bb051126-3420-4d3c-9377-b6f6caa3c45f", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644883308, "uuid": "6eab9c7f-a0d9-4449-a12b-5d8985ef94f1", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883308, "uuid": "b2969599-f533-4ee9-bb17-dd16c752ec62", "value": "535c65cdc13b658b4dfad5c968a9b255821ff1f54b3330b5ec2d2c3d93be27e4.gzip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6abaa6dd-8e93-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644952434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952434, "uuid": "31bde869-0953-422b-ae99-8f7f5d596880", "comment": "Malware payload (Formbook)", "value": "2dd6da56d2b157365a51fb76764db9ed", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952434, "uuid": "a95aaedb-1adb-4dac-93c7-dc44d5696f48", "comment": "Malware payload (Formbook)", "value": "54240271ba86cd35518902f260f010583dc0a88ed3f304de9136295375614eb8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952434, "uuid": "f2751bf4-760a-45ea-9b8e-62e5991d44c8", "comment": "Malware payload (Formbook)", "value": "51bb9de33d70e0522ddc5c6183c298a58fe02500", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952434, "uuid": "f922231f-198b-4770-a0c0-3bd21b7937a6", "comment": "Malware payload (Formbook)", "value": "fe1ee10b6743c9646357db47fe218b3c639adf16de82213774712aa74c31592cc3da01fd67100f2c158b738e82ef1f8a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952434, "uuid": "908b1a01-73ec-4c99-a218-f10a357b3df2", "value": "T1BD959832B1317A87C3161461276FBE86430CBD47B2C65F8D905DFBF82CA68A79306D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952434, "uuid": "3668740d-04e4-44df-b1ec-08f0f7d02ac7", "value": "1536:h34QJaKXF34QQPD3iOya7I45AiS9SCHAD4pAs8A4eSoHFJ6oUsbaJu7zc1YiW7RH:4e3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952434, "uuid": "acb18f62-0763-4212-8661-5ce171c9eeff", "value": 2055489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952434, "uuid": "ac13540c-acb9-4ed5-bd8b-8771e6bc33e9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952434, "uuid": "33cbab01-396b-49fc-bbf0-71f2df3cece3", "value": "RFQ 281OR41.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1a0531-8e45-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1644919102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644919102, "uuid": "52ae1b79-e675-4df7-902b-bcb55b596f96", "comment": "Malware payload (GuLoader)", "value": "3a41efdcc8a081d8983b5464c53affb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644919102, "uuid": "8cf80b58-d1a5-40b9-82eb-2185c3e7918e", "comment": "Malware payload (GuLoader)", "value": "545e0ad68832f2c8806d7ff7e5c712440869cf865ca3cd88a65e80a9a51b7095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644919102, "uuid": "b02652bb-44c6-428f-82ef-48ce7300773c", "comment": "Malware payload (GuLoader)", "value": "3de8711a7e575af554ed4db28ba79d2ceb800049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644919102, "uuid": "50d3dcba-4482-4596-af52-f03c96bcc18d", "comment": "Malware payload (GuLoader)", "value": "c3b4577acfa0538c295958452f07c6c36cedcb7bd8cb0eea1afea238306da5c78e8293ba54052fd87115af19dadd5cc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644919102, "uuid": "4ae4f37f-c9e9-4579-bc11-3c4c38a1404b", "value": "T11824E1057F41DDA7D0B10AB9096897B98DF7AE111628CD8387857E3CA8333E0EB26756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644919102, "uuid": "239b976f-b182-4ac4-b3bc-26a5dda4cd70", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644919102, "uuid": "c71d0f69-d57f-4705-8759-f588a1ff4344", "value": "3072:3bG7N2kDTHUpouNbIbv4qWrpRuF7GyDU9v0uH2ZlDPTZkNiiSeP/E:3bE/HUVuvHWrnk7GKAvqZlOEiZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644919102, "uuid": "348e0037-4aab-4b9f-bac2-53838be7b608", "value": 230096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644919102, "uuid": "b8a0c166-af44-4931-bf9d-6e7f984f5150", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644919102, "uuid": "408d8dbd-8e91-4312-9fbc-302ab1d840d5", "value": "Quote Order_No.POD2215.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce7ce63-8e96-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644953780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953780, "uuid": "5ece25a6-dd3a-4913-afcc-4ad7724d3ea9", "comment": "Malware payload (AgentTesla)", "value": "bc8d33cf9a58428b70de223566f5fe58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953780, "uuid": "bf9a060c-96d6-4240-b384-1eac6bb1955e", "comment": "Malware payload (AgentTesla)", "value": "547c44993cbbcad4856b44898aa0f25f4e3e4f6af156bb060887ea4e355d32a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953780, "uuid": "a1bdc32c-a53b-4f5b-a7fc-881fc9be87aa", "comment": "Malware payload (AgentTesla)", "value": "ca4a078d635345cea3e539b446d16e4bd69be474", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953780, "uuid": "656e3ab3-c16a-46bf-af6f-e15260691589", "comment": "Malware payload (AgentTesla)", "value": "204c9b1e9ba32fc8c2576961a3052f2a56c70d590e27c10f70618bee45627f69ba40864b41f7a25b5d0c45a38d2cdd34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953780, "uuid": "d6b67292-6362-4c50-90b5-b2e9ef2efc21", "value": "T1ABF4020077F76755C4360BFA80E891895BB5BA9D152BE73DCE9370CC1C227888A7693B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953780, "uuid": "5f7af5f8-d4d0-46ea-ba6f-6430b3fc623d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953780, "uuid": "bfd7b475-24b6-405a-8b1e-282fca027064", "value": "12288:oJt3n5k+kBKSje7f/acIcAUrIU10p/3BmePi9Vw2vSk2mDh3V3T5IKCLNVb/GZ5:uFaMQe7qcIclEimvB0rJvS8DhgKGDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953780, "uuid": "c64d1036-71a1-4edd-8579-42af13084a1b", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953780, "uuid": "49704ec8-99c4-4993-a73b-c15ca3226b35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953780, "uuid": "be97aa84-e6d2-4aeb-b357-976d97a8e090", "value": "bc8d33cf9a58428b70de223566f5fe58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50739ed-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644953095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953095, "uuid": "f72300d4-8d17-4ad2-b0cc-267e9769f42e", "comment": "Malware payload (AgentTesla)", "value": "e5d08851ca3e997b878f54a611fa625b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953095, "uuid": "590a1b21-c3ed-4f72-93be-5f0f876acb19", "comment": "Malware payload (AgentTesla)", "value": "547ce94d270d7261c4074e9868072530ff0b3d17dda480861c48c3bb106c8c3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953095, "uuid": "61ef5bc5-36e7-46ac-84e7-8f6644556545", "comment": "Malware payload (AgentTesla)", "value": "10a77b49cde36f0ad559bdd4ee2ab3a6a31a281a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953095, "uuid": "bde1bd8b-b2dc-4dd5-b7ee-e527e59461bc", "comment": "Malware payload (AgentTesla)", "value": "1da4fa18f3e3e9cc596c5d777a6ed6d9fb007a8acc45b9c992e1ebeaa61741464423962ad1582711d7f25df24b8922fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953095, "uuid": "4b539458-8695-40e2-932e-3988e25a0f08", "value": "T1EF05020076B73790C4760BFE94A160C60BB9666E6526DA3DCD9334CC0C627D19E7BA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953095, "uuid": "ab24a6c6-f92f-4cc4-807e-e7df1ab05bda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953095, "uuid": "c4724d30-911a-41df-b9b2-cd39a2a0b388", "value": "12288:bc5k+4MhS9BSrnwgoGEyiwfQZ4yf97hI0aNNjl+iUY2YrxLvxGgdxHQ4Rz:gabMmBAwg6yiwiH9tIzNx12T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953095, "uuid": "ce763d78-c55d-4465-924f-7ffcf1d1f1da", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953095, "uuid": "1f58db89-b2d2-4168-a6d1-03ee11775f2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953095, "uuid": "79db4ae1-4112-48a4-ad2a-0e9ccce8cbbd", "value": "DHL AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507622f5-8e57-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644926620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926620, "uuid": "71bbcd04-b47b-441d-89de-0932696da490", "comment": "Malware payload (Formbook)", "value": "4049ea10c061ecd53c69f0c0a2afe683", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926620, "uuid": "38dc9999-1476-4c3d-bf02-7631ebac3d86", "comment": "Malware payload (Formbook)", "value": "54cfa1f93d985c0bf952e00247f781f36988dffec0cb8d83f79fa3e41d98b335", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926620, "uuid": "e8ff12be-e803-4c44-bb06-44763f6560c6", "comment": "Malware payload (Formbook)", "value": "5e3a42cfcd133343ee81cc1bdfdf9fe86e1a7065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926620, "uuid": "55245385-6e82-4ac7-ae19-d75b273546a2", "comment": "Malware payload (Formbook)", "value": "9e8ed5e74d3da0e20fab2c4ce04b01c7f9335fc592a6e7449b2851fec7d0104d8576249c2f69d22a2951399605da2af2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926620, "uuid": "ad8acdf0-2e58-45c2-95b1-ca3b5977dad9", "value": "T157F40116B327A6AFC53402F8887282C64BF0B29E14A6E7FE5FE231D452C1BE5457417B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926620, "uuid": "94dddbd0-7824-4729-a25b-a1a0893ac2b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926620, "uuid": "19e0b962-c5ad-41ac-b48a-453576dc9b05", "value": "12288:KGbFd7QRfr88/k2YumaAM+tJDpsP2UPGmN7lYCDhHvU6imYcVTG71hrwJ2DJ5k+:XzQVr88ikfidfUPGmBZvi8uWANa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644926620, "uuid": "10a39ab7-2bc4-412e-b2a6-e3e21d624a91", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644926620, "uuid": "4854f768-f681-48e3-b995-d06b1b50c98a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926620, "uuid": "0e305125-194f-49ff-9561-dbc6bf20b9b8", "value": "NOVO PEDIDO DE COMPRA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e32a64-8e0a-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1644893558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893558, "uuid": "c6106ae3-b6a0-4a1b-a578-ad0a8a92cb06", "comment": "Malware payload (Amadey)", "value": "282af58104695bd9d994de1aa6008880", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893558, "uuid": "b233194a-5953-45cd-b8ec-99235fdb745c", "comment": "Malware payload (Amadey)", "value": "55bf77af4d199f51c85b2d2f18c724393d4154f4f6f7250a95c2f94666b24f2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893558, "uuid": "426aff7d-a60f-4be8-ba91-95623aaf9681", "comment": "Malware payload (Amadey)", "value": "5730d379f5d9e2a45ad2bab92df03f262370fc15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893558, "uuid": "7a84b047-7cd5-4b18-b533-c11252bbf3ee", "comment": "Malware payload (Amadey)", "value": "7fe3a659ebd7fa7c04b1b688b7ba3bff12cdd135c856cd7c5dc361e54d8aee9373b07dd64aed7c9910740b429aa988f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893558, "uuid": "b8aaaa3d-9edf-4d72-92f7-5beb50a2441c", "value": "T1BE658E01F101A136F8B340BBDEFE592DDA68AA61130954E773D8594F8BA2EF23D32157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893558, "uuid": "80a708d9-5ed2-4785-8c22-d39b57075260", "value": "e45d7bb41c81c82bd0d5fb8ab0aa4903", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893558, "uuid": "e0180fce-a88a-4dc0-859c-c53bfc0541cf", "value": "24576:8wkKYD9dVaCsy1Hwz3/8f475iPUDPoZ2jTSoJC:8wvYD9faCsFz3/w475mcP22jTSo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644893558, "uuid": "a25fcefa-ca35-462e-a301-c954b1c58689", "value": 1464256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644893558, "uuid": "6ab007d0-3b35-4b27-b6a8-c9b2a0fb27a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893558, "uuid": "1b217020-efff-4dc0-a4a2-a791b9bee429", "value": "282af58104695bd9d994de1aa6008880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea89769-8e66-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644933301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933301, "uuid": "9c2861af-3a63-4ccf-b79b-7806153ffe70", "comment": "Malware payload (Formbook)", "value": "92dd2dc529fa579c3dbd71aa64b6030f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933301, "uuid": "05f26961-40d0-475c-875c-f2e3b81ef79c", "comment": "Malware payload (Formbook)", "value": "577be11cf58c8f96ee336ccf5bae82afc461d139ea81ab696877d6fbbe0ade62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933301, "uuid": "d9c0a70c-f5bd-486a-97cd-0ddbbea28b36", "comment": "Malware payload (Formbook)", "value": "01ebd613cd4ed8edcbc5c2c108575af077c551bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933301, "uuid": "f672fb06-bf8d-4c96-b717-87ce00c6ddf5", "comment": "Malware payload (Formbook)", "value": "3ea1fcd6695350ac75d0f0301dac7e9f30ef833f1f0aa60bf55e26420f842bc64e4117643a61e6b3101e3c556bc79dc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644933301, "uuid": "e814175a-e272-4334-b6d7-9b6a2c2f50c9", "value": "T1D8F4020173F33745C4361BFAD4A695450BF97A9E1927D23DC99260CE1C63B908A3EA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644933301, "uuid": "6bfc7673-343f-438e-89da-77600c043453", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644933301, "uuid": "f7f27b70-61f6-4f8b-9c21-967d7080b13d", "value": "12288:fR5k+K3GihKGsNuq8W0Op9MzxayGHEhNyhwkJYw5CbWnY53:JaLGrGsNz0OExayGkBep5I5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644933301, "uuid": "d2010a77-6168-417e-a036-b3e1e9225d6d", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644933301, "uuid": "9aa41296-7283-453c-bac4-95006c57bfa4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644933301, "uuid": "aa30661b-7861-4bda-9a1e-d1ae40eb832d", "value": "RFQ 0203-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ba3405-8ebb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644969526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969526, "uuid": "8187f4aa-e3a3-4a2e-aa00-216282bed882", "comment": "Malware payload", "value": "3fa536476c0ef85e7909e7eb3be2f7a6", "object_relation": "md5", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969526, "uuid": "70c55edf-fa5b-4a26-af14-d4dd2ac4b564", "comment": "Malware payload", "value": "5947d8c79f9bd18f89c58b60191096bf0f3f76cf085e19a2352daff060c4c70b", "object_relation": "sha256", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969526, "uuid": "aa4a7206-937e-41d1-8d29-0a8e92c2eba1", "comment": "Malware payload", "value": "9d263782d85c85342171b5587d74fb8b190ed14b", "object_relation": "sha1", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969526, "uuid": "243e6589-8f53-438f-af83-7aae79cb0eb7", "comment": "Malware payload", "value": "5c9372474e80c5702c4ff59423bc073ddfba3631546cdf2e5ac0693baa8834790c0840d878b239a763725173f5f25705", "object_relation": "sha3-384", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969526, "uuid": "d7b2850c-eecf-4ea6-a7a6-40f5ad1fd9c5", "value": "T10E4523FFD14C52CADA3548B482E5F11DE8077E66AE140883BA937CFEE6B54984E39017", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969526, "uuid": "c78ef63f-3b05-4810-8db3-6011fcf9f4ad", "value": "05b52ed39c6c35deb93da7d639404837", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969526, "uuid": "6375cbd3-04ec-4eb6-90d9-184b811861ee", "value": "12288:kGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kGsqjnhMgeiCl7G0nehbGZpbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644969526, "uuid": "299d44c2-3640-4b3e-bd9f-0ab993c422da", "value": 1255424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644969526, "uuid": "6d2616de-806e-4814-bdf7-e1c0221049ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969526, "uuid": "2dd825a5-d6bc-40a6-9f7f-df690e275c3a", "value": "5947d8c79f9bd18f89c58b60191096bf0f3f76cf085e19a2352daff060c4c70b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a1f068-8e9c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644956152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644956152, "uuid": "06b693d7-c0c6-48ab-9386-296018ac35a7", "comment": "Malware payload (Loki)", "value": "bdb049c944a16243e651c6ba19139709", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644956152, "uuid": "672c97b6-dc59-4d10-aaa6-a0f971f53272", "comment": "Malware payload (Loki)", "value": "598dde997bd5f0f16ca0d9846dfd5f5375585012473fda23878c8e18cc9b6ad0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644956152, "uuid": "c91d19f1-9aca-4d24-957b-c527216ba4f8", "comment": "Malware payload (Loki)", "value": "4b7eb287f37753b633b0ac537b96660ac9f8dc64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644956152, "uuid": "7c8c5fcd-e5bc-4412-bfdb-7c06712d245a", "comment": "Malware payload (Loki)", "value": "90e4d0fb164d41eb53c7348a16141341f8da727a16f6a944b12f45be0ba2615720948074a3923b1cb4779fe4e386c90d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644956152, "uuid": "6c9d08bc-35fc-400d-a7c7-4347ec95c816", "value": "T1A6F4010B7B2BD674C47916B500DFA13553B0AB8C2573DE7A7CA6739C19823930EB8939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644956152, "uuid": "0aa552ae-6b27-429d-a8cc-63690089835c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644956152, "uuid": "de6d7dee-c461-413a-bc68-edb5c6532532", "value": "12288:DTENkEFxlXrTqaJaOZ3baC1goJnkU1nCF7XSzcnwUrbk:fE/ZrhZ3ZjkOnW7XSzAr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644956152, "uuid": "d74b4b83-e2a5-4e7a-837e-7e2f96b9e012", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644956152, "uuid": "77c9cc69-ddf0-4104-a29d-1cf0d6a335d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644956152, "uuid": "62ca4df1-a042-4043-ab55-cb783b10482c", "value": "bdb049c944a16243e651c6ba19139709.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7d4291-8e82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644945026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945026, "uuid": "1e2d22ec-0921-40fd-aac9-4279b9bc3ba0", "comment": "Malware payload", "value": "97a962fb5bd427e09547ecaaf850e034", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945026, "uuid": "4fa88ef9-aca0-4f82-abea-c21fedb37b02", "comment": "Malware payload", "value": "5a1797ae845e8c80c771ece9174b93ad5d5a74e593fe3b508ba105830db5fd92", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945026, "uuid": "56a578c6-5d60-44ce-8ca2-daa9802d050f", "comment": "Malware payload", "value": "3040ea8bc3226af1fc201c4fefcca17b62184bbe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945026, "uuid": "7a237c17-0554-4d35-9a0b-451f14c8c920", "comment": "Malware payload", "value": "6d633e2d6aff0b9a1c230768289cd0d5a383be381bdea19c4a825a01a868cbb096d0727ed14397904300d526de3c0a7a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945026, "uuid": "6f7c4e28-6c24-452a-b57b-525da2b0020e", "value": "T197F0E9ADD6615FB9BD1822B93A4FD0CC88464C76C6BF8C13B505B9D210AE22A7069632", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945026, "uuid": "b5c9f902-6c08-494d-a588-4c6afa6e28db", "value": "12:emlOqLS9dQL11/47cWlCBUWCSV11aMlCBbfxCBmK3Cx:emjLS9dwCIWUfvG8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644945026, "uuid": "f9451cbd-bc1a-4678-9353-88890afe9267", "value": 489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644945026, "uuid": "8332818e-6b39-4696-b258-0fbafb16d424", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945026, "uuid": "9ee474f7-e76c-4ae2-a477-a7b03b55919f", "value": "run", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2cb3a8-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644953267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953267, "uuid": "83131ca3-c70e-461e-ac7f-9165ab5501fa", "comment": "Malware payload", "value": "70f58625baf28f632fcee71c709078a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953267, "uuid": "2e2d6c6c-a9d2-45c1-958d-fface7af65f8", "comment": "Malware payload", "value": "5a5960ccd31bba5d47d46599e4f10e455b74f45dad6bc291ae448cef8d1b0a59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953267, "uuid": "9af3e582-24eb-49ba-80d9-aa3fb2a0b187", "comment": "Malware payload", "value": "4452c731f1a67113617a4a3d3e8961bc1abaef3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953267, "uuid": "aabf1cf8-75f9-4362-800e-3798ab54c398", "comment": "Malware payload", "value": "680a30fe0df91a9bd2ed15a97e40f6e7206b4eded5a216a76569cdab78c60d189dcd02bfbfcc947cd582dda533c8cff8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953267, "uuid": "a7c7eac4-58d3-488e-b4c1-78d53ad46fa5", "value": "T10F06224BF5429FE4D4B5003C45F58B722376985AEB138377364AE375FD8B2B82E85882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953267, "uuid": "33a78ef0-8edf-4f37-8fe7-98788a9e353d", "value": "98304:6tctO3dnVeza4F29hm7SHZ6nexM25HMrE1:GD3dVb4FyYa5HM41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953267, "uuid": "e306bcaa-623e-42e8-9645-942c1e572256", "value": 3754388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953267, "uuid": "4a87c88c-13e3-4632-8dd6-2434bdf78f01", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953267, "uuid": "211da814-02f1-4be2-ba80-6961224e866a", "value": "ltmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10ecb84-8df4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884262, "uuid": "1025f8fc-2507-43cf-a7b8-373b0eb3d949", "comment": "Malware payload (Mirai)", "value": "1d14d9f520aa22b5ffff005c47f52870", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884262, "uuid": "2b0d8e26-bab5-4077-a3d0-f83a26c78a07", "comment": "Malware payload (Mirai)", "value": "5b1ca59a8e0e9583c4102605264fc29a0cfab84c68b78072a908a5783b441948", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884262, "uuid": "6ab1f0ba-51a8-4390-b4f8-d0f6a6e21c5a", "comment": "Malware payload (Mirai)", "value": "28fd3a317630bac8383eddd615ae86a108af7969", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884262, "uuid": "dbdc32bd-f1d7-4ce8-bff2-9f27fc9a8807", "comment": "Malware payload (Mirai)", "value": "1c1ffe3b067052fe7bce7ded8f282ba5936fde6d591072841928246b396f8d53b8c189512a09bb82c420061d2ebc04a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884262, "uuid": "c509ce27-948a-4933-b2a9-4acd5bf75b4d", "value": "T16703F891B8819A13C6E4237BFA6E018D372123A8E1DF33179D222F517BC692F0DA7645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884262, "uuid": "bdd3a367-0fba-48b6-aa4e-645d251c2cb0", "value": "768:kFK9XAhVNfE5RNViitg+GnfqnpiFbt1YJ2Wo2SaMInpEe:19YffE5jMFbtY2mpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884262, "uuid": "0e2c7f80-cdc2-42fb-b4ba-186a7d3467f1", "value": 37872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884262, "uuid": "c33bf3a4-e40b-45d4-9f51-53b4fae499fb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884262, "uuid": "d3d9173e-cb7b-4f32-b83e-ab08b82370d0", "value": "mizakotropistam4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e064c0-8e59-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644927642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644927642, "uuid": "dd349200-7295-41d2-a54e-ad4d1ad9bdc0", "comment": "Malware payload (AgentTesla)", "value": "a6a78b442e749111c169c0bf3c6dfb19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644927642, "uuid": "208f1f92-dfe7-4da2-aa4a-5d2b04e54d14", "comment": "Malware payload (AgentTesla)", "value": "5b9743f0c65c5e93b2ce57409241ab9a7a827b20d4384c02f929e0e0556789d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644927642, "uuid": "27af11f3-ad58-4932-bcac-e72aea8a625d", "comment": "Malware payload (AgentTesla)", "value": "c72c9505633d45b25aebeae534546faf35a2b613", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644927642, "uuid": "99987df5-a2b5-445e-9f45-3fe9709a40a6", "comment": "Malware payload (AgentTesla)", "value": "64c5b9609b15a33dde42f93cb194c7932228748bd357d52b4198f2bdfa2ada5b16b6b457237e387a5c63286c0ed0c55b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644927642, "uuid": "2d494eed-cbb9-4ad1-ab64-8cc831e7989e", "value": "T198F4010037B7BB84C4725BF641A1A1880BB5719E6067D67DCE6230CD5C62B91CE3BA7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644927642, "uuid": "0856fb16-eccd-448c-8577-41f7946247b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644927642, "uuid": "d328e07b-4673-4d08-aaa6-d6c4cb86658f", "value": "24576:dalTPEnB6dlNMr7NnC0mPKWunjjbjdzlLJFlB:EhPrsNnCvPwjbph1Fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644927642, "uuid": "980719fa-049c-45b0-a2cd-9fddb7c9ac6e", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644927642, "uuid": "6cec25a9-db41-47fc-8ab3-dbeb61cdb1ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644927642, "uuid": "e98b2057-702f-480e-aae6-9ddf51c77c5f", "value": "bankdetailsinvoice7890123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36ba0a5-8df4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884293, "uuid": "2afa4381-4582-4ead-ab11-37ed90c718ad", "comment": "Malware payload (Mirai)", "value": "defb892c44cf101df4751cc05cc7f68b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884293, "uuid": "a428ac70-0786-4003-9926-c32f64752e79", "comment": "Malware payload (Mirai)", "value": "5d6f674a7abab5e60548531a69e6ecb23cc2e2fe823cd7f8ccac6928db5f757e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884293, "uuid": "8907a72d-bb4f-4a5e-ab48-346833ecad81", "comment": "Malware payload (Mirai)", "value": "66317d7ae162afccc543cbe11504a4868c5ca3fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884293, "uuid": "cb014dbe-f23e-4b56-b320-7d3381a47e49", "comment": "Malware payload (Mirai)", "value": "b77a6d368799abce475c687bba6192b4d7a141155ab24f06c80eeaca7f47cd23c311ab3fe80dbe070ae61092d493f0b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884293, "uuid": "2928fb11-0d9c-4d32-aa17-6945603e7853", "value": "T119030A17B981C1FDC489C57457BAB53EC93735BE023DB2A637C4FA27A946E208E1D848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884293, "uuid": "6e573557-5b03-49e9-a2cf-d91f6932380a", "value": "768:BzTnTW5wKgB3cR7stPNyNZbnOSAGWq+MCuTyZSXzcooV:5nTW5wKgBcR7sdUNNt3D+ButXjoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884293, "uuid": "e0c570fa-740e-464c-9ad5-fbdc2f3f76fa", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884293, "uuid": "05ccf066-ec51-4e2b-ad85-f7806cd4ad89", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884293, "uuid": "04a5fd6d-eeae-4af2-924c-0ed237d42312", "value": "mizakotropistax64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e9e3b7-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644953073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953073, "uuid": "70313c19-f270-4a24-ae63-b618ffe23aff", "comment": "Malware payload (AgentTesla)", "value": "b6384caf2e619b2e470ae7eef3c61020", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953073, "uuid": "30c08168-1a7c-459a-a47b-175ee869e22b", "comment": "Malware payload (AgentTesla)", "value": "5d7383ae1ddec95b158992fe38c4c0155e3ed5eed55bee833f6921feeccf9284", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953073, "uuid": "a4988ab3-6085-414f-b238-b719c96e0c53", "comment": "Malware payload (AgentTesla)", "value": "edb062146cdc851bc0bb7777fa64528e2880511c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953073, "uuid": "23dc24f5-10f3-495f-89db-8309ae0f5df4", "comment": "Malware payload (AgentTesla)", "value": "8c9ac30403e6d7dac3a1839a05b5e54d362ca2892d6a2fe6d4b7ef15c4bf2fc7016575021ea3ccf09301f4625d6b0bce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953073, "uuid": "171f3954-9232-4015-a172-45c8409f215f", "value": "T14115021B773BFB34C06523B640DB91B503E1AA9C1273DE7B6CAA32CC1A523125EB5539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953073, "uuid": "2a0ff0cd-0288-49dd-a86e-32547b756030", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953073, "uuid": "952c91db-8844-46e0-83b6-2771d00f7404", "value": "24576:2VUwmXHi1TlfZBkBuLMrnYmV1jGOn4M7T2c3bGWKa7fcBTX0VSgJ:CUwmXHQvm8Qj7ecrb3LITkogJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953073, "uuid": "35294dba-127d-44f2-b58a-6fd240506637", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953073, "uuid": "0306e40b-73c6-4b7e-9707-851895248a28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953073, "uuid": "e890d1cf-4752-4fb6-9859-ae5e515838c1", "value": "HSBC COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d02543a-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932117, "uuid": "9042f0db-32bd-4e50-bb1a-5aff600dec84", "comment": "Malware payload", "value": "74c51cf0963e50f41b5bca8cabae38bc", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932117, "uuid": "758a7e41-919b-4cb1-94b0-4bfaccb60507", "comment": "Malware payload", "value": "5da68257d61b0ccd4d3cde916d825223f7a21a01b4154c1c92830ed73ae4549e", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932117, "uuid": "bd5a1b73-2255-4e79-a0b5-6fb61e49f210", "comment": "Malware payload", "value": "db16d7fb0d4ce3b5838d4312d7a0d3383aea4ba1", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932117, "uuid": "12e294ca-02a6-4eac-a686-4a8e3aa5987c", "comment": "Malware payload", "value": "d6436ba9f89bf6483aba7e1fa9764af8352626687585dfc406875299bc2a90a4a20dc206526198843fd12719cb348f8c", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932117, "uuid": "25d50b09-8ebe-459d-aad3-ce067d6b37f9", "value": "T1B6131BB30213FD8F5A220E45D50C2110DC9CEDA772D89DACBF4898E59FE91188DE8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932117, "uuid": "5f73e8ef-7ccb-4130-b43e-122a3c3db135", "value": "768:YGWLt7h3+TwKa4Wabmm92kfgnt/XpXc36:YGq7MTw3Zaym0kfgt/XK36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932117, "uuid": "e2c487cc-3995-4c7d-be47-7b18bc3b6e58", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932117, "uuid": "d1e63a7e-81c0-4549-9e71-eddf59eed73d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932117, "uuid": "1a90908f-406d-4318-995c-69d39c1a5c2a", "value": "NJJJGORDO.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c801026-8e93-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644952329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952329, "uuid": "07022692-f175-4361-af47-2c893c537589", "comment": "Malware payload (SnakeKeylogger)", "value": "6fd03773a93040fbd07b7cf48d47bd10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952329, "uuid": "040a8517-94f7-486c-94c9-827bc57db978", "comment": "Malware payload (SnakeKeylogger)", "value": "5ddfb2c0ff6ed684d4bc9fcd114625015c054d797bd7f0d2bf7284b4fb48f5fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952329, "uuid": "6881e01b-b511-4de7-af8f-75642fb4f375", "comment": "Malware payload (SnakeKeylogger)", "value": "24c2284c3d39d138f485d9e9bbe134fd53b8fa16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952329, "uuid": "9331039f-e214-4dbf-9110-f98681faacf6", "comment": "Malware payload (SnakeKeylogger)", "value": "48d97c0832f2bfe8e0ae09dc16c86e766ea661f97225f9b94dbf9df689a7331e3efaa8f1642d8f8aadacbb7ae9f1831a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952329, "uuid": "4347d5e8-35ff-463d-bd7f-02ca5af7542f", "value": "T103E4010033B73B80D57217FA54B4D2425BB27A4E5127DA7DCE8234CD1C62BD49A7AA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952329, "uuid": "3582939d-dd41-4ebe-a5e4-7adb83fc5dcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952329, "uuid": "1acb7a53-515c-47ed-9df5-cb9a2ee68879", "value": "12288:YH5k+AFIezSbL+FKLgrr6LG4NfUfX7sxIP1WKMxATSpfroSfHH:UaduHuK036XxUfLsxoW1okD9fH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952329, "uuid": "677d1924-02fe-4125-b563-4dfaccf3ed9b", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952329, "uuid": "dee0e527-cd65-460d-8bd0-38b2991a5de3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952329, "uuid": "33ed12d1-e73e-485b-9325-b1719199332d", "value": "wdBUZhnOstjGORN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a00549-8e45-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1644918839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918839, "uuid": "eb4e6192-c918-42ee-861b-fa149e954a39", "comment": "Malware payload (RemcosRAT)", "value": "5af1567d74b265563c2aafccf72f5cd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918839, "uuid": "94a55020-a09e-43ef-ae6c-8d48a1d5eb2e", "comment": "Malware payload (RemcosRAT)", "value": "5e068f4aa5de01f9bcecef94e5ddb60e09b6e644fae54d031756b5139d5430a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918839, "uuid": "9493d8c1-3bfb-414e-9094-ab49dde2fc42", "comment": "Malware payload (RemcosRAT)", "value": "4a93d321b96019ad5e245dea783428ca27f806e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918839, "uuid": "8e32d494-cd9c-400d-92ce-3e7e67d9d8d6", "comment": "Malware payload (RemcosRAT)", "value": "c8ea9a01ad0865be40dca2501fc20bc2adca9ef16429320c46e6ea9f51079ae271d3c15113bdee01c7a3b9ac14e3dadf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918839, "uuid": "1981798d-3b0e-44d7-a216-f409c5e62279", "value": "T1B7351207B627EB74C46806F600EFC4B613B1AEDC1037DE7A79BA319C19563A20DB6578", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918839, "uuid": "efad5dc6-850f-417b-af3f-d775c239a7fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918839, "uuid": "fac7a42b-cc2b-4ad7-b6ad-98c7f1a4351a", "value": "24576:tJoBcQohPm1jml77CGlj/FNYnhdI93TUjmBvGDxvhMJfqLIJ2mP:3oBcQohPm1cxdrShda3TUjeAxvhMJfqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644918839, "uuid": "667195a1-c230-45d4-87e7-2e62a9d26d81", "value": 1146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644918839, "uuid": "8d2fb49e-f461-4667-a1cf-ea02fd45c5ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918839, "uuid": "d45b566b-f939-42b2-986e-a1cdbc077f63", "value": "ORDER-MV GHENA -GHSPE021522.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b85b11-8e3d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644915412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915412, "uuid": "539467e9-55e9-4370-9836-d5bccec4efa7", "comment": "Malware payload", "value": "51ecec287af1910aba3e7f4d724890cc", "object_relation": "md5", "Tag": [ { "name": "batch2exe", "colour": "#550915", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "evilnominatuscrypto", "colour": "#8ABDBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915412, "uuid": "697bfe63-ccb9-4a71-bcdf-0dc352b6dc86", "comment": "Malware payload", "value": "5fcf5f6ab5218cdcc5745e391ff77ec1e7769134048c9f8432f1325f3c59dd5f", "object_relation": "sha256", "Tag": [ { "name": "batch2exe", "colour": "#550915", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "evilnominatuscrypto", "colour": "#8ABDBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915412, "uuid": "3f30b679-a5c7-44ea-a4cd-add87c49fa88", "comment": "Malware payload", "value": "b1e29be1a7d502a8fefeecab981829b2c6ff4818", "object_relation": "sha1", "Tag": [ { "name": "batch2exe", "colour": "#550915", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "evilnominatuscrypto", "colour": "#8ABDBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915412, "uuid": "ab656f40-be73-49e2-aaee-2b30f551c42d", "comment": "Malware payload", "value": "d5531fcc692cb334662107dc3d3ec4e39fd4fe341c8c69412072cdecdcbac76c87c42999c4fa6aa35eda12cbe1ed8a18", "object_relation": "sha3-384", "Tag": [ { "name": "batch2exe", "colour": "#550915", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "evilnominatuscrypto", "colour": "#8ABDBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915412, "uuid": "ec7611f3-ddc5-4692-9083-164c0fb413cd", "value": "T1BAC41345B6FB01FBFAF34A35009A642A9726B630975AD8D7C70C3C42A543DE2993C3E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915412, "uuid": "d60b845e-38b7-4c16-9fc2-08f44915a5d5", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915412, "uuid": "0cc97afe-4745-44f8-a2db-d407ab88a728", "value": "12288:Hcv0NTl83xZAI2hO1OAglNFHznrTDxDMT7Vas3yH:HcvkTlqxZGO1sDFH3xDMnAs3yH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644915412, "uuid": "b53aab8b-ac83-4910-9039-37d42471b14c", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644915412, "uuid": "29f602f2-1284-4c60-b342-afb333c5ca9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915412, "uuid": "96f34115-35d3-4133-8ae1-d84ab253e91a", "value": "5fcf5f6ab5218cdcc5745e391ff77ec1e7769134048c9f8432f1325f3c59dd5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d529394f-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644931997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931997, "uuid": "83d523e3-a8ac-428e-86a6-2dcdf7f95500", "comment": "Malware payload", "value": "33de0a5710044af5e04404bb6509a133", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931997, "uuid": "56c9dabe-0ef0-496e-890a-ea1ca6754c9f", "comment": "Malware payload", "value": "618ddee2774ede5aafa78414a210ad4003a3cc6520c0f75df9ac4ba836bdd338", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931997, "uuid": "126abbca-8434-4108-84dd-329220d67afa", "comment": "Malware payload", "value": "c4c1683cad26e026a25a838b1eba8cbdb1d2c616", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931997, "uuid": "87e227e1-a331-43be-b3b1-13913e4b233a", "comment": "Malware payload", "value": "2d328b5c4dbfc4f3f4defb8ae9346271c48431058eb6ca911f446506f34c35712ef6b7685cac9fb1198a339caceb8cb3", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931997, "uuid": "92d969c2-91e9-4d22-9085-1e1a5c3150b4", "value": "T1061309B30213BDDF16260E52E40C3115EC58ECB772D999ACFA4888F58BE5118DDB8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931997, "uuid": "2618841e-5633-425b-b802-95b4be01d879", "value": "768:3qRhh+KYNfV++m8Y4e6um9f2kfgnt/XpXc3CtO:3Ag3fU+m8Y4e619+kfgt/XK3kO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931997, "uuid": "a8f74670-5334-440e-b798-16e09f04e478", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931997, "uuid": "f87a2e72-e343-42a3-a957-52d0fb4f1443", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931997, "uuid": "00685316-8e36-4dcc-b6aa-6f79d0e890fa", "value": "gord08.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b428c202-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644953416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953416, "uuid": "60d47d5d-6099-41a0-b90b-ab1e079e07fe", "comment": "Malware payload (RedLineStealer)", "value": "d2b70e81fcaa5770ceacd4e708760d95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953416, "uuid": "5796e45a-98b7-4d3d-aad2-f01193a0da1d", "comment": "Malware payload (RedLineStealer)", "value": "61e2c6c378e1a2732efb70d5df248936b38ec60d7f98527525a428f978270501", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953416, "uuid": "b5d587c7-bb1a-494d-af91-4918d7618ba2", "comment": "Malware payload (RedLineStealer)", "value": "07c8bbc92e5588b312ebc08ae1119abff7b8d7e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953416, "uuid": "f87c9b6e-9956-4365-8b1f-3c440b73f7ae", "comment": "Malware payload (RedLineStealer)", "value": "de08e35980c53ac2a71d2d4fec7107f9b1aeb2ee467a5202f20346d3252d4f5150b8b01da77a2a4f39a7c71096150b71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953416, "uuid": "7232f89d-915b-4673-bf0d-93f35991ffcc", "value": "T1F1A4BF40BBA0C03DE0B715F47876D3AD652E7EA19B2055CB62D22AEE16747E0DCB530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953416, "uuid": "8e20979f-d635-4370-bffa-320a49ff46a7", "value": "d157c0a5c61be6cf8862631968209884", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953416, "uuid": "a55398fa-0959-40f0-bcf4-6a451bc45f09", "value": "12288:ph5O8fm0L1BCwGxUwPK7Ffl8ErCxJFXJ5:7swvpBCwjwi7FN8Er8FXJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953416, "uuid": "7e0c2471-4319-4730-9dd4-ef35c317d0b2", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953416, "uuid": "3c926525-2398-4217-8366-62d532697f62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953416, "uuid": "999c73b9-096d-41f4-aa95-8afd741b1705", "value": "d2b70e81fcaa5770ceacd4e708760d95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ad3046-8e93-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644952325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952325, "uuid": "ae532c51-a7d4-4699-abca-246a08badba7", "comment": "Malware payload (SnakeKeylogger)", "value": "812e75de2e0ee9e241609c74d02a3128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952325, "uuid": "faadd0df-5a23-44ec-a78f-785c94d7856e", "comment": "Malware payload (SnakeKeylogger)", "value": "62a8b168aaf8dace944ab58603210100fdd3580b0fcb43043f1a2e3a4cdc0936", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952325, "uuid": "27680b9f-6059-48d6-bff5-4a1c7e09eb0d", "comment": "Malware payload (SnakeKeylogger)", "value": "42c8663da60125ce13b7e7395f76fa23fa925f4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952325, "uuid": "e0d52afb-a359-43f7-9287-76443b41677e", "comment": "Malware payload (SnakeKeylogger)", "value": "ef6a46fad1ee804807d401e21dc11a78506cee561d4300042eda4eaa021247ac4bd566c30f1776eec42aa5914996fb86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952325, "uuid": "1b076fdb-42dc-43aa-b4ce-b3e0ee1294f4", "value": "T1E4E4010077B77B85C0B607F985B5A2852B75765D1227E63DCDA230CC5C62BC08A7AA3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952325, "uuid": "f77f5169-56d5-4ab4-89b5-79a52a91ed17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952325, "uuid": "392043eb-c7cb-4817-9817-0821faf0e58e", "value": "12288:Yr5k+QZpLXpy7vjSFDLcUQQnvYXtUTH2GFmyXRMQQp9CBrWYn7aZlUKu:AaJBXo7rStLcUhlWGDBdqCQh3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952325, "uuid": "61fef4f9-a3f6-4a85-936b-1b1f361b0c3f", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952325, "uuid": "be0e811a-09d9-41c8-b333-cd1175863219", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952325, "uuid": "d3fc58a7-8854-4de2-96c2-c37134b971ef", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bef987-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644952996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952996, "uuid": "0918f8b4-f55e-4320-bda3-30129c1f5b77", "comment": "Malware payload (AgentTesla)", "value": "36dc394ac20e6af518a15c53e2a5f063", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952996, "uuid": "a0aadda8-d8c8-4d99-bdb6-2ef287124d1d", "comment": "Malware payload (AgentTesla)", "value": "64805aeee335c0ed44878a726937e7b1f2de00c11068a8f047dead2d55667845", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952996, "uuid": "0e05f9cc-258c-403e-bec4-4a18c4c1a150", "comment": "Malware payload (AgentTesla)", "value": "cfe679792add7a4e0d51504ad10d931d7573acf7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952996, "uuid": "87ffcfa1-6de3-4327-9ae5-7375369921d9", "comment": "Malware payload (AgentTesla)", "value": "64cca59318f1b122f8c6084c1a9c1ec1ffe7b4332d69ce1cd7e7a849922847924a8b550d645d5ecbe7e761cf393f5970", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952996, "uuid": "01ce5ce9-f17a-4928-8bf9-3dddd1a74915", "value": "T11D1412D93B334DBDD792DA371C145AF302B9EF6AB965841110803918C77B581FEBA32A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952996, "uuid": "003f8489-9293-40c1-afa7-86e6b40fad98", "value": "3072:d85XB+b2ls2pF7Pg7QooCusJ+UhVRaT7geDSNvLf7V/gXPrd+UKE6B/G:y+u67c2fJeDATGXPQbVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952996, "uuid": "a0f72d55-bcae-4061-8750-671a0e8b951f", "value": 191816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952996, "uuid": "3ce2552c-4457-49a3-9621-d96031b4006b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952996, "uuid": "be516bc4-0196-40e0-af57-611ab0f31e92", "value": "Purchase Order . 007877.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461f12aa-8e82-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644945071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945071, "uuid": "3ac50b51-f3a7-460c-b87a-9b47c0e7621f", "comment": "Malware payload (AgentTesla)", "value": "a1dc62f001fdf408cae12b91cc657c14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945071, "uuid": "1a573d1d-69fc-4086-853e-7abed7ba2a09", "comment": "Malware payload (AgentTesla)", "value": "654fefc066964a822be5d2d1fa2e9312219126eba31b5fed3c0d614126427662", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945071, "uuid": "7637d17a-33c4-40a6-8614-95875a28075b", "comment": "Malware payload (AgentTesla)", "value": "cdacf6dec22c7cb81816806abff9703298e9933e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945071, "uuid": "75322e98-e948-4929-8654-5dda9c668d78", "comment": "Malware payload (AgentTesla)", "value": "315c6bfc293394e9802b82a6adb5952077c516bb4e249a5eb9efbeb2f4b6ac8616df35fae1542d72d35b9c7be615694b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945071, "uuid": "69f01fea-5855-408b-9389-8009c8d1831e", "value": "T19BB4AF11CE55D443F3309CFC9576F754CB9AA5BA3F1AC9629AFB89FE52887912C02103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945071, "uuid": "606d54a9-2587-4717-a9bd-c7b038364d40", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945071, "uuid": "253bbb0d-7bce-44b0-92d2-3a23bc00cd0c", "value": "6144:Nw2So7OdFOjO72hA3FTsfiMKfQcT6VUiSob4qYBCKO2A11gd6tNaMA21aFGhn2iu:vW2hAdMKoc674qYBa11Pj1aGF0WG3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644945071, "uuid": "ca2c79bf-5883-41f1-acae-e20c6e06eb22", "value": 503914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644945071, "uuid": "2d77df63-826c-4ff7-b762-bf030927163d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945071, "uuid": "818385cb-a6c8-4bae-ab65-628e962ae14c", "value": "Purchase Order No. PO-109688.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3796f396-8e83-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644945476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945476, "uuid": "e3299f14-5570-434a-aaa6-a3c82da1f800", "comment": "Malware payload", "value": "5394b8179aa9142c6fc9959e04c3cc05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945476, "uuid": "76e3268a-c099-4929-a4bd-ac3104f171cb", "comment": "Malware payload", "value": "65a5b2c6d78bad71cc8995da57a727eade04c491dfd885d12f07c2ae7365c45b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945476, "uuid": "d855260e-0cf9-465b-bf22-49b1bfa83827", "comment": "Malware payload", "value": "2065a75fe2d75074a729075be087d5efa6a9bb15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945476, "uuid": "f3dd7a88-81bb-4602-a7d2-d16906081633", "comment": "Malware payload", "value": "6b18ee43de8f7cc514620634c35564fd846337a4df413891f98dff000a470d1299f1bf9954d2aed5a17dda1b1e415532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945476, "uuid": "f43c7cef-1f0e-4a21-ae45-e4298ce64985", "value": "T1DCC38D0131D2917FE4A5977154A88A9086AFFD222D798FDB674C203ECC356D01B3BFA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945476, "uuid": "b8772d64-ec4e-4967-8209-138c31358659", "value": "4d6e383159a39513e9161389910c7357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945476, "uuid": "933d7cf1-e44e-42c9-b399-5aa2e6732769", "value": "1536:krg1+KVQ8rIrQgdQqWzEEXficU+H0se/COAMMjpf3Dk6Z3r7DqFiPTG5c8YvsWjd:kUcvvAic0rIF3DkEPMJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644945476, "uuid": "923c913a-649c-4f8a-a61c-4c0eb2ee0b61", "value": 120320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644945476, "uuid": "a9b01d28-477b-4be4-8f46-5049fe928566", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945476, "uuid": "0ba06bef-721a-4f8a-b981-5abf0310bdd8", "value": "zvpjv.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8930f1-8e6b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644935339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935339, "uuid": "27f65cd1-6a71-4880-97ba-63af11bfa8c5", "comment": "Malware payload (AgentTesla)", "value": "cf45142dea4f119d58c01908adaeb67d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935339, "uuid": "811ca9aa-813a-4816-b6f0-cd9ce2a18be5", "comment": "Malware payload (AgentTesla)", "value": "65b50fc4bbef286894fc469aa071abdec8a5bb5baa018fc05eaded20467e7d14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935339, "uuid": "421ddeba-f172-4dda-b850-6716a8625bc4", "comment": "Malware payload (AgentTesla)", "value": "c5b6d9c3b857280d5f92fab6a8193f48968428d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935339, "uuid": "bf155c2d-efa0-441d-acc9-3574bffd8f9d", "comment": "Malware payload (AgentTesla)", "value": "52818b206a7476acb87cd610d91792e56d207e46c87eb64c1d322eeb7c872142894b20c0c8e83c2c5360c2b78c3de330", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935339, "uuid": "3f940d6a-700f-466d-85d7-ea9ffd88a81f", "value": "T117556DC4639B85E8F1FE7A3E50250F0605A8F09BDF547E2B1F905D4CC862B9E9CA3952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935339, "uuid": "031c19af-ed96-47f2-a44b-d497425db0d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935339, "uuid": "50b922a8-f1d0-4b15-ac3f-c39057320772", "value": "24576:vhnzEAtHG0DscM/l944m5o90jhq4Em4+lnkBpvOV2MzYjr1c:vKAtHd5MN6d5o9QhqZQnkBpvOVpzYjr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644935339, "uuid": "242b615c-951b-41b4-b686-a79c67592f40", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644935339, "uuid": "617571ab-4391-48b0-a9bd-4bbe3fa8e496", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935339, "uuid": "c0435c77-9d49-4d01-8216-794131d544ce", "value": "009273820220216.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abec0764-8e27-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644906158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644906158, "uuid": "fe61c8aa-0047-472e-8cf7-e65a681bd0f9", "comment": "Malware payload (AgentTesla)", "value": "10779a2fccf789499a03956e70e27673", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644906158, "uuid": "3224d9e4-c2be-4b7c-8389-359cd59302b2", "comment": "Malware payload (AgentTesla)", "value": "675117bdc9843dd5bafb4626a913554f07dbbb9e4879cf63887349baefdd8f70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644906158, "uuid": "ed62c93c-3cbf-4af3-9a8d-9d598f58825e", "comment": "Malware payload (AgentTesla)", "value": "c39904fa431433903644dddbea05a53cdc70d960", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644906158, "uuid": "fd295135-aa2f-41bf-bb58-f18d30ca3d7b", "comment": "Malware payload (AgentTesla)", "value": "e3d9798c20238ba813f45c581aec08eceb2666276828c9904526ff4a98c55498384e972085cb5a53943076b90643a149", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644906158, "uuid": "a6da970f-d787-4b18-815c-2739718a5f88", "value": "T163E49C2601F7C8B1CD6B86FEE921C58C6F64EA2FB042FEFA8441D4BDE06C6D04656563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644906158, "uuid": "f630e021-8f85-42a8-a80b-347804e9a2c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644906158, "uuid": "70cf0ae3-daad-44be-b119-e04cb7224379", "value": "6144:1GtsjasZHv4Zv18I3YNqFiiteqp262y2w8Sulbtdj64m+tOLKMA+c1NtLf:QYasV4cSYMFbeqpgy2w8SWd64fDmm5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644906158, "uuid": "a1ad9e01-eced-405e-8f4b-8ac5d35544f5", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644906158, "uuid": "9c45e83e-6d48-4ada-be47-259bc8d1c2ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644906158, "uuid": "eb30a119-2371-41a0-9289-189c7daf3cb0", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdb9925-8dfb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644887152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644887152, "uuid": "d3bca632-673e-4ab1-94c4-6288ae0d91c3", "comment": "Malware payload (Mirai)", "value": "af5648196864e382b901a255c3b114a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644887152, "uuid": "9f04e48e-2767-4b91-b057-f6adbeb0e8f7", "comment": "Malware payload (Mirai)", "value": "67d203aaa61f5277d3b60f7a65c61fe34d3be31e12db72c92512e7a4c8d359fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644887152, "uuid": "d9a291e5-2066-4426-8450-47a8cd21db65", "comment": "Malware payload (Mirai)", "value": "9fc0dab11e869a93588bb377466c4a0d90c53f63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644887152, "uuid": "33535e93-abd7-4d96-8b6f-23d356e2ac4d", "comment": "Malware payload (Mirai)", "value": "158e3561f398671a64581d4153b3425c90a19d36bca13eb143785a21ac6e63b01f1eb5e0df6b60ebc1da054e32e2a09c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644887152, "uuid": "9eaaf8da-210c-4a68-b884-758ae496963d", "value": "T1B373AE75E06D6EC0C2960679A5E88C3C1F13A185A77B0DF65AC24765204BEF8F806FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644887152, "uuid": "817c45f7-2566-40b8-8515-fe6789720da8", "value": "1536:O/qx1+v1Kxk/a1+ckhqNNh3FACwdriw9D/KFZRGnAjCJUuEH:OyxstKyysjQzACwVi6/KFZRGnAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644887152, "uuid": "a418c742-c3d4-4b35-a564-c9a2d4fbaae5", "value": 80396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644887152, "uuid": "d5b21dcc-3c17-4601-90d3-ad62a38b0758", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644887152, "uuid": "8ea8de0f-b5a6-468b-a101-73acd294260b", "value": "af5648196864e382b901a255c3b114a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9324fbe4-8ea2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644958944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958944, "uuid": "daa0b8f2-957b-49ff-bb59-a9863315eea1", "comment": "Malware payload", "value": "c82184576cb00127bae55fdf42200a5a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958944, "uuid": "40ba079c-407a-418b-97af-625f66ef4000", "comment": "Malware payload", "value": "6810f45a7cd68fe580381cdcee315fc808300e5cd69c56228c83781a9afd1480", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958944, "uuid": "674fa386-befe-4ad9-aacf-c595cf0e4837", "comment": "Malware payload", "value": "18445de2eb93134ff02bec29ca0a9a1ee7732ede", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958944, "uuid": "f3ed003d-782e-4269-ba3c-ff12f4b8dd54", "comment": "Malware payload", "value": "6396ddbcb905e18825bc6eca7695dafe0f179748a86b62804683412ab7db5eaf8b523dd53343665ea6767441f03a020f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958944, "uuid": "d63413e2-4660-439e-9e59-523237343fde", "value": "T1F7B25B46D682D8BAF91711BA257B53239B71E8696014EBC1E32DE133FC92610972B7CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958944, "uuid": "efc0c1b3-7d47-47af-816c-da74af39f0bc", "value": "768:0PP6I/X/3Xy+sZRbhAlmpUkB8NfVpXIU:46I/vn7mqguk2TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644958944, "uuid": "10d0159a-f597-4661-bc4b-1dbb15ad2386", "value": 25648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644958944, "uuid": "3669a750-f658-4004-8393-44b45481e2cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958944, "uuid": "f65823c8-d4b0-4f3f-a8bd-fbcea1f96a57", "value": "beamer.x86-20220215-2102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43385869-8e04-11ec-9275-42010a9c0029", "comment": "Malware payload (QNodeService)", "timestamp": 1644890950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890950, "uuid": "d6628c23-fb3b-4a36-8730-b35a92451ae5", "comment": "Malware payload (QNodeService)", "value": "ebbf5985ff9a0cfc176c2d5dbf6d1d6e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890950, "uuid": "78a85ab5-17ee-4f49-a1af-0564f52efacf", "comment": "Malware payload (QNodeService)", "value": "68ad2876c96e3e643a83868b669494cb7262bdc0eb3835036e51fa3dbdb40e4f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890950, "uuid": "5b13431e-a19f-41fd-853a-ce07ca2a5ade", "comment": "Malware payload (QNodeService)", "value": "5947e7ae978e5686dbc72c50d7ef90467d71b80c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890950, "uuid": "7506f6ff-efda-43d1-bf1e-42b0710942fd", "comment": "Malware payload (QNodeService)", "value": "042006a4cb8fb0ef5db8b04c668f9c7031198e1bd654ac2415db3ec4e54212adbf6ddc77fe3c48e2ecf351d44b6cf4cc", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "QNodeService", "colour": "#47618C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890950, "uuid": "c578bc59-225b-496d-8434-b3ae69ed8a12", "value": "T127740217FA5DC63CEE1345705190E11BAD389DBD831A360774F6889D2EE4A0E2F26F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890950, "uuid": "17facfe1-a33b-45ea-8c23-f046e9211b8a", "value": "6144:ng/9qy7X9F6yqA7hcOTVfnvNW2E7PHAefVzMba+ESwbEneVZX:g/t7X8yCOT9NOPHAm9MGS0EeVZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644890950, "uuid": "567c0b6b-1796-46b4-9d2c-49aed53ba16c", "value": 369297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644890950, "uuid": "4b51654c-d07a-4879-aad4-1b4258099749", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890950, "uuid": "879800d7-7d7a-4a88-9035-5f798ef39374", "value": "Incoming_voicemail_wav.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e23ce3-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644953048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953048, "uuid": "f5f8b158-1139-42f1-b468-c3cce2be110a", "comment": "Malware payload (Loki)", "value": "320d1c692b97f5c3b719e51987550863", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953048, "uuid": "fb226f80-a818-4b61-bf31-0c3270edadf1", "comment": "Malware payload (Loki)", "value": "692b0061136ca6480ac14d9bf73919aa95fc3485430f57c6b15d7d8f345adb04", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953048, "uuid": "b9f94368-03c1-4d87-a9b5-74ad2276cfa4", "comment": "Malware payload (Loki)", "value": "7190cce3393a49133e5a924db0a6ffcfc6deb598", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953048, "uuid": "a17440ac-516f-46c5-87e7-d19c2da9f485", "comment": "Malware payload (Loki)", "value": "7cf5b397d735948ea93929a43255e4405a30360c95a6a9e8ca9cc7f84e79d8df8a43097df1775759f55113626a8d9341", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953048, "uuid": "2333afae-4a8d-4c22-ba21-7046257f7f85", "value": "T190141220B7A50E05F1ABA3F5622BDCB7DB569CC8075C6D8D22F2B5187434D4AEC062D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953048, "uuid": "d962b78c-7c79-4892-87c9-55a003767c32", "value": "3072:rxP/MxT7UIrtsjXevEqocqjcaaFnGx6ivUraeBFvcK2P98B/fdPwVd6JW5P:J/4cstZEqoccPaFK+aeBFvk98Bnd4xP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953048, "uuid": "94535277-97f0-4427-a5dd-c5d7480a134b", "value": 192136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953048, "uuid": "df4c60e4-6d04-4f89-9b1c-a3e082eab57c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953048, "uuid": "5b57bab9-d110-426d-a37d-7d589e4ea4f0", "value": "Purchase Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9224ea42-8e3d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644915563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915563, "uuid": "57938754-1e50-4cc8-b240-71855213101c", "comment": "Malware payload", "value": "7cdf50ee4f3d0febc70dd36298ed07da", "object_relation": "md5", "Tag": [ { "name": "evilnominatuscrypto", "colour": "#8ABDBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915563, "uuid": "7ecd171a-e823-4492-a0aa-052781d8d6c2", "comment": "Malware payload", "value": "69811a6c9376b219b335a055cfa970d38cd768abeca7138a2c1905560d468fef", "object_relation": "sha256", "Tag": [ { "name": "evilnominatuscrypto", "colour": "#8ABDBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915563, "uuid": "4584f850-cdc2-4788-999f-50a27773bc87", "comment": "Malware payload", "value": "0170c2deae4486a43894c202ea92d43556218e1c", "object_relation": "sha1", "Tag": [ { "name": "evilnominatuscrypto", "colour": "#8ABDBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915563, "uuid": "50f5303a-587e-4e63-9c2e-a8d05e9e7c6c", "comment": "Malware payload", "value": "380d9b30e95ce0394de1f0bc82acd484b211639e52e97501e439c72c3fb4d246dbf897d6c59c5966fab4c1ab0ce88f83", "object_relation": "sha3-384", "Tag": [ { "name": "evilnominatuscrypto", "colour": "#8ABDBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "screenlocker", "colour": "#9A56D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915563, "uuid": "dfed5507-54c2-49b4-85ae-4c487825a406", "value": "T1E1E207143BF8DB1AE2FF57BA99B252001771F587A825E70E0684109E1E7279089A2F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915563, "uuid": "c1f539fa-3535-4f29-8645-a7a52cdf1732", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915563, "uuid": "eabb34a6-c9e9-4d80-8f19-d7ea1e61306f", "value": "384:AjdXpgpMf76oJgkB4nokwFwA4Ep/0VUx/Nx9DPxmB++6iCjGnLBs0Rr:adZgpCOagkBRp/0ut9Y++6iCjs2wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644915563, "uuid": "a7815375-b8f8-4d18-afc3-5519b5dfc379", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644915563, "uuid": "f012843b-f3eb-46fe-8b8f-56a3d8e36bfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915563, "uuid": "df9b6726-10c2-43f0-887b-81c7b87516ef", "value": "evilnominatuscrypto", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2065e2af-8e3a-11ec-9275-42010a9c0029", "comment": "Malware payload (LockDown)", "timestamp": 1644914084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914084, "uuid": "60e8f884-f867-45a7-9357-eb4122f536d5", "comment": "Malware payload (LockDown)", "value": "77b7e9ffa41774dd3b2947628ee4a6e1", "object_relation": "md5", "Tag": [ { "name": "cantopen", "colour": "#6380F0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockDown", "colour": "#EF4948", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914084, "uuid": "04818fc2-6e23-4230-a1c6-058cfd3832b5", "comment": "Malware payload (LockDown)", "value": "6b2eef51eb8d2da78055f70b99a85766ba6731a99a5c1b90eaaa80a47ca42702", "object_relation": "sha256", "Tag": [ { "name": "cantopen", "colour": "#6380F0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockDown", "colour": "#EF4948", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914084, "uuid": "d7622415-2220-458b-b89b-152815ca3870", "comment": "Malware payload (LockDown)", "value": "80cd3cda8a7794050d73a8c00e388b3ac27c2493", "object_relation": "sha1", "Tag": [ { "name": "cantopen", "colour": "#6380F0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockDown", "colour": "#EF4948", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914084, "uuid": "637ceee4-101a-474c-a009-ac232293de59", "comment": "Malware payload (LockDown)", "value": "a7f8e58799055779ce354d97d0402f4f53a01824ff3f50a4297526f7c170ecdff5a41ad5d85823861a6bee7a62c6ab2c", "object_relation": "sha3-384", "Tag": [ { "name": "cantopen", "colour": "#6380F0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LockDown", "colour": "#EF4948", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914084, "uuid": "c3fcce6a-d504-4d3e-80bb-12e9d8aa7378", "value": "T159C295A8A2F54315F2B52F7DD87B6340867ABED3FA77930B4086E04B0E637129950F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914084, "uuid": "eb05e8c9-50f3-402a-a338-6a6db0bac379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914084, "uuid": "1a0d544b-e98a-4194-873f-f7e1e0166421", "value": "384:vJg/8iatWZg7+LuMKJNakkTiHG8eZXVb0zZyre2ajBW4Tv:xgUiYDFyVb0I0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644914084, "uuid": "8595ac9d-c7e8-41fd-9190-7ffceb0bbbc5", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644914084, "uuid": "73a504b6-8575-4895-88b4-b406cb17afa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914084, "uuid": "85eed890-589c-485d-96c1-3defb3d15af5", "value": "6b2eef51eb8d2da78055f70b99a85766ba6731a99a5c1b90eaaa80a47ca42702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee56985f-8ea1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644958668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958668, "uuid": "903da3ec-a050-4117-9c61-88608f5056d7", "comment": "Malware payload", "value": "73ab727d65a56573c3aa9c25f5d99286", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958668, "uuid": "2bef2ce9-d76a-41c8-ab7d-d593d8f9bcf2", "comment": "Malware payload", "value": "6bdb733cb3f2afe0506cd8959953fd4ade7efaf636e211f99fd6c6aea06e3bdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958668, "uuid": "46b04aec-dd63-4f9f-8044-a70e21198da2", "comment": "Malware payload", "value": "fb70173b28263a23852622c056cbd8bdb61a06db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958668, "uuid": "766cb7a9-d9c0-4ca6-99f6-59048d65be0a", "comment": "Malware payload", "value": "fad02323feed6e88ee44e7c102013835b395a3f12231f899cd71a67a898ff934ae427e6ea188ed648cba12cab75652f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958668, "uuid": "8ed3746e-3427-4948-9bbb-e47c928172b1", "value": "T1FD840292AE5F4602C928433A9FB3A70497F1A9AA9CD3C31F552760B44D7FB593D812CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958668, "uuid": "5107797e-f9a1-480c-a297-a8ee27335017", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958668, "uuid": "279dcd32-8d96-4fc7-bbca-1a70c6b2cb8f", "value": "6144:ffiLBpUSPznChSw5KOxijo2uq+hBs12wef7d0wc050j2qTT9T4gIxs0ZSDzmX0ZA:HsBpbuo+T47uFhK1Jef7d0wc06j1p4gQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644958668, "uuid": "ef5f6852-4c50-4a51-a634-54192de5b2a8", "value": 375296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644958668, "uuid": "64230cf5-5b0d-4449-97b6-c388fe0dfc40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958668, "uuid": "10279be6-34e5-4445-bfe0-b0d09c17bdd6", "value": "73ab727d65a56573c3aa9c25f5d99286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b66ebf7-8e93-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644952328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952328, "uuid": "2321cefd-fba0-4e8a-a4d0-abd90aac4d80", "comment": "Malware payload (SnakeKeylogger)", "value": "151153c86b2fe2ad96721ddbbfb72a28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952328, "uuid": "b12ae82e-98fe-4901-81f9-e6d8bb65e1fa", "comment": "Malware payload (SnakeKeylogger)", "value": "6d3a1d43e4c36fdf610098923d4e5abccffa0b69abef0973694cedc052527dc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952328, "uuid": "ae86cc83-6dd8-4c5e-a877-513fd753431f", "comment": "Malware payload (SnakeKeylogger)", "value": "584e7d7b4c4e3305e4e5757967746f2739ccee4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952328, "uuid": "ca5128f4-38c9-4490-b130-726b88120f53", "comment": "Malware payload (SnakeKeylogger)", "value": "473433c6a46e4fb199af776fb411036a1b5026744cacdedabc3d1f7f459183451c05f12a32065d41cbe6c161025269bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952328, "uuid": "40c27098-1ffe-44be-82b2-db9893e29794", "value": "T1B3E40128B337BB8BC57432F4886362C557F496A81526DBFB4CD231C991C2BC656B207B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952328, "uuid": "0328ceb6-5742-4924-a570-d8862917e282", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952328, "uuid": "009d4da4-f198-4d97-a119-05584c5df402", "value": "12288:G3dDoMCygzGMUw5uyCtEplwRN1QAw01j5ZS2GjJKS/zaD5k+:5fLewktRNqAr1vGjJKQaDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952328, "uuid": "758a385f-0bf1-435c-b5ab-4d9645e677b7", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952328, "uuid": "7bca5bce-b1b5-4f8c-bb44-706f65d8e068", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952328, "uuid": "4addf628-455e-40f2-be07-eee1d9a1d3c7", "value": "Payment Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ff8885-8e3d-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644915325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915325, "uuid": "433b31d7-6c74-4476-b43f-2d4ab36b553f", "comment": "Malware payload (Loki)", "value": "f134c6ee4d249165b09eea300f2d8229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915325, "uuid": "4881fe8a-dc82-4d91-bdfb-067b4dc426f7", "comment": "Malware payload (Loki)", "value": "6dd1c29a05cc6e24d9b0cad1cf09b31f71119a890fbcede2319a88764fe0bf5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915325, "uuid": "38a3ceb1-6128-4b4b-99e1-f39d0bdec9ee", "comment": "Malware payload (Loki)", "value": "1aaf167edf833110697dee29a39430c2813d0e0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915325, "uuid": "a5e0f36f-e7bb-4563-8ad4-58d4294267cb", "comment": "Malware payload (Loki)", "value": "a2bac865ed73f7615873351c5ddc82ed811a5f35273c572319c8273646b287dd7708392bacf913c8ab8f269122383a43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915325, "uuid": "8f73ce0b-c904-4277-9656-b1dc2754adeb", "value": "T11354230A66C29127D2270E3359367BAFFB71E71151B00A4F4B25DFDBA91E0C78E09867", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915325, "uuid": "09bd1b1b-d5c2-4980-88e7-69c378914aaf", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915325, "uuid": "765ea603-b05a-4f3a-8be8-bd8fd8c4ef39", "value": "6144:ow6UnCjWosB2nQXofZVhcNbGwMaLiT7bG1QNP8Ix4Q:uSCjWNInOunYP3aqgUIKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644915325, "uuid": "1a39221a-dabb-4a33-a453-daf59d46cd30", "value": 288932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644915325, "uuid": "4f12e131-1745-4a75-9432-f61ab20a1760", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915325, "uuid": "70d8164f-386e-4b7c-b2bc-653134efd418", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff09eb17-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644953112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953112, "uuid": "06a4ecce-1b08-4753-b3c7-841f7703f2f6", "comment": "Malware payload", "value": "1c5d120486cd99115d448527c617b35d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953112, "uuid": "7feb1046-e8be-45dc-8f0d-0388f126ef11", "comment": "Malware payload", "value": "6e4facd4e259c72e5c306195e00aca4642079dfb07334d302efdbbaeb6b140f4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953112, "uuid": "78bcdefe-f0d2-44ee-9afc-7e9c5e400b49", "comment": "Malware payload", "value": "f7ef721e0820447f3c224af2a94821d30d4445fc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953112, "uuid": "8e46c4cf-2200-4a04-9ff2-cea5e0d98830", "comment": "Malware payload", "value": "76a21ed433384093dba921f47654436ac2b98b8d9a7e1875c5a603980630c218f766a9e7510a96945451bcf66b1a133b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953112, "uuid": "409b5b2f-74d7-4ffa-92d3-81e95926c368", "value": "T17694E091C5C458EAE84A0B759C73FC751267BD2CA9B06D2E2E1E34365BB32D21433A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953112, "uuid": "3292a7d1-68a0-4896-9bed-4163157ef666", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953112, "uuid": "ed6c41df-ff4a-4902-9145-616f5fe39224", "value": "12288:BuSPEwtQoJFtmMcBWOtsznIzkiNAeI7oPC:USPio+WOEIzDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953112, "uuid": "16c7df06-2078-4425-a1e4-1961aa16ac66", "value": 447818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953112, "uuid": "3052c26b-8f16-4e9a-90c3-b3d6f3a60644", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953112, "uuid": "0843ef40-143c-4766-9f99-e2e2f8aff930", "value": "INV-DHL202038.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9df6a89-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644931978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931978, "uuid": "df11dd42-df22-4224-b97b-9c057105b84c", "comment": "Malware payload", "value": "dd1914a962e46c1264f118f6e915cd64", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931978, "uuid": "66a26078-0981-4466-8a04-18a8c3813097", "comment": "Malware payload", "value": "6e6795eca22840f6ecf4c4e2724d370dfa84647aa552054c0066abb21f7a0b05", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931978, "uuid": "aa249569-206e-4e4e-a123-f7852a6746e1", "comment": "Malware payload", "value": "b9cb505dfe9ba8ebcef399accff1e7b95ac3f487", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931978, "uuid": "03c8a399-0849-4d59-81fc-2191055adf24", "comment": "Malware payload", "value": "a2a3aca821e7bf200a12a00cd3495c8ebe24449e9d7ea3c0cce31b769c90c17f691a54113488694ac0a32b914bd2553e", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931978, "uuid": "a640ef25-bfd9-46b5-bca1-327e7f5d3382", "value": "T1D6130AB30513BD8F17270E46D50C2151DC59E8A762D89DECBF8898F58BE41289EB8EB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931978, "uuid": "d25ae971-796a-4771-8db9-6b236ed82023", "value": "768:9rLt7hCt4KaeqDA0qj3fUajz1wx2BwAmeu2kfgnt/XpXc3z:9N7s4KxqDAd8ajZwaw/ehkfgt/XK3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931978, "uuid": "8e462348-25b5-404b-aa60-606a69596e26", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931978, "uuid": "9c745046-3de8-421f-9bf8-51395f744033", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931978, "uuid": "1588dd35-6ee2-4b02-865f-a18860a4946e", "value": "dom27-01-2022.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a1a173-8e01-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1644889819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889819, "uuid": "9fe6a99c-f3cc-47cd-bee2-a04d6bd0d0be", "comment": "Malware payload (AsyncRAT)", "value": "0646eb5af12fc30efc3ead27a3d4e49c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889819, "uuid": "fff04496-4785-4046-82e4-253c608dcef7", "comment": "Malware payload (AsyncRAT)", "value": "712d471fc66e6d0b3935f9781c4b34f042aed8d675d2f322efb80a136c08ed9f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889819, "uuid": "fb7d036b-996f-43e7-8368-9220cda8f5fb", "comment": "Malware payload (AsyncRAT)", "value": "ade3d41e256f797ebcfc02e0fa14573255c42e7c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889819, "uuid": "19640fca-9fc1-415a-ad6e-9ebb3ee5397e", "comment": "Malware payload (AsyncRAT)", "value": "a480e66c8a2840130f784fda74846b8cdf339c61e677517d641323513d2752b62617e46858838047d5ce1b06664ed6b2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889819, "uuid": "918f6e39-3af5-40f0-9653-ec04537a09ea", "value": "T190E4012AB66BBA38C46426B641FF913907F1AA0C0573DE7BBCF6778C0D022524D745B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889819, "uuid": "72d99f18-474a-4a5d-816f-1c36853c8869", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889819, "uuid": "47717e3c-865d-4226-ad53-ed7a82192c77", "value": "12288:I6MRXZYNkfeIswmLdYCubbwuHFRt9jVHpChvnE44YgTlX0:I6MHfWwmkHFFRHwEJ5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644889819, "uuid": "a398f0d8-e426-4ebd-b518-48b1c3ad7465", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644889819, "uuid": "f8dead3b-b7eb-41d5-8cdf-48908e0212c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889819, "uuid": "f228d24f-af27-4d2d-a476-fbc72d15dfd8", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb542bd-8df6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884843, "uuid": "b150a2c8-ebd0-4254-8f9e-27d2f3915325", "comment": "Malware payload (Mirai)", "value": "292825b2e6d88377e8ae94433c1fa07c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884843, "uuid": "629dde82-fc75-4d17-bc35-9a7dd54c30ea", "comment": "Malware payload (Mirai)", "value": "716c9611428f5f3ad7e2e692c42a86188e871f1b3af4ceda774206172f49311e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884843, "uuid": "f8ea08e0-13c6-4356-900c-bdba67ed662c", "comment": "Malware payload (Mirai)", "value": "decf9ccda67cfe39de838143693a34f2f37431c8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884843, "uuid": "07537572-c46a-4aa2-8328-499764d772d7", "comment": "Malware payload (Mirai)", "value": "7127f10cace6d5c3ee508903473c023ff0ac74e64df7a276c1e9f31faf06b72c520575b62f9e078b9176eb5463bebf81", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884843, "uuid": "f759e1d8-5c01-48c6-b6ca-4b278a08b320", "value": "T1A4831895FCC29A5AC6E0237EF5AE559E331073E8C2DB7117CD200B547ACA81F1E63A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884843, "uuid": "abe8419b-f7b1-4d7c-add2-d47386077325", "value": "1536:dL9uU3ig/2SmttonzfhDaTscLkB+9wBmWyiBVD1pSyKtOWpQEHqkkkkkkkkkkkkX:t9dig/2Smty5uGpJKBokkkkkkkkkkkkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884843, "uuid": "b2aad4ac-dee8-4b0b-ae3a-e81c598adde2", "value": 83184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884843, "uuid": "c007a884-e1d8-4c31-8c93-f77a121e2716", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884843, "uuid": "66651891-57ac-40d8-8054-0e758553df80", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5940f0ca-8e7b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644942097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942097, "uuid": "00257022-7198-4127-a71c-555bff877d37", "comment": "Malware payload", "value": "748b399827d2161c238d5ca1093ba315", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942097, "uuid": "0705aecd-8686-4c59-897b-4e150512e915", "comment": "Malware payload", "value": "72432ed9dc08002f4e1d8868c872dbba775c744b5eb6f6a17b41e584daae8a2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942097, "uuid": "9c4becfb-50a5-4c58-9f68-aa64ec88f18b", "comment": "Malware payload", "value": "61c317155ebb1ec64e03379ef3523e0b53ad9478", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942097, "uuid": "cb4be756-6ab0-4cd8-9232-405e82ba93f5", "comment": "Malware payload", "value": "94fb854313f9cb89e541c5b86b4f6609ff5263ee1666a06a63d0909a9a506a167af8345b4fef3f8b4f5738ee4a0640a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942097, "uuid": "940c5e7a-8c40-4293-b151-ec859616e29e", "value": "T14362F7947BD8CA79E9661B355C23AA8806B4BF04DD03962B38C9B70F7C727401A62B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942097, "uuid": "517ee3f2-bb79-441e-9807-a00de559b271", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942097, "uuid": "f44c13db-401c-444f-9dc3-99bc597c05cc", "value": "192:u9PIwUQ6PgwJUnacXYOTK+qMVkKhdhR0VHbJeZxF:OnUj/2nacHTKnMVxhRO7JeZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644942097, "uuid": "0ea5419c-7e92-4165-b59f-886d11a780a4", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644942097, "uuid": "592fa6cb-5b80-4e85-af84-24ff0b845281", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942097, "uuid": "1635b4f1-1b03-4799-99e5-2cf8c1b8714c", "value": "748b399827d2161c238d5ca1093ba315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bafea3-8e04-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644890900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890900, "uuid": "1c223652-5ac8-4241-a3ea-24fa985492db", "comment": "Malware payload", "value": "ac7caea248d93b6f3c7522c20ad14e88", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890900, "uuid": "3e2c855b-0edc-4ec1-875e-dcbfa99e1d11", "comment": "Malware payload", "value": "74987f2fa3f067399bfff9836a5b73c0433e4e0bdf6abbc68db3166bbda4b8ed", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890900, "uuid": "57240d18-e39b-42c6-ae56-23ae55d5346f", "comment": "Malware payload", "value": "d842857da2d42e8262ea6aacce419893b05f7aed", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890900, "uuid": "27d5d146-ebb5-4998-9bab-9b247833a2d6", "comment": "Malware payload", "value": "684857add6b98459da76314ea7a6d3221f0ed67d39fcbc09f802d4a206cd68cf9ddfbef579cce14524c106618c7c04ef", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890900, "uuid": "ac1dfe99-9397-4db8-89c5-f76359fb24ba", "value": "T102E56C27B284653EC06B19364937B7D8993BBAB2661E8C5B0BF54C8C8F355403B3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890900, "uuid": "da0e4eb0-a982-4c22-905c-3bd92120fcff", "value": "49152:+Ej1WXxrRvfRXsNfMSJGDGXt7phEBN3TjcZ9OY+EA:SBrVfBsrt74BxgOYJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644890900, "uuid": "14aacf80-bd52-49d3-b242-874f74fc2fa1", "value": 3111936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644890900, "uuid": "6a313d4e-be93-435e-8e49-e9df185e8b8b", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890900, "uuid": "c10724e8-476e-484d-8b37-e80d5735771a", "value": "ArchivFact.EndesID1502.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f629e4-8e98-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644954620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954620, "uuid": "02fa5ad9-d45b-46cb-b832-859f5b7487ba", "comment": "Malware payload", "value": "65950a9c8df8b41ae77d2e29e127adff", "object_relation": "md5", "Tag": [ { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954620, "uuid": "bf4821a2-3d4d-4af8-bb5e-55755d7b2eda", "comment": "Malware payload", "value": "74bd30c5bc1a2bf4b25af41c44693d582e6a7c26a8cdd0a99b7eb2751cde120c", "object_relation": "sha256", "Tag": [ { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954620, "uuid": "f5a6e881-ee20-45f2-81f5-6556a447217a", "comment": "Malware payload", "value": "e2d9585902ed41e3e15c2c0d4fadb6988eb57f4e", "object_relation": "sha1", "Tag": [ { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954620, "uuid": "ad3043f7-d7c9-4643-8b49-a329fc28a89f", "comment": "Malware payload", "value": "90b259d8854a1889852e6c3767cbd0295ae0e2aafdcf72b58da2a41bef1a55f7459a97a0ab52aca37d49841195c441d7", "object_relation": "sha3-384", "Tag": [ { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954620, "uuid": "e896f049-c9de-44e8-b36c-a505e7b576f6", "value": "T1A724132C5B029920F512BEF6B4AA895700F517E26C477B35E2BF104280795946FFEEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954620, "uuid": "594b93f0-48d1-4ef2-b86a-b04cc982c593", "value": "3072:ABAp0jyL+umAddBccBYdwzLjyR+Ql9PIHAeZgU5O6//lBsEmAQ8soHfz3HYYB9GR:Afulh9bYYiRdl0b/lBLx1HjHf+PjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644954620, "uuid": "0029135a-263a-45ba-97ce-f20e0d99c92e", "value": 213396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644954620, "uuid": "4b248c5c-90a0-41e1-b967-2dd37fe1df34", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954620, "uuid": "8ba6af4c-dabe-4c51-a688-9ec0a3624b4e", "value": "xaedeetsm-tpu-rteieaa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a898fe4-8e56-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644926100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926100, "uuid": "4af89575-8a2e-4eca-8c42-87873c18cca5", "comment": "Malware payload (Loki)", "value": "ef109cfd5840406965db382ea6012820", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926100, "uuid": "04122ce5-3b8e-4e2b-9ecf-294cad459207", "comment": "Malware payload (Loki)", "value": "75093d27159323b105c74e7f5db19fc54a7f528fe6cb384b41ce4056d221e555", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926100, "uuid": "d554a373-1637-401d-8199-15ead8449fe9", "comment": "Malware payload (Loki)", "value": "9dc1dac994054bed4f59e8bc96565fa07df0d3b4", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926100, "uuid": "d2915d66-f6b4-47e5-b700-534be5d41851", "comment": "Malware payload (Loki)", "value": "d3bc8cd8798712fbc41a91b21b9d6ea51c2a885864f4289d3b5183bb01d97ef281781584b13778af533561e39ab2bc99", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926100, "uuid": "41284070-2f3e-442e-a1cb-a0525330970c", "value": "T18E1412617959562DFDE8AA3BF0538F049AB1FC07285C033BA40AB6EB757F2E85801335", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926100, "uuid": "22a42e65-2d60-4ca3-aed9-5c83847e4760", "value": "3072:FCcrNz12DOAXYivDDDDtJUeAgXwMxVE7OFYlky/pZwfw2zUIbgKyUpP:X5z12HvDhJnAg9/E7Oilk6UzUIbyWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644926100, "uuid": "82bb2fd6-f5cb-44fd-8365-0cd2023bd27c", "value": 191640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644926100, "uuid": "a178de1d-9e11-4469-a6a5-fcc91c658c3a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926100, "uuid": "18253522-78e4-4b92-a02b-2dd4fb9be3b7", "value": "RFQ_PIF Round 2.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d27fc3-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644953452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953452, "uuid": "3f2ad53e-365a-40fa-8bdc-796d3de58fbe", "comment": "Malware payload (Formbook)", "value": "a73ad78cdc6895796193a834ca297d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953452, "uuid": "7df5f578-1200-49e9-9a57-59c53c402c9a", "comment": "Malware payload (Formbook)", "value": "7535965340e3a37d74b7329bca8f67b82cfb299cef0c4419e8a04aa08f598d78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953452, "uuid": "1671ddb9-a9e8-4088-b818-641cbda69a2b", "comment": "Malware payload (Formbook)", "value": "ef8ac6ed50d41a35519073176d09b6be65d6b8fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953452, "uuid": "2e693f8d-73e5-4931-aa17-afd9dd5b319b", "comment": "Malware payload (Formbook)", "value": "219f63a7de6ede5cf35053299af3934cb208df122b545930259bdba10446b80b14ae26c518025a653672f2d6b3c619ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953452, "uuid": "d08118d5-424b-4978-a431-83bac66127bf", "value": "T11AA4E2D2F66EACDEED794CFB04F5A7C67C61AE1C0B0297D1A7653A99937A2123C0C005", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953452, "uuid": "edb5e1ea-d03b-4f4c-b8d7-709fce2b5169", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953452, "uuid": "d83d6e57-7203-43fb-81be-6c24e0e817ad", "value": "6144:fwrFaiaYtZJQT9CSfkbYi47Zckd1LjVE8bkxD+E/dMG97O:GFaiaYtYTQRYppe8b0tlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953452, "uuid": "b7f45819-96b6-4ab4-9d13-2c337bc6272e", "value": 466730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953452, "uuid": "8fc6614d-40f5-4957-ad7a-df3662ac805a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953452, "uuid": "dc58a79e-a4b7-40b8-9264-917ef7ceafce", "value": "a73ad78cdc6895796193a834ca297d61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e3e02e-8e57-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644926596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926596, "uuid": "57ee5140-cbbc-42e8-9cb9-beffd8cc92d6", "comment": "Malware payload (Formbook)", "value": "fbef4aa390e2a135af182db12bfd1efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926596, "uuid": "b1e957f1-9572-49bb-90aa-da4db5f2a540", "comment": "Malware payload (Formbook)", "value": "76381a94a940a4d2b7f4ecf9ab6e507eb1ab9dfb1deb27ef852b632ed069865e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926596, "uuid": "b73f7c3e-d53a-4fa1-85a0-21f77d8dcfa0", "comment": "Malware payload (Formbook)", "value": "312334c729a1a39d1089296e0b56be660084bc28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926596, "uuid": "9fc445bb-3fd9-4958-9a80-2639533aadbb", "comment": "Malware payload (Formbook)", "value": "8f3cf6d5525a1b94c89fbd589cbe7a80a35bf98058c39bcdbcde5727cbfe9af186fdaafb49e06292bfa9b63654de288a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926596, "uuid": "2357a773-4bb6-4724-a08e-7e951ca32cb5", "value": "T1955412AA77D0C8C2D0C30B303BFB5769E574A75470B96E876B7D1FF9322809A914B192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926596, "uuid": "16fcddac-5c66-4602-bc8d-209d727d4da6", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926596, "uuid": "e984e4c2-e25f-4f4c-a37a-0c7642dd34f0", "value": "6144:owKeIFGXuUkKPLCL53Xn4CSAfwUWVCB4vCrTMC8ze4:2nEXJPL4RmjITMC8C4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644926596, "uuid": "86803bc4-73b1-4895-bbb4-cd193de42b22", "value": 299917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644926596, "uuid": "79596fa4-efa6-43d4-8aab-0084f5f00777", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926596, "uuid": "daa3cdf7-b386-4fa9-8b7b-b483f7f8f9f9", "value": "mobifgdre44321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf639a0-8e97-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1644954367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954367, "uuid": "ceb7a980-d731-42df-adb6-eefd18d38479", "comment": "Malware payload (ArkeiStealer)", "value": "73d6177754cde9105ede509643943ba6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954367, "uuid": "47d25a13-5f5f-4537-8c8b-447a162a134f", "comment": "Malware payload (ArkeiStealer)", "value": "76b0e21eb14f634c137bd2e38462e55c70cdb71cd681463f0c24eb9208aab4df", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954367, "uuid": "57163495-b6a7-4486-bc2e-9cff3b1fce33", "comment": "Malware payload (ArkeiStealer)", "value": "e9f4ca45ca47420944b1edde88d4f8fa171e5971", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954367, "uuid": "fa5bcd2f-9bb2-4d23-a378-2df794f7c8f0", "comment": "Malware payload (ArkeiStealer)", "value": "4ee0a6e6e4323263676b48c966cf2d3f240917471d3058b1458746ab0969fe2f2c84aeeed14e07e8bbd89ed9f0e2abd1", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954367, "uuid": "1839be08-b309-4aca-a7ff-aea54456dc70", "value": "T18506334040F67D1DD6A8F0781BB7B5B9C08E50B6291BC0F7E179B18A42E4EDE8A25B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954367, "uuid": "847042b2-fdbc-46a8-baee-f6c19e29cbf1", "value": "18df1dcc1fa258b4d6e464d165239b75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954367, "uuid": "749ef89e-d1c6-40cc-8945-1f6c2579c90d", "value": "98304:Up36XhhfhmlnOE7co7xUXRXvzrCxIfvqXQvjj8P15p:UJaWUhXvzrUIfvqAPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644954367, "uuid": "05aef161-6d52-49e3-aa97-d3820af43dd8", "value": 3795472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644954367, "uuid": "88cfb437-f438-4d74-9c6c-354b0bdfba46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954367, "uuid": "e1012bef-7c96-4dfe-9b0e-72ac5ebaecbd", "value": "73d6177754cde9105ede509643943ba6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81cde017-8df2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644883324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883324, "uuid": "741388ad-0762-4e78-aba8-3e80bf7b8a43", "comment": "Malware payload", "value": "208ca5481472f75d9f59ab935897aa1f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883324, "uuid": "9692b154-45ad-4a68-8235-6d13e5ab695a", "comment": "Malware payload", "value": "777658826e0e1b12a61011c9882bafcb61425c06cc0ac12f1c76b5ff09d1ac0d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883324, "uuid": "5492bcb7-7f2d-46f1-aedd-5372b7873912", "comment": "Malware payload", "value": "631cd9e746d2b5f89085fdda6d3ef0ac977b4f94", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883324, "uuid": "8d517813-03bb-407a-a51b-6a033840354f", "comment": "Malware payload", "value": "d264a0f33d90d49dfda416b9c96c0e0c6c0f7e546d0f119cde239ab49e175e8a07ea248db0afb6a2545c3262152c4334", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883324, "uuid": "95a17f0d-784d-472c-b56a-b91eebebc7d7", "value": "T1BAA1E750112C1AB172466D7AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883324, "uuid": "6df04ef6-1917-4879-840a-47d6951e0408", "value": "96:8cRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:1RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644883324, "uuid": "736fe54d-fde1-41ce-ac70-d21d368d9ab7", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644883324, "uuid": "2bbf3622-0a18-4ccb-bf68-18c8a3f3cd81", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883324, "uuid": "ffddbf81-0ed5-446d-a707-1101cabb1e4a", "value": "777658826e0e1b12a61011c9882bafcb61425c06cc0ac12f1c76b5ff09d1ac0d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a2cfb0-8e69-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644934516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934516, "uuid": "32edd371-d6a2-4825-b765-e4812f9a650d", "comment": "Malware payload (Formbook)", "value": "7b38c49a7f0f5c2aeb2449e84a97c61d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934516, "uuid": "c8f8b9c1-1c3f-4508-86ea-e4e58d8637cb", "comment": "Malware payload (Formbook)", "value": "77d1a0cd83ad78dfe6bf44f82bbcd88c0b8232436a9fa42bfc954bd9f29314e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934516, "uuid": "8f1dc490-537b-47d2-aa20-8fec3a61beb5", "comment": "Malware payload (Formbook)", "value": "c155bfcd85216240f5d5736189d0f6ac43ec1cc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934516, "uuid": "e645081c-4bfd-4fdb-9ff1-e38d9879f343", "comment": "Malware payload (Formbook)", "value": "300989ccd4b43c7989619978943a7edf2a81e6aac0a2e8938dddf9f88d2f0f4ded685a2fb4831733fd71303bbd3ee119", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934516, "uuid": "cbae5f3c-c0ca-4762-b7e2-f317fa58f438", "value": "T12454132630DA9CE2E24B417325F3E5C7C3B2E2301A62895F7F761DFA55125839B1F186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934516, "uuid": "f9b39342-aae7-4614-8464-1c585b9dd87c", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934516, "uuid": "732af17b-9be9-4134-9bcd-46696a99fb43", "value": "6144:owlu5NppbLpTyvdfxvQRLcxaopvkSeBlC0kQXbS:k5NvbLknv86vkSioGLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644934516, "uuid": "2a953aa1-1b91-4b1b-8822-2313f45ba0ff", "value": 299901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644934516, "uuid": "d9ce49d1-fc96-4051-9ac4-9c04a7ec3ffa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934516, "uuid": "014a349c-ad15-46b6-a930-1a9921e74728", "value": "new-order-002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9243cd-8e6e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644936415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936415, "uuid": "c6bb817f-659e-4e11-980e-835f2910ef47", "comment": "Malware payload", "value": "ca75ac6cfe7f5766e0987cc7186a9738", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936415, "uuid": "a5096281-ad87-4c8c-910f-59d33e56f19d", "comment": "Malware payload", "value": "7894122a4fb30dcff08d7f8915645af06258aee51316956e858ebe439e355aa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936415, "uuid": "210d51c7-7ef5-44fe-811d-6075aeca8d90", "comment": "Malware payload", "value": "990603d45d5f7fcf666e27f0a6dc646d19921a6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936415, "uuid": "f0ddc2f7-8a09-4372-9e7b-1df62c714205", "comment": "Malware payload", "value": "8a2590178fa113d5aef3b4198608f3b8916f1a08e2387006e9ef89984078892b01108075426c9174cf54466d5bfc0ae9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936415, "uuid": "71ec39ff-1907-4048-baf4-793b10dd3cfa", "value": "T1D58533285B381771B086991475C2B3231BD938D40F167D199D0B7E87F4F9AE2EC936E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936415, "uuid": "68fe8785-8e37-40ad-91ee-b39bd1248e78", "value": "49152:4WRODb55sK6Rg0j9c3Zqhlgv9MYV31Oxwo6R1p:4Wg355SgG9c3kloOwo6R1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644936415, "uuid": "8764023c-c92e-4b3f-bc5f-1473e0427e42", "value": 1817344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644936415, "uuid": "a4a0e095-57f4-4d07-9de0-588717822ac5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936415, "uuid": "5768e1c2-ba6a-4038-b156-84dbf8993e63", "value": "test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63b5277-8e6e-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644936750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936750, "uuid": "eae13fa4-a462-4f22-a6da-4caf22c11063", "comment": "Malware payload (Quakbot)", "value": "5508b01862cd1f328f92f66656025b5f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936750, "uuid": "d62dc3c4-262a-456a-a964-8df8e9bb275e", "comment": "Malware payload (Quakbot)", "value": "790951787b259b98ea0f3b7face9c805643bd5e36b2d8a9d92d6d20a7107971b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936750, "uuid": "7bfe22d6-f5b5-4917-864c-8b40a84ba4ed", "comment": "Malware payload (Quakbot)", "value": "025e1efde052d4682db9af50eb09f6b8170028fa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936750, "uuid": "a281e69f-6a04-43b5-9863-3272b8e20933", "comment": "Malware payload (Quakbot)", "value": "0f4ebf36f6b71e508fb019189b3bb1578daf33b8d40a708aa60a875c36c031c88566bfe7f04573b01acbe59b91070cff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936750, "uuid": "15fa0306-ed20-4d52-912f-3c2f85205092", "value": "T1EB35C789E5902BCDF1D668BCA71D33BD9F560BF00A7E7072A103188A2AB02F59D75747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936750, "uuid": "6eecf088-d840-4e17-9e6d-48bf1431b20c", "value": "57a5c3ba39e99f3a950c01b9d5a944b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936750, "uuid": "6ad46ec1-62c7-47e1-a98a-654440f89c0f", "value": "24576:gHpQcqx/tkp5k3mzsscZs7ytsUR84q99fg+IgrZzTAZoE:gHpQcq1tK5k3mzsscZs7y2UR8r9fgrgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644936750, "uuid": "3d26b543-330c-48d5-8dbf-0e5fd007a4ae", "value": 1154511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644936750, "uuid": "fa977874-f9d3-4d5f-98ae-3b45e617701c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936750, "uuid": "e3aadb0a-b927-4f7c-b0fc-de42c2cb37c5", "value": "dxv1.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279cc861-8e82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644945020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945020, "uuid": "c80d886e-5d8e-4eb9-a294-b1d9f97da821", "comment": "Malware payload", "value": "4faceceaf1d7b32055d19330e199b155", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945020, "uuid": "ee721cd1-3aab-436e-abe6-82b4098b5cb9", "comment": "Malware payload", "value": "7979f1cc7f09d88d182069e0ca8b726772e18e81de69f2b48d7f3330e054b666", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945020, "uuid": "3c28093b-0ca5-419d-9a02-81b3fd81b354", "comment": "Malware payload", "value": "2c6aabe2e1c2411f5c906298fc0289134b7662b2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945020, "uuid": "9b690528-9935-4071-83e6-f51c16632741", "comment": "Malware payload", "value": "34f654a2edcfac70396b18d9cd34841fe859da02fd1a245d493c1f94963698314f9109eb51687843b31a24d6eef325d3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945020, "uuid": "3f33e72a-3e4c-40ec-8bf7-2eb4a8a0d742", "value": "T15DE026279A2C8DF71F892B1F3FA29CAF16534C1C8CBF63C58E06845C0A5C006D602833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945020, "uuid": "47403b21-a96e-422c-9f72-77f875906ce1", "value": "6:gern3ZLLWtngBBFt52p79SewBflqnBrZv:NJLZBBmMew/4jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644945020, "uuid": "ed832d9c-7585-4bef-898e-18ad2f58d9f6", "value": 362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644945020, "uuid": "07c10b09-8a09-4ba3-bc26-1def7d1781e1", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945020, "uuid": "bef821f5-42d2-4663-95f0-b22634bc7a8a", "value": "go", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6e6d38-8e62-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644931633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931633, "uuid": "a91a147c-1756-44be-b285-d971952396b1", "comment": "Malware payload", "value": "783e33793e24632dc37bd3d2204f98a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931633, "uuid": "31ef3c83-6aa8-4ce4-9bfe-df10d3fed61b", "comment": "Malware payload", "value": "798928e4d423f24b0f10f2fb8ebcb2c6794c0093a883bbba24c48dbf2b6bdbd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931633, "uuid": "e1ca92d3-e3c2-4a15-9394-b446d78bf45b", "comment": "Malware payload", "value": "2f68d9d1e6b71cd1a93ef11d116bd5a566a56082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931633, "uuid": "02d24bac-b2ba-4cd7-9cc3-0b7a39a5f8a8", "comment": "Malware payload", "value": "f94baa72cc4a1e36c5114e03a57d92721b43a8bdbbe8b4855244891db0987b380978bb1d3fc715de8af507c21af0446d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931633, "uuid": "2bc804ea-2c10-4e17-97f3-c5c7e775e28c", "value": "T15FC35EF4E774B919F010C97CF99982703AF8EF605F329542B469763A197E2AC3D620E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931633, "uuid": "6b1fd680-0137-4472-b897-1a396bbff784", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931633, "uuid": "a802427b-7ca8-486e-9b5f-843e7e2369f3", "value": "768:IvrIeN2oIGcezZ3maHiYMwN8Agw3nZPHbzYKL:IvrIeN2oIQ2NAVZDzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931633, "uuid": "caf4f546-6850-4a93-b79e-e9b42e900431", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931633, "uuid": "d2439bc1-a32a-485c-8189-6f522e673651", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931633, "uuid": "b5c6bbea-9db5-4191-a854-f416d52d9bcd", "value": "Payment Confirmation copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3388f3-8e6c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644935716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935716, "uuid": "5d8601de-9129-4068-8b29-3506626b2b45", "comment": "Malware payload (AgentTesla)", "value": "4ed8364e7643856f83cdee4f1d725564", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935716, "uuid": "bbf574e0-e889-4791-950d-ae2173efeeaa", "comment": "Malware payload (AgentTesla)", "value": "7994662f6a5faf9b197f7bb4029feb3687d797c0b5e5591fcd4e1ac98acd1641", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935716, "uuid": "c3cd9400-e885-4f49-889f-1e2abaee287a", "comment": "Malware payload (AgentTesla)", "value": "ad530403461d706fcdc769d37f3778ac5cab5325", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935716, "uuid": "334d1870-ada1-4b12-b0c7-dc1008a64b37", "comment": "Malware payload (AgentTesla)", "value": "349d191aaaf2ee2e726fbb8d76b8ec840d1847ee019c883a582a9231aa46a068c2b0375983037f83238dcf8bad702f41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935716, "uuid": "fcf0d0b9-71fd-4847-bc2d-356944f1992b", "value": "T1F8F402007BB37B40C4330BFE94A485845BB1BA6D5527E67ECA9364C91C537D08A7BA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935716, "uuid": "fd9e35e8-070a-456c-b49d-6e8d9be9a625", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935716, "uuid": "b6e1d01b-8659-4bdd-93ff-c7d6dd40891a", "value": "24576:aacfTRD9bfa3JqKXpJEeN0cxKI+imPPD2:7g92sKZJEeWcxKliUr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644935716, "uuid": "047f131b-535f-49bc-8ea2-51e3ddd82bae", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644935716, "uuid": "e82f8b92-8b69-4b67-ae00-958658dde062", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935716, "uuid": "5a947758-1a88-432b-a4e1-342bed37d7bd", "value": "document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654ea58e-8e43-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644918065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918065, "uuid": "a0bcd76a-92c1-4dee-b50c-9e6a120763b0", "comment": "Malware payload (Formbook)", "value": "fc5b0cd0cf0b98900b92a6568c61dff8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918065, "uuid": "b49a5b9b-41a7-47a3-88a2-1bb8318483df", "comment": "Malware payload (Formbook)", "value": "7b5242b8a4daf148898ab3941081522b3dded15bb649628dbb1b7a992d6186d0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918065, "uuid": "9a978245-0134-4209-882a-c114f0d2a62e", "comment": "Malware payload (Formbook)", "value": "ec5f6996712d2976c72f758d4e4f3b5c20710b37", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918065, "uuid": "9ef54077-9552-4c07-a562-0e62e36c6d58", "comment": "Malware payload (Formbook)", "value": "980680b36215ea094661efa791512d4e9a521817b9042548733f6acad258171f2b520cc3f935650879f0e1283d967106", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918065, "uuid": "40e2433a-df82-4744-874c-a32773fc3027", "value": "T13A5423903483A7FD03DC64897A9BBFD9ED37781B2BD8F3F0D1908576A962149224270A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918065, "uuid": "d5f75c76-afca-474f-9228-dc84a39e02bd", "value": "6144:s2E1QTGozOlRZjzy9gVqvTvo2klHuJoELI3mUPHetQB+Gda3M5+EdRBth:sN1CGHlRZVVqvjzklHuSELI3h5YNPEd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644918065, "uuid": "71a22848-8d8e-447a-9825-4148465342f9", "value": 287812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644918065, "uuid": "5e4c4e40-612f-4a1b-9812-64f680ef6765", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918065, "uuid": "5fc59a84-fe94-439e-8b6a-9dde18b80648", "value": "1644911291.Vfc11Ib6cc5aM921320.dynamene_G302_220214023_PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef20950-8e40-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1644917007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917007, "uuid": "7bd81fa7-1d3b-4805-bc7c-8975e0e4929f", "comment": "Malware payload (RemcosRAT)", "value": "a5ee867d538aba1c630822fefd28180c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917007, "uuid": "90bd0004-9818-4bac-a807-a01e30e6c310", "comment": "Malware payload (RemcosRAT)", "value": "7b5f70276fe64b0ec64ff186af6706b1dbbf2e2dc69e4b1546745b293121116f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917007, "uuid": "ebebd9f2-1c89-456a-b3f2-604e2a8f1379", "comment": "Malware payload (RemcosRAT)", "value": "009eb1d6bd85625c1988d0faf283c0c6f0b68b08", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917007, "uuid": "b241d19d-13c5-4a9d-9222-6693ff0e7f02", "comment": "Malware payload (RemcosRAT)", "value": "76e6ea163bc3d4750c4b737772e099b7e32edf6128f25b1b949b0b23e529351a800b8ef8b2146804bc5d5c552196a7e6", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917007, "uuid": "94eb40fd-ab5b-4c1d-9132-43f23b3e2074", "value": "T1A541408E3643E029C9124DE2EEEBC85EA9B252097979C4817B1C86C1087182CAFD89CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917007, "uuid": "69e840d5-7fd0-4f52-875d-1c79f691acdf", "value": "48:KWY60jvsxCoNmGAW1VqhgbS8IH2AahkOiJW0RFQ63+LL7ZihKn:6aNmA1VR5IH2AHZjOLLNiYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644917007, "uuid": "175351f9-9dae-4ea7-b170-c70de3595e73", "value": 2380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644917007, "uuid": "637225b8-a1cd-46c1-b48e-f2701abdcde3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917007, "uuid": "14c675d7-9eec-471d-b864-b04e463f7392", "value": "latest inquiry.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc4812e-8e04-11ec-9275-42010a9c0029", "comment": "Malware payload (N-W0rm)", "timestamp": 1644891024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644891024, "uuid": "b4cf666c-ccd0-4410-ae70-5adf2ff75ce8", "comment": "Malware payload (N-W0rm)", "value": "74f58ac31a1f70bb4c704f31074882c0", "object_relation": "md5", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644891024, "uuid": "be633776-001d-482c-b9cf-acae06c09dab", "comment": "Malware payload (N-W0rm)", "value": "7c1862829839b836c1c21bb92e65316c1148efefab2028eccf91231bc50fe2c2", "object_relation": "sha256", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644891024, "uuid": "596c3a22-08b4-4485-a152-2f485c35ae4d", "comment": "Malware payload (N-W0rm)", "value": "247ab701feff34cef747bf8e388b3639b8af9084", "object_relation": "sha1", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644891024, "uuid": "9123920e-28cf-4011-b553-e9c9ac35ddd1", "comment": "Malware payload (N-W0rm)", "value": "627b8a82068e13baa826206ffd9ee3b210c9d6c67e11f8101e7f57f488a65b6527e7d0fb53ab8cdc02b0b0b4ed391250", "object_relation": "sha3-384", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644891024, "uuid": "4c77cd01-e219-4a51-8eb8-41cdf59685df", "value": "T198E1760256C8285157CE1F2DC735C814ABA13C946F97B7B3B9C7925BAAB4CCCA1CC8C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644891024, "uuid": "9f436aac-22f4-434a-8673-12cb64efc002", "value": "192:zOAiOPO4OROJAOKoTOBXMX5XlXxXXc3XZOFsOf9SOQq:iADWxY7G2vhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644891024, "uuid": "98c806f0-1be7-4ea3-9d07-882a0e5b4aa1", "value": 6828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644891024, "uuid": "c7ecf99e-74c7-4744-9437-53a1e243083e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644891024, "uuid": "131dad25-02b5-47cf-9ce2-05dd7fe09742", "value": "STJQYIULUDCELUOGYJKBGX.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6352d3-8e81-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644944731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944731, "uuid": "4996f67b-5570-49b9-8dd2-96bf6314e8cc", "comment": "Malware payload", "value": "32cae8e79eaac8d4f2f39553d2b3d06a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944731, "uuid": "6fa28aa7-ae2a-4627-9245-81c0482f1cf9", "comment": "Malware payload", "value": "7c2e5e6b88a8601c9b2bfca545b176a6246991571ae775f0b8061ffd8a1a3e3b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944731, "uuid": "f8294d39-599f-4718-a900-91bda35f96ca", "comment": "Malware payload", "value": "f5263b8c9019bde3a2a9470220f222d89c4c5d7e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944731, "uuid": "71fa0fc2-b5d3-457c-b599-5e0235a0b093", "comment": "Malware payload", "value": "5ed92011a266a561257b26d92fadef7f5416d592520b345bb725407af00d98975a690b6b86166e2eedfbd9a2dfc07321", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944731, "uuid": "7d4cf978-2f5f-4ef9-bd10-3222d3574e19", "value": "T160A1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944731, "uuid": "ef437f6b-7768-481d-9413-58296869aa9d", "value": "96:3RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:3RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644944731, "uuid": "48b63b5e-d5fd-4c81-a0d7-7d03f1d684e4", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644944731, "uuid": "69b2a37c-d120-49b9-85c4-4f93bd19529d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944731, "uuid": "4ebe5a1a-0d90-43d3-87ee-d349d5ad7bfa", "value": "7c2e5e6b88a8601c9b2bfca545b176a6246991571ae775f0b8061ffd8a1a3e3b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40789ba-8e1b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644901071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901071, "uuid": "4f47063b-ff7a-47a7-aa01-32b338c00e20", "comment": "Malware payload (Loki)", "value": "3d84778605f5418bd97058d1e719628d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901071, "uuid": "8c82aafb-e43b-477b-af72-ea36c568e23a", "comment": "Malware payload (Loki)", "value": "7d6c79097183380d5348aa4e6b044a8311eee13c14a57b5e65941f93cfdd0879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901071, "uuid": "4f3d2daa-f6c4-4f8a-b457-d0b3966418de", "comment": "Malware payload (Loki)", "value": "2c563fd6631b40fe137dffe3c19e5891b0c21cb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901071, "uuid": "6f1c6a1c-d0e5-42c9-92a6-8b66c97ad569", "comment": "Malware payload (Loki)", "value": "44c95ec6ea6f3dd42fc72efb23d9536aa40b75d66455af9154d7531288904fe3cfa2a5fe3ac3224bacb0d063f31b07b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901071, "uuid": "624ab436-e8e8-47f7-a893-96d11ea6589d", "value": "T1B4A4E01C60E4E512DAF674389FE7C6789321AE880812562FA7E43FDB39FD29B55013E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901071, "uuid": "3fb6baa5-858d-4f5a-811a-0808add1b5a8", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901071, "uuid": "4c79bb7d-f963-4e81-816e-3de18fad1802", "value": "6144:XwsifSmOi+wUz3RzWYCrq5svgBJhMaKJYVdYzolinfDlQ:VpmkwUTRzADvI0RmCUlinfDlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644901071, "uuid": "99eb3e87-2e92-4efe-8b63-5c371ec9d421", "value": 455372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644901071, "uuid": "a4fa9eac-37d9-475c-8482-aa3d555e67e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901071, "uuid": "70ab1425-51eb-4bcf-b6dd-25f0d6684968", "value": "SG16427R3406864PKKHI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fdecf5-8ea4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644959840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959840, "uuid": "26da3633-2ae9-480e-8089-b088a2a3e824", "comment": "Malware payload", "value": "e6bb34383dd24b7585a969e1ece6875b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959840, "uuid": "9f7eb5f5-8b02-4d6e-bf96-ed18e3e22256", "comment": "Malware payload", "value": "7dc07a2115fb8669f57cff0ca2f08e0363810467f6fa4982bbefe44ddf515a94", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959840, "uuid": "b047cb48-20fb-42e6-a5f3-cf5d3bcb1b52", "comment": "Malware payload", "value": "85f947722a422e8c14279bbf02e63ae16d6256c0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959840, "uuid": "4a9947f9-4ed5-4ed6-8306-677ad7c87a49", "comment": "Malware payload", "value": "7e79fce66d1cdd85a65e95e2c971d63f148914668615d57f968207c820a266f4df31788218ff4675fd87e072bf97f0af", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644959840, "uuid": "49194efb-05d0-4d74-ab55-d3011b25a221", "value": "T18D85D020B2DAC537D57E45B0362ECAAB45297E654BB2C0EB53CC2E1E1DB29C14331F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644959840, "uuid": "db74a996-0dcd-40c3-9df0-a219e38700b4", "value": "49152:ZSTDx2iFVNamKJXL/lrVwjiUK+QXllAVLdPl0YAA:mxzmlrVtUK+QXPPYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644959840, "uuid": "2f7de17b-a124-4ec9-a399-32260f7b12c7", "value": 1778688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644959840, "uuid": "5c3b83f6-78e5-4c7d-a426-f772491388ab", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644959840, "uuid": "50ca98de-cc29-490c-b307-62dd9f3fff53", "value": "Comprovante (Pix) - Banco Bradesco.pdf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054f03c0-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932077, "uuid": "73c0a24a-24e9-432d-a883-d3457f56670b", "comment": "Malware payload", "value": "eb2d788605378f7066bb874764fd7856", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932077, "uuid": "479c9edc-f95a-43b8-9ad8-7a0c564b2775", "comment": "Malware payload", "value": "7e10abb9e8549bf50b98d8615132af98050688ef6574f251a40f4c45c1ed3d4c", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932077, "uuid": "f8e58eb5-747e-4373-817b-6b897de78d4f", "comment": "Malware payload", "value": "4a461d6d2d9b9589e00a212da2bec8162d54ae53", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932077, "uuid": "41ec8985-4cda-4032-8d33-d02463090f00", "comment": "Malware payload", "value": "ee0a7cf71f238bc8a75b47b69500baf1f3a459fe1fef817d4979f5f2c9754f8b78fecfb9d13d62715cc32258cd0a9ca5", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932077, "uuid": "9984bf5a-185e-41ed-b734-5def268e8eba", "value": "T1391309B30613BDCF17370E41E50C2121DC59E86362D899BCBF4898E59BE51189EB4EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932077, "uuid": "f52dd833-532a-4d8d-aa3b-7fb4b7413242", "value": "768:X4BxnIKaeqDA0qj4fUakND3BxQVmBgcu2kfgnt/XpXc3ftZ:XsIKxqDAC8akND3BxQ8iSkfgt/XK3lZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932077, "uuid": "7449dad4-940a-4e7c-96d8-58f1c7720d94", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932077, "uuid": "709d1c84-ed44-4614-aaf9-3fc272ff8e45", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932077, "uuid": "f19b0c39-0b7f-433e-809f-9eba7c011073", "value": "minj.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6ec551-8e3d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644915609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915609, "uuid": "c0e7b931-8028-4b46-a799-18650590e2bb", "comment": "Malware payload", "value": "d9351cc8a5a24f3662a8a44696e47c2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915609, "uuid": "ae2880fc-7faf-48c8-b674-cb5948d96852", "comment": "Malware payload", "value": "7e6079910cd33e0024719dc55eae6dbf1b35d3e7d3cf406a66872b458c72590d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915609, "uuid": "16ded116-99ba-466d-8613-9fd80dc0333a", "comment": "Malware payload", "value": "36a4f82f59a237c85a83401c06d36f63236a5742", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915609, "uuid": "d9f9991e-f4ae-4996-a01c-17ba96bb6d02", "comment": "Malware payload", "value": "0edd47bac445fc8792fac846edbdda38caa9fe91787a1f0c4efbb619102fd50a40505018c4374d03d66af79ca2fe8fc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915609, "uuid": "fba417c9-3de9-4e74-bdd8-4160c6d06be6", "value": "T102F3F1053754D43BE49387724932ABE74FF9E92026B64E870710BEAD3E232919F1B325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915609, "uuid": "9d409a23-1565-4224-a31e-e7b02389aef3", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915609, "uuid": "a9188f41-c188-4f1d-9395-e1ded5ff0f33", "value": "3072:wbG7N2kDTHUpouDT/FjbxZsnOSiEEPAPIr7Ey0tACPb9m74a:wbE/HU//5PsTiEEIIt09u4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644915609, "uuid": "e1885ef9-4407-4bf6-9cfd-93e59868d94f", "value": 162648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644915609, "uuid": "7514b558-b5f6-450a-94db-94892ef72771", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915609, "uuid": "6298f17e-b3c4-4949-9684-1e7a1b806c85", "value": "Factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ff8a13-8e7e-11ec-9275-42010a9c0029", "comment": "Malware payload (RunningRAT)", "timestamp": 1644943465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644943465, "uuid": "593e52a7-262a-47e2-9372-d3c8be91ac52", "comment": "Malware payload (RunningRAT)", "value": "6db6ec5bae1438faf87e2ad4378e083c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644943465, "uuid": "527dd72e-00a9-4f37-bf05-4293e8ae1078", "comment": "Malware payload (RunningRAT)", "value": "7e785932bf809a672845f139212961959daaa5804e838e5817298c328effdfed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644943465, "uuid": "7b89a0d4-5e8e-424c-ba04-20524eeb76bf", "comment": "Malware payload (RunningRAT)", "value": "f0788c41222dade479d857e2fea59b8967ab196e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644943465, "uuid": "cb014987-9e76-4aaf-ac73-1f2b571fe715", "comment": "Malware payload (RunningRAT)", "value": "80a414c73b27321b87286c79f964b682353b3ce0c31295cd1a8c6dfcc5c550cee4f522d8d2dcfc6990f40966c09ddc44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644943465, "uuid": "5d87a64a-1f91-40c7-b308-e0a39e3687d4", "value": "T1A7636C027780D07BCA0123B22C65D36E596ABFA56BDC2987F7E9CB0F07319D17919923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644943465, "uuid": "fe272369-6ca5-4842-81c2-d92f350bfb18", "value": "1b365823829e2ac9bfb0aa5d328240a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644943465, "uuid": "7dff6711-6333-4368-9bb7-43abbefa2413", "value": "768:BCB8S+OR7dOahyoHokBtqN74W7bZZmYb9PyzcjRlYlwa6NVdkPnJJMIzV:BHJaAoHoc2x7bZoYBAcQlwJdMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644943465, "uuid": "5397e846-3850-451c-b41c-52a5ba0fa21a", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644943465, "uuid": "b18cf914-4cf5-4313-b401-b8baa68dc5c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644943465, "uuid": "bb749639-1077-4dab-a94e-b4c740c72a51", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ebeceeb-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932227, "uuid": "68167664-553b-416b-9a09-3f9dcea32257", "comment": "Malware payload", "value": "13648abfe8e0e01fdb0baae2de5d45a8", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932227, "uuid": "b2be60c6-61ba-4418-b16d-87fa2650f482", "comment": "Malware payload", "value": "8082d0d85595939bc44f3021372ff41d1b7c3c67f98206d08dab6ef728e9fc80", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932227, "uuid": "df743be7-1ec2-4e9d-a058-42189f14e141", "comment": "Malware payload", "value": "8a3f58616218df390dc73e55c5940a5e4e82be55", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932227, "uuid": "f3b1bc12-da80-4c3b-902b-a31edecd990c", "comment": "Malware payload", "value": "023cece2bbaa7ffb93e28420a50ef83bdd4a4864b6276770957d9c0a6cc9562a2ac46ff1a02a5d3496228984af42805a", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932227, "uuid": "20e15954-838a-4357-b0d7-980eb9198ecf", "value": "T12A130AF70613BDCF57330E42E50C2121DC59E86772989DACBF4898F58BE41189EA8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932227, "uuid": "c1c9dbd3-0531-4734-bd9f-bb9025fefa82", "value": "768:zCpbtohyIKaeqDA0qjCfUaWND3BxeVm9p2kfgnt/XpXc3B:z+owIKxqDAo8aWND3Bxe89Akfgt/XK3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932227, "uuid": "3961f94f-32b8-4163-9721-30b4159c7dd6", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932227, "uuid": "00e75b14-061b-4a94-9aaf-24b3d5cd1aae", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932227, "uuid": "734e56e9-1f44-4253-bb0f-90bf534ae590", "value": "XxX.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cfeef2e-8e3c-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1644915071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915071, "uuid": "1e42269c-d0ff-42f8-ae75-bbcb1a5fd6c5", "comment": "Malware payload (AsyncRAT)", "value": "94f0bf0133164f89db28f9b4f3dd9708", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915071, "uuid": "04ed62cb-1d8f-43b3-a8b4-475511f816cb", "comment": "Malware payload (AsyncRAT)", "value": "829abb88ef2e3a50a7ad30c61a3194f6991a8d6b8db37d29a6f22aad591a4d06", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915071, "uuid": "3709388f-3f78-4e96-b3aa-eb8d31260c30", "comment": "Malware payload (AsyncRAT)", "value": "663d0843e70811244624d7d7e15088f84c320425", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915071, "uuid": "501f2cf2-0b90-4b75-95a7-2c7acd0b298f", "comment": "Malware payload (AsyncRAT)", "value": "028d7302abbb0ec16cbce82532d530277db5f6ff03e07c99d6235f5705328730fca00240bf5a32b9dea26d0fbf81fb4d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915071, "uuid": "c22eb7db-8c53-49b7-ad45-084aee0d8169", "value": "T1A11493E0DD5CACE2DE650776A4B229712225AF7EE5BD256E24B0B52020B75C330F7C1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915071, "uuid": "26fb1963-bb24-4dff-9b5d-f228d8f2148c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915071, "uuid": "8705ce9c-81a9-4377-9599-61c6f260522b", "value": "3072:q5ftLYu/nn7XAnxnnEnnDnnSynn+vnnUKPKKKuIKKKK9KK9KKKKKBKcKKKKKKFKJ:q5R+oJ9ceTuhTBqZvCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644915071, "uuid": "d61a625c-7c0a-43a6-80ba-a79a0676fb45", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644915071, "uuid": "4780e007-bca1-419a-961e-fcddbca155d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915071, "uuid": "779c4fc2-9c5f-4cec-aa4b-16e185df99c2", "value": "RFQORDER48442502836-ARF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a948286a-8e24-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644904865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904865, "uuid": "c0e418be-1d37-4ea2-86a0-cb3d75605c87", "comment": "Malware payload (Quakbot)", "value": "17d4dddc3fee3825f5d0b34633339a51", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904865, "uuid": "8400f723-f9d9-4491-bff7-7cf2b38bca93", "comment": "Malware payload (Quakbot)", "value": "82c0e1fadff42149e37485a8ced86bbc67789ccc953ae5416f04a9aa23d43d1f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904865, "uuid": "96fcde77-b328-4aa1-8f92-b39fb2ddb42b", "comment": "Malware payload (Quakbot)", "value": "df870200e797fd588f6cb0ceef468eef3f8a237b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904865, "uuid": "00fb2991-b3b9-47a9-bfa3-396c5febc955", "comment": "Malware payload (Quakbot)", "value": "da11592ecb4698dab6ddf7feb7659075f21426007d2d1bcf0e1d56ed706322b428ead1d7ce2dbba1b84bc5b01dfe97c9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904865, "uuid": "2e0d8e6a-2d06-4052-b622-9157abed8b9d", "value": "T15D358E3271C1D5BFC4B23ABC9D6A71A588257D520D2CCC0DBBD84F4E0E7A691673229E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904865, "uuid": "085805cb-b273-4b48-b3fa-3cf2ab2ceefa", "value": "220ea7972e993d1cdbf761cab8a71a9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904865, "uuid": "67c9af9a-8aa1-47f1-b260-4646e1b57c19", "value": "12288:Qt1RcM1gmtlMFHvP/AT0qUyF1XPPzXTwnUV1cQ47gZckpPWUyQVurP6lbuiw1rPm:wuwgYKvPteX5lNEZYy7P/411KQtg9Fq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644904865, "uuid": "3ac21291-19a8-4244-8cd8-4c71a3e9a63b", "value": 1098736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644904865, "uuid": "cd49b4e4-d970-40ed-9707-e425872d03ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904865, "uuid": "71d7258c-ce9d-4a2d-bacf-d2550bfc71a3", "value": "1621832826316290(2).dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844982a9-8e6e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644936585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936585, "uuid": "1497b087-bf73-42ce-9b01-1c53edc6fdbf", "comment": "Malware payload", "value": "91ad0cdd5b3ff133d24b386812815120", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936585, "uuid": "1dae2e89-d6d4-449a-bf9b-dd2dc5b942ac", "comment": "Malware payload", "value": "82d4ca3bdf9ad14c8c4def81716b9368f1e432eccf537d1cf8e855b67fa7c6f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936585, "uuid": "15790f5a-3359-4235-a782-3773bd79c479", "comment": "Malware payload", "value": "6102a3b120f5d9f1c9a2896f7fdff627f8dc259c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936585, "uuid": "a68e2f28-ab3a-459c-9348-608835fc3024", "comment": "Malware payload", "value": "9b09ac00c2b2781fdcccd9d34a7b253ed984f2eb8036204ca4436554894632c220b58ad0c44e78a81500d5b132ec4547", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936585, "uuid": "9559da9d-701d-4dad-bf34-ff9bf34f5df4", "value": "T14A8533286B381770B086991475C2B3231BD938D40F167D199D0B7E87F4F9AE2EC936E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936585, "uuid": "ecc5dadc-5f94-4fba-83b0-cb1239dcec28", "value": "49152:4WRODb55sK6Rg0j9c3Zqhlgv9MYV31Oxwo6R1G:4Wg355SgG9c3kloOwo6R1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644936585, "uuid": "7cd93f69-79da-4241-868a-2c1854398ecc", "value": 1817344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644936585, "uuid": "f1790a8f-e8f7-48ef-81f9-2b1b5d71f1d4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936585, "uuid": "a62a448c-6c33-4fc2-9b26-3025f78ca249", "value": "gpg-check-pattor", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77e98f7-8e73-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1644938819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644938819, "uuid": "274dc348-93e6-4da5-9a3f-b897442abc45", "comment": "Malware payload (Gozi)", "value": "b752e675e6a8f5608e3edf722e80978f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644938819, "uuid": "5282f7d3-2258-4a5d-8e33-9276a19bf340", "comment": "Malware payload (Gozi)", "value": "852f3d58b0bce11b1ab5017d215b9d805f02ac8e932a39558c75f2166dd7d488", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644938819, "uuid": "7039ae57-0d9a-41d4-86ac-4c0c4dcba601", "comment": "Malware payload (Gozi)", "value": "26dafde0e91b71636b17510bc0534d6d6b353b77", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644938819, "uuid": "fa2ec2ee-0498-4f2f-9cbd-655322d94a41", "comment": "Malware payload (Gozi)", "value": "9dd882c53e3f0510f3fe2b3c2b57539d73095c43320d39cf5e23fbe0417bfdb0378a4b909990f9c8cff509d2f9d76c43", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644938819, "uuid": "710b66e2-7e43-4ba5-ac18-7f2dfb6e4c22", "value": "T13F139F01B7F608F3C7A25EB07525FBB5A7E95A3022719044E727AADD2E70853E53D20B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644938819, "uuid": "a6c102fd-8f10-48e2-a8cb-779fb850e8f6", "value": "768:57DIq0MrJBk0+1XZtg2+JUqBbqDHqF1I7p4lNimySSO3Wos/QPj11KsySVBnl:S2J9+1Xb7+JNeDqF1I7+lNimD3WDQPBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644938819, "uuid": "7acc234c-5e1d-4050-9597-d60f829d3d43", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644938819, "uuid": "6283780d-6e1e-4fd6-9d91-bbf9e0f7fd5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644938819, "uuid": "5fec70ff-17c2-48d9-aa60-503027e1adcd", "value": "9f0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c773c5-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932134, "uuid": "4dbc4c2c-f28c-42d8-8e25-a3676d6d5129", "comment": "Malware payload", "value": "5386a1681d11851eb0e1a0671a367401", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932134, "uuid": "65e36e0c-bfda-4f80-8a9e-98f9f230cc1e", "comment": "Malware payload", "value": "863db8757940800a3b12975beb87d6b94fada2f5b8ec6133a360af361643e34a", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932134, "uuid": "a5cdaca1-7595-4df6-8a30-a4c6ac0bb2fa", "comment": "Malware payload", "value": "e75e12e68afbb6a2fc4928ba490910a4b8921e3e", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932134, "uuid": "fd9f5813-b301-42df-adb0-d0595f339b3f", "comment": "Malware payload", "value": "7f62ff9d1ae8eec8233688ed778df9b9d39528e5d65a9fca218f238f112e24d26c3e37b841ce3b2afcbbb2772229141a", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932134, "uuid": "9478d8fa-2384-4f1f-b0b1-0809fc7aac54", "value": "T1AF130AB30213BDCF16260E81E40C3115DC59ECB7719999ACFF8888F68BE5118DDA8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932134, "uuid": "4a98897b-7fb8-464c-83fb-ceca8faaf8a6", "value": "768:/8txR3KYNfbC++m8Y7iH0cJ39p9mnU2kfgnt/XpXc3F:/yj3fbL+m8Y7YBrpEn3kfgt/XK3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932134, "uuid": "d8a81acc-8dfa-4eb6-b23d-61e485c96b73", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932134, "uuid": "19f2a2f7-618e-4bc1-897f-25836a9cf928", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932134, "uuid": "0b592ac2-d907-44c7-a79b-8b401fa46002", "value": "pabl.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37651d2d-8e5d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644929155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929155, "uuid": "e1be5305-2507-470b-81a9-33c3ab5337a6", "comment": "Malware payload (Formbook)", "value": "4a3f27f583265d76d6bbdf933a4a0ffc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929155, "uuid": "eeb8cca5-9f0e-4019-aa54-15d509f0e22d", "comment": "Malware payload (Formbook)", "value": "86437f5988a08ba44e610ae53eb2d77426e00f3ed8e5110dee63f98abdb30092", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929155, "uuid": "3e5dda3c-221b-462f-a9b3-81bbeb3b4741", "comment": "Malware payload (Formbook)", "value": "1bede76c6d4cc9a95064c3e60635011ad497b009", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929155, "uuid": "1dca1d50-87e5-4f20-975d-95080da83f4e", "comment": "Malware payload (Formbook)", "value": "03a625813d386c1c4c15e4628f6ba33fae48d8679e955d95ac52ddd697deb2b30c20ffd348df6505525f8b349d56d5e7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929155, "uuid": "b27f2502-cff0-4e8f-887b-3721ade59c14", "value": "T15AD423E2F02915CE51873806D1CEAF960CF9B94EA75956627AD4120DBC63FB33A0C1A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929155, "uuid": "88f1fe2e-e8fb-4926-a476-8fa8365b2c51", "value": "12288:BHxlOkpDbgaLq0+Iy26O1unzDeurFNCpQLTckkA2AaNZGDwzM7ajLzyPKNA:rltZgaLq0+Iy26OCzhxkQH1HaNZVMajA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644929155, "uuid": "f96cce25-889c-45de-a2f8-b9e227cf7e25", "value": 654579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644929155, "uuid": "c69f7dc6-c0a4-47e6-b1db-82dd121258e1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929155, "uuid": "4469bcf9-bef5-4c57-b998-4addf78f2dbe", "value": "advance payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48528e3c-8e82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644945075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945075, "uuid": "9636b8ae-e976-4d7a-98c9-711262ae19e1", "comment": "Malware payload", "value": "4c2388facf00c37e29d3ee8ff4555459", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945075, "uuid": "8335742b-2180-4f6a-8b51-17019e3bdaee", "comment": "Malware payload", "value": "86fb767e01d1fd17f7b289b67aefcf3c04882e4d41620c7b4e72018afb482ca4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945075, "uuid": "9dd2e639-7d70-4ba1-8d85-d0763c4aadcc", "comment": "Malware payload", "value": "4541a76a6b7cda490f48860a9e6ed845aad1c964", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945075, "uuid": "26532e70-c5ef-45d7-b4c8-3d27da2bd045", "comment": "Malware payload", "value": "4fd7f6b81f9160b160359137bddd5527cf90b4e5b7f42384411f4ca81c5c157d2001a07cecf162f313db0861aba39392", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945075, "uuid": "553b2f2b-4b42-4bf9-ab92-d022fd9172a7", "value": "T1C4953B06A387CDF2F2B345B00789D7372971921A9063F4B2EE89BB55767A1016F27378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945075, "uuid": "1331139c-7baa-42ae-907d-0efaca23af0b", "value": "24576:TEL3d+/bYn3+PC00b+qD6ZK1FUCA+57PIHeHCpmisnB1R5T1SwECuGqnx1l:a6En30nw+M6ZKFNPTT1fE5Gqnx1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644945075, "uuid": "417362de-73cc-4d53-a69c-3b961dc19e8c", "value": 1897740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644945075, "uuid": "d0f8f8a1-65f6-41a1-ad7a-86c134cffaa3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945075, "uuid": "ed2eee27-f74a-49bc-b151-79bf1decdb2b", "value": "tsm32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a98227-8e01-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644889826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889826, "uuid": "bc0658eb-9cdb-429c-a10b-1c0084a4932d", "comment": "Malware payload (Loki)", "value": "62d2a6f654f58b72b514264c036efd43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889826, "uuid": "b5a8cad5-c056-4149-b379-07fb6aeff421", "comment": "Malware payload (Loki)", "value": "8745bcfcc6dcae5b29429a611278c58127abaf751650d7177bb94b801ea67e81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889826, "uuid": "357069f9-2201-48cb-8743-4127905d03f9", "comment": "Malware payload (Loki)", "value": "b53e7b5cb969dff15242ae397ec93f4a02d52ffe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889826, "uuid": "2c342a3a-127d-42ff-8d5d-1107c47b644c", "comment": "Malware payload (Loki)", "value": "7d32404148a64fb38ca4fe2a590847123ef4aca1ad2bb0aae5baaf5461fe7d00521738414fd01c86a2c0ad6377f0268f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889826, "uuid": "3fe00ab4-60fa-4f80-ae79-4b44e7bb479b", "value": "T1D905F1017BEE6B23C57B0E7BD8B1424257B0E90A5117DB7B98D1329C5C8B3694E7233A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889826, "uuid": "5d266c19-fe48-4738-9bc0-76a87b0c20b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889826, "uuid": "37e11a3f-2ff9-4b8b-b037-11a3d02356d7", "value": "12288:sLXeXZOirMNM1/OQOToS6N1aHZyTjqtAdWlOZegtHvYt9Au5KfkNL655OakKX:s8zB5qcfa5ajiAdHTxvYVMfkNL65E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644889826, "uuid": "1e01371b-a405-4db5-a9cd-bbd315a673a8", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644889826, "uuid": "4e1f3019-823f-4043-afe8-5c64a779b5bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889826, "uuid": "e2015523-bab9-4a9b-be9d-3e4bf2b25336", "value": "mbF5xNSLJST1xNR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd123165-8e6e-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644936707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936707, "uuid": "bfbac227-6b45-427f-bd03-c3b782e1012e", "comment": "Malware payload (Quakbot)", "value": "4dbb157ef77d9d7205012ef1cdde3f11", "object_relation": "md5", "Tag": [ { "name": "EtterSilent", "colour": "#A9B976", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936707, "uuid": "3ffc3c44-fc7f-448b-84bf-c19be9b36fe4", "comment": "Malware payload (Quakbot)", "value": "87e3c4e969f620bb0bfda888c6dd9a7cbe4104302c432bb391bd39cf215408d1", "object_relation": "sha256", "Tag": [ { "name": "EtterSilent", "colour": "#A9B976", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936707, "uuid": "6a4390ce-b270-4688-8b9d-151575aeec8f", "comment": "Malware payload (Quakbot)", "value": "cf35867ff3f7550799a533afeca3af598d2dc4cc", "object_relation": "sha1", "Tag": [ { "name": "EtterSilent", "colour": "#A9B976", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936707, "uuid": "fc18f4be-6489-4a74-86a7-7a3645b0859b", "comment": "Malware payload (Quakbot)", "value": "bf362bc212d0a8a6a61c71f0d49f35772301b21ec9da573e62998cbe0a16d2c7107ec3a2e8821585e9b8c4f1a5055c8f", "object_relation": "sha3-384", "Tag": [ { "name": "EtterSilent", "colour": "#A9B976", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936707, "uuid": "40d1b444-8d16-473c-b105-d908465f40eb", "value": "T1014401565900D732F9096E3CE89659CEBE34286BB011642F1C65ABC3CBFB5431FED226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936707, "uuid": "f6263cc1-29b5-4a76-b95b-0243e0d4dbe4", "value": "3072:AcXPSSOtJOM8NpvCEbOQCkICXgNeyD7+ndIhZKF2UxTp+SZFM60EpPtuqd:QO0e2k7Xg4yD7HZexUERpPt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644936707, "uuid": "64d22e57-98f8-4c44-b315-98e068adfc10", "value": 264069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644936707, "uuid": "213dc4a4-18c7-4fe1-bb7d-53af50fa6b9d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936707, "uuid": "d5074e97-3974-415b-9398-a5a62604bf69", "value": "DV-1053810321.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c4baf5-8e93-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1644952352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952352, "uuid": "ebced17c-4927-4275-9df6-dfa044e62650", "comment": "Malware payload (Socelars)", "value": "0ed0885678e0e5b8369bf7965aa0210b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952352, "uuid": "c357ef5a-a447-4c99-9aac-c6c3f0afeeb0", "comment": "Malware payload (Socelars)", "value": "87e48dfe2a8f77f6edc6387a66a90076d46881b9915953b4ff13d83ad148a105", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952352, "uuid": "89ab0486-c568-44e6-aab7-b171b94504f6", "comment": "Malware payload (Socelars)", "value": "5e6a5e997122163109ae8afa523d584f7df0d11f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952352, "uuid": "090f8ab9-da3d-4ed9-8b72-e2b29f870ef1", "comment": "Malware payload (Socelars)", "value": "f0715e07bfb91e297582868a27995999f03281fb1bea99aec132d9e8715dc4dc38f64bb9890e88870f4bf862a3ae2dcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952352, "uuid": "f54716fc-c010-4cee-b444-67135731ec52", "value": "T1F365AF11F6826036E8E30073C6FF46FE9D287621070854D7E3C46DA96E619E37A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952352, "uuid": "b64dca58-cd8a-48f0-8f46-69db20e6b2ec", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952352, "uuid": "f81dc53f-7c9c-41ed-b164-b9bbb16c7604", "value": "24576:KPp+wbkYdhaPeAKOJ1bD/pu6sssUZIpEOsn/mvHe6OWsP:YpxLu9EvDVsn/mvHzOWsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952352, "uuid": "42eda1ea-0795-41a4-a372-4f21db67d58b", "value": 1516544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952352, "uuid": "98bd42e6-a8cf-4561-9b45-03f09d545f12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952352, "uuid": "9f5cc6b2-bec0-4d0a-a14f-24e3cc36b966", "value": "0ed0885678e0e5b8369bf7965aa0210b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce23c5dd-8e89-11ec-9275-42010a9c0029", "comment": "Malware payload (Blackbyte)", "timestamp": 1644948306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644948306, "uuid": "ca41bbc6-c1cb-4a92-b11f-cd46d980d7ab", "comment": "Malware payload (Blackbyte)", "value": "eef977108c7a7aef512532cc6e2f49cc", "object_relation": "md5", "Tag": [ { "name": "Blackbyte", "colour": "#563206", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644948306, "uuid": "6eab30cc-8c5f-4804-bde9-425f948fc23a", "comment": "Malware payload (Blackbyte)", "value": "884e96a75dc568075e845ccac2d4b4ccec68017e6ef258c7c03da8c88a597534", "object_relation": "sha256", "Tag": [ { "name": "Blackbyte", "colour": "#563206", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644948306, "uuid": "8fedb72a-f8b3-40bb-a5a2-1598bb8504ee", "comment": "Malware payload (Blackbyte)", "value": "7273bf0db30a12428f7046ef99ebe3e7472cdfbe", "object_relation": "sha1", "Tag": [ { "name": "Blackbyte", "colour": "#563206", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644948306, "uuid": "debee039-a419-4680-a27a-adbdf53a6ece", "comment": "Malware payload (Blackbyte)", "value": "4266a872790826a287a2b424db2ab3fa821c50ef71603edb155b6083277fc2be2160a596ae5b3484554102ed476c803d", "object_relation": "sha3-384", "Tag": [ { "name": "Blackbyte", "colour": "#563206", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644948306, "uuid": "405a2586-f5aa-43ab-8320-89dcfad20fc4", "value": "T138D4E42D38A0351F560B360A87BA33A0BF9165D6FD25B8FB5EC194C11C748B28499F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644948306, "uuid": "016aac48-fb90-43be-9cff-86fa835ef04e", "value": "6144:9ifWwIb7L3vMTk69b9wwU5oyISUiuH4CgzO/NAgpD8TAVL3QGGv14nzUmviNu:cWwIb7ATki9wwyoVSUQCgwNdwML3K2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644948306, "uuid": "16ab3c04-7bbb-4375-991b-04a160ee590f", "value": 637055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644948306, "uuid": "53265dbb-ffd5-4b6e-aefa-04ab0d6dec30", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644948306, "uuid": "51a44318-57a1-47ba-99c7-2a0631abacb5", "value": "asdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f1f1e6-8df6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884839, "uuid": "75642551-779e-445d-bb63-e3dc32cf977e", "comment": "Malware payload (Mirai)", "value": "37801be6d2dc13453cb2101d591a262c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884839, "uuid": "95056aa4-1d1e-4ea3-88ca-01d3f491157e", "comment": "Malware payload (Mirai)", "value": "88de9abec90d0421c88a2eed104427974185c67a7f9ec57d5fd712d95840d0f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884839, "uuid": "c8592e92-f22b-4ffa-b4ba-2b00569b50ee", "comment": "Malware payload (Mirai)", "value": "ec04cff48c428008f8a23f0d9f7a527628548982", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884839, "uuid": "b01c17df-8cd3-4c0a-bca5-7f6eaefa98f3", "comment": "Malware payload (Mirai)", "value": "28da520c7b9417d55b5c8f32b50443fae273b452faef4a47ffd65666b176b9706e398f71826012adc4610cdb077c5d4a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884839, "uuid": "6d4e09ed-94e0-4ad9-998a-640192259b3e", "value": "T1ACA31946FC818A11C5C8237AB92E118E371267E8E2DFB223DD141F6477CA92F0E77956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884839, "uuid": "d58ea583-0144-4f3d-97fc-593e8f5021ae", "value": "1536:QNnxDOicdr+Pqg7B4iPxMT8AGU/sNUN5GBzTs0+1bWVOn2MyigkodhzTb1EH:gDPPbuiPzN8GTs0+1bqkodhzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884839, "uuid": "067cd527-69c1-4bf8-98c3-9b393c27dc7b", "value": 99632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884839, "uuid": "1debf35f-7f47-469a-8bbf-92a6166e8bdc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884839, "uuid": "50a0641a-2666-4c81-98f4-d135d08bdab2", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63319c06-8e34-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644911619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644911619, "uuid": "00d71e54-2487-4e74-982d-d9800d8a5e4a", "comment": "Malware payload (Formbook)", "value": "b6cbbd4ec1c4edd87c047424949c88c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644911619, "uuid": "9184489c-b084-4589-bb53-ab2b471bec17", "comment": "Malware payload (Formbook)", "value": "89e2525019ea9d8e1050f42c57a2e4b54880c1ab929d69f8a5242dbe805c3e86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644911619, "uuid": "05b17a54-a1c8-4d72-83a1-e51824a59352", "comment": "Malware payload (Formbook)", "value": "c3532ea977b978ac7621e1d820efbaf461c6a715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644911619, "uuid": "0dd7819c-e022-4769-a9d3-457e66384433", "comment": "Malware payload (Formbook)", "value": "056f9be0f8e743f363df89d9b45ada2515e93c5fa69888bd00977c9a1af8443f7e6223dd4be2ed1356794154d59fe0dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644911619, "uuid": "6b44ea0c-82bd-4acd-a4e6-3a7082cda8ea", "value": "T1C7159C23B590843AD92E29B9CD0B87E07519BD647D18A8073BE73F8C5FB9241B43725B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644911619, "uuid": "39ff5068-7646-4205-8e69-700dce7e2372", "value": "395245e59962be96e38956eaadbe8ace", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644911619, "uuid": "3030fd75-dc30-446e-ab14-9c293a18fd75", "value": "12288:MHJF21eFz0BwfJ4VOTKQLzjgmXWr9ioR0i1K2KIRCT+SNR:MpFArifJz1z3XM9ioL1KIIT+SNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644911619, "uuid": "3a919ea6-e156-4efe-a953-c5e138ed89c8", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644911619, "uuid": "4e31cc1b-8cb9-4436-bacf-ffc41f6c21db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644911619, "uuid": "912d6592-e366-45c8-9f59-9d4b5fe90b44", "value": "Lista e Blerjeve.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ce9d77-8e49-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644920676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920676, "uuid": "63b92228-43b5-4a5a-8311-91aed42f8ad3", "comment": "Malware payload (Formbook)", "value": "9a095d66b167a41d9a1df1507c0bed9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920676, "uuid": "fa56e5bc-d593-4e30-8a29-d2d82da325cc", "comment": "Malware payload (Formbook)", "value": "8ab6c464f4c3695f54b05d3c5628c75bd84ead68757828666e540f86fef9f955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920676, "uuid": "b475f28d-bf52-4309-a24e-e660dda6cf4e", "comment": "Malware payload (Formbook)", "value": "53d91871e7ff66c919acfa21b2280ec123c317fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920676, "uuid": "2fb28d58-edee-4583-91ee-f61426dd4e60", "comment": "Malware payload (Formbook)", "value": "f98d5a548c72afb7e947bd670b33c9aaaa28ae2a231eec97bbfd64c05cf1965a6cde3a33fead08646d8b402090b492f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920676, "uuid": "5f20fb18-ba8f-4146-96e5-8e313e5a5c3b", "value": "T13994E091C5C458EAE84A0B759C73FC751267BD2CA9B06D2E2E1E34365BB32D21433A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920676, "uuid": "e3745b88-9d25-4c80-b4a2-87998158e06c", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920676, "uuid": "66c3b57e-0ac1-48c2-ae9f-2f81cfb0aba8", "value": "12288:PuSPEwtQoJFtmMcBWOtsznIzkiNAeI7oPH:GSPio+WOEIzDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644920676, "uuid": "901bf689-b52f-443e-a3a1-f9de7d7256d6", "value": 447818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644920676, "uuid": "91bda0cb-516b-4b2b-8683-12c14aca1df2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920676, "uuid": "e32fa499-befb-4c8a-97df-f89f2f6c845b", "value": "INV-DHL202038.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7868d11-8e98-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644954683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954683, "uuid": "14adb843-cdb2-4813-b91f-7c7fce1b85e0", "comment": "Malware payload", "value": "8bd838053188d8b0de54ab603a9c00e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954683, "uuid": "241aea79-7e68-465f-8988-d8e8b353c208", "comment": "Malware payload", "value": "8ab7dcd16ac2caa1d5c29463246d8ba782028890b3ce6ac722afd0d26f028339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954683, "uuid": "8979bf23-2f5a-455a-a4e1-2798af8d2b9f", "comment": "Malware payload", "value": "2781490642035b736d2d0349c2cafccf1a0ed5c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954683, "uuid": "d469008c-08ce-469a-8060-c3a6fc7b1ab8", "comment": "Malware payload", "value": "bf9886b3714f1c950a3d7d2b8793a0a41aebbbeb487901ef331b866dac0adef6631c6d565b6a459b8ae8f9f6d661e70d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954683, "uuid": "36cba947-1ba3-4639-9cf9-ef894ffbc4f5", "value": "T158A37C0231D484B2D406447101654F739BB7F6361B2FA983F764A9D27E60BF2962EF8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954683, "uuid": "be983895-5355-4c34-8aad-183326b43677", "value": "189b0e4751fb61bd6cafbfdc0138fd3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954683, "uuid": "8a6d7cb1-c0fe-4a16-a131-3f608a5efeaa", "value": "1536:HlcfoGRYBmOTEnPisxF0oIV0dY5oHKB92GrPbKH+M4txZhZcm:HqovTEKsooIVu/Hs9dbKeRtxZ8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644954683, "uuid": "29f96a79-86cc-41ce-b43d-6159a12ddae8", "value": 106622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644954683, "uuid": "12cad29e-04c1-478b-bb24-8f5215b406a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954683, "uuid": "46679fb3-4f71-454f-a11e-f7b0c8f0159a", "value": "8bd838053188d8b0de54ab603a9c00e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33299c0-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644931966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931966, "uuid": "12bfed99-9b54-4aed-84bb-b683df804d40", "comment": "Malware payload", "value": "a394738e064b1ec7adc32fd0460d5118", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931966, "uuid": "f0c566b8-3f30-4aec-a399-d922ed0bfc45", "comment": "Malware payload", "value": "8ae9976cfdda074fee1c000acb0a70751382c5e6eef6b841e9e51419dc15d39d", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931966, "uuid": "b2ba6e66-3228-4b18-81b1-24332ae07004", "comment": "Malware payload", "value": "3c4830c8687c3d3e62282a26538f86a1e54f9379", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931966, "uuid": "8019681a-8a00-4970-87a7-389d8689beaa", "comment": "Malware payload", "value": "fa2f9bb7df3c67c1a9b1f0c954a09d975580c5264ca2ad386302b6d2900bf242b084b2aa5c198813e80f340892c15c04", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931966, "uuid": "2bb6eb62-e86a-4b01-b826-5f7e16cd48ed", "value": "T1585319F656135E4F82270E55E40C1310ECDCA8ABF3E9A1E9FF454EE689984588CB4DF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931966, "uuid": "b5d129ac-c8e9-4548-9f3e-64079a5ec1c6", "value": "1536:YU6i6hWC/cQbBBm0ga5ApggHf4kieuNMElHEbNWxgoG7qRR5:YU6iRCkQbBw0Doyk6NMElwND05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931966, "uuid": "83ba5d19-677b-48bf-b43f-02f95d680ed6", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931966, "uuid": "5c09d24e-39ce-4cd1-a3e1-b5da3434155e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931966, "uuid": "54d66da4-2828-4548-b6cc-15ed9f047cc0", "value": "AsyncClient21.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9146f16b-8e97-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644954217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954217, "uuid": "46164fbd-e064-4ffd-b4be-e58711b3405d", "comment": "Malware payload (AgentTesla)", "value": "40b79ca9a01592195ff1e8aed0f1feca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954217, "uuid": "f7c9bb78-0d14-4791-86bd-02b1071eba3b", "comment": "Malware payload (AgentTesla)", "value": "8b32ee76afb9fe5273edbed09d3dc1685bb67dcbe2e9f286ebff82b28b1274ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954217, "uuid": "d7f97b85-7d08-4676-85a0-5153d102ba00", "comment": "Malware payload (AgentTesla)", "value": "283457824e0a54e425925b41aea581230b3e8093", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954217, "uuid": "cf5e6837-fbd2-4fa5-b2d6-0f07badfd6e4", "comment": "Malware payload (AgentTesla)", "value": "173f2f496195d4a03808daae5e125d817e496ceaec634533e992d72e7648c6818f6b8ddb8313a4e030fc664b8057470d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954217, "uuid": "fb89940a-bdd0-4589-8d1b-c69e8b10010f", "value": "T1AD15010B776BDB34C4A42AB544EB907223F49FCC0933DE7AAC6632D80A536530DB55B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954217, "uuid": "044e1847-223c-4fcf-a4cd-e2a0cf9db5db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954217, "uuid": "c5e5d38f-6e9b-4417-99b2-cf5d4fc1e33d", "value": "24576:y/73gP3/GymjqGVREoybJe0uDs2GznEE:s73ovGpWoybJL2EnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644954217, "uuid": "567cdadb-2584-46dd-9136-1f01f3ff7a58", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644954217, "uuid": "e7d43290-a2b4-4800-8d8d-8a0b12d7ba5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954217, "uuid": "fb0d0791-ccb2-4553-81cb-0842bfe7d1a4", "value": "40b79ca9a01592195ff1e8aed0f1feca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1e777b-8e61-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644931092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931092, "uuid": "26b39c3d-6322-44a5-9bd8-42e64b8e801f", "comment": "Malware payload (AgentTesla)", "value": "68d832c559762b3ec888b48774b62b0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931092, "uuid": "62fdf559-9ce5-4402-9817-0cf6accd1690", "comment": "Malware payload (AgentTesla)", "value": "8b48b354b120517e66618ba10f9f9556b1497d6b942a512650bfa11b71c8d93c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931092, "uuid": "2d1724ba-c9a3-4170-bb29-5dcdca8b6750", "comment": "Malware payload (AgentTesla)", "value": "e0eb62492017c21366cf2e25d22517c46c4bcd74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931092, "uuid": "f1e79a41-89b0-4c55-966f-f68f69c670c2", "comment": "Malware payload (AgentTesla)", "value": "f305bd53ccb088a400c2d6ec006527d27e92f8dcbdb3ba574b54a764b0b7815d873de13ed167ab3b3bf9cf6ba346ca84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931092, "uuid": "285c2045-6f95-4d37-8b6e-6ecc0f841acc", "value": "T10CC35EF4E770B919F010C97CF99982703AF8EF609F325542B469763A197E2AC3D624E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931092, "uuid": "130a699c-126c-40ea-a03d-d120e1fbcb99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931092, "uuid": "c8927cb2-bf37-4733-8155-1f9702bfc95b", "value": "768:QdwXX8IeNdoIGcezZ3maHiYMwN8Agw3nZPHbzYKbR:VsIeNdoIQ2NAVZDzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931092, "uuid": "a0af50a5-f3d5-478e-9fa2-09cddb6a751c", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931092, "uuid": "d81e837d-4230-4104-bdc2-738500fda234", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931092, "uuid": "5480342a-baa5-438a-931a-bf740211bc5c", "value": "Scan-Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c036b1-8e4e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644922690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644922690, "uuid": "0c68f07f-99a6-4f35-8665-a8ad98dd8c4e", "comment": "Malware payload (AgentTesla)", "value": "f93deb64a0af847f69544e60b4711ced", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644922690, "uuid": "a5d85469-9e59-424c-b599-7d273a98b697", "comment": "Malware payload (AgentTesla)", "value": "8b51c08b76a310525e6702227cbb0f46a830bc2175ee346837e9024686dd877e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644922690, "uuid": "3079c8a4-2ff4-41c0-a329-0247718e7fcf", "comment": "Malware payload (AgentTesla)", "value": "0a34708840ebb478ed4c157258989caadf27857c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644922690, "uuid": "c54507e0-5320-45f6-ab1f-3bfe944bfbff", "comment": "Malware payload (AgentTesla)", "value": "cce4a96cc19c537dc86990c5377a649dba13a3d1f28fec4ed7aac6e74b85fcddd997c86d96691f977fa506d3457c42ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644922690, "uuid": "2c66850a-03b6-40cc-b93c-9e4b333287c4", "value": "T16F050202B3BB7FABC43405F448A650C697F48B98591ADBFA4DE271C899C1BD509B01BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644922690, "uuid": "8ee63784-59d0-499e-98fa-437f9ef4f9fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644922690, "uuid": "d81a4c2d-c6b6-47ef-8a12-2db026af1699", "value": "12288:slGnX9HLmrvbH9LqYfMrxkHzpQ3Its8pypJ1cPreKy9QIkpn5k+:XNHLmJfIxkTN4J1mev9Q/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644922690, "uuid": "6410752b-fbee-4349-b427-4072cc30afd8", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644922690, "uuid": "54a0c98f-41c4-4063-a14f-ba77afc42f8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644922690, "uuid": "581e9317-193b-4968-9305-8cb631bcb02f", "value": "iuJ7VY6WCgQHYRV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ffa2e0-8e31-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644910203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644910203, "uuid": "44b9bb4d-99f7-4edb-b4c6-e48a174454ef", "comment": "Malware payload", "value": "6da9d3bd332bf05cc8b61bb4611ba2dc", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644910203, "uuid": "7df3d6bb-fff0-40d0-a82f-74700f0b4aca", "comment": "Malware payload", "value": "8be90b4c90a09b925e817aab99accc8bc158e9aeac561136e6fda91e48746cb3", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644910203, "uuid": "21dab59f-9013-4a26-83c2-a0708a341862", "comment": "Malware payload", "value": "af904ca6c0d7c20989188266a9de7c8fd43cb7d5", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644910203, "uuid": "a9c610b5-4314-42ba-a861-8338cc916e70", "comment": "Malware payload", "value": "0a3af285d823c3700a9a1734f664d720eb6562dad5a46b126db9266eddb79691363b9f2a12abcf80d17447ae8f689653", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644910203, "uuid": "44d0d76e-9fd3-4f10-a59a-89a6c2410bc4", "value": "T106D342771773AB094E098FA598DE27D9BEB428771A20C191DD0333BA74961F18C24DEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644910203, "uuid": "d380a6ad-028a-49e4-ba39-cb62f466cff8", "value": "3072:HRJ0g0Q9CTC2EGiJc0Os8hNSi79+ahlALE9y:sQ9CTC2EGiJc0n8hb9+ahiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644910203, "uuid": "284014bf-d716-4361-ac98-f84368a3202d", "value": 134488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644910203, "uuid": "082c92ad-d281-40f8-8b02-517d23a1c42e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644910203, "uuid": "3607f278-525f-4ca5-82b7-de29193c7d15", "value": "9595-pandora.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc73bb3-8dfd-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644888072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644888072, "uuid": "1fd14132-520f-49fa-9f82-12a044af7d92", "comment": "Malware payload (Formbook)", "value": "1c9987dba573e3745ec610ef0968b746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644888072, "uuid": "b9abfe87-1983-449f-a595-55423af67a57", "comment": "Malware payload (Formbook)", "value": "8c4f6fdac7ad099e36f33ba17cb2f7439dc95916f4013b652f464c866fe88fdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644888072, "uuid": "beb45d88-680c-45b2-9252-6605f6951c31", "comment": "Malware payload (Formbook)", "value": "b6d4bbc6cb9f42796b6c6240e9dabafcd86f14d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644888072, "uuid": "23fb6179-2b86-42de-8a69-90494c32c543", "comment": "Malware payload (Formbook)", "value": "2f7c7e77e4e2d227158e002c900cf52e1e1e0814f42eecb85baa6dd2958dff94c9253325b1d6be3854f362bfab4fb2fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644888072, "uuid": "f155c8cf-4aaa-47ee-aa81-a776454cc7cf", "value": "T10554223F32C448BBF596447065E3AA7AD7348F1627930517EB638FAB7C420DBB04526A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644888072, "uuid": "089429e0-5efc-4dbd-a7bf-a171a29320e0", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644888072, "uuid": "4c6501fe-ea1b-4850-927d-96852c56e247", "value": "6144:owYR7huSUL2innBXLsoBM3erfBGcvQe47Y9kZoYrhl9:MR7hudweM3eNDQekYSoYdl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644888072, "uuid": "81635cb9-fd24-4475-9bb7-2173070ab5c5", "value": 300925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644888072, "uuid": "719b25c2-3036-4159-b2ad-a49165416807", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644888072, "uuid": "8075b3ff-984b-478c-ba6d-ec07b7b0f15c", "value": "Order-Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ee29b9-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932001, "uuid": "0e86535b-89d3-494a-aa5d-3146011f2526", "comment": "Malware payload", "value": "faa578785493e3066bf1f59428238a21", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932001, "uuid": "a8f97c6e-e1b0-4a69-9911-fa4ee3356cad", "comment": "Malware payload", "value": "8d6ff2b873c05a03b940a44748b2646510c753550253aa783cf117c1c6373393", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932001, "uuid": "7ae90fb9-c5f6-428f-a53f-9a6a9dc113bf", "comment": "Malware payload", "value": "8f73e7b2e120f10946f6eb253cbbfe81843306e4", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932001, "uuid": "321a0ccc-7503-4257-9fde-1d1adf892c52", "comment": "Malware payload", "value": "6eac7fdab10c40578b6aa7e347cb0e95af1b3098cd4ef839ffbb9bf7f9e428e4f46953c9cbc4822c03eb0d51e714a2c3", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932001, "uuid": "e85db900-b5df-42a8-86c3-efda615d1f27", "value": "T1C7E23B770613ADCF0A270E45D40D2122FCA4B8A7726665ACBF4489D6C9E512CDCE4DB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932001, "uuid": "7c145a86-c723-40ea-af1e-46dcc12dcee9", "value": "768:qpeomZxScW7CaUE00DD0F3KSB6Eyu6Z/QGQCmM:q/mCuE00DD0F3KSBDy7/QGQCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932001, "uuid": "e7976b1a-ed96-4fd9-bd02-c7ca4530fe00", "value": 32088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932001, "uuid": "369a0013-2bc1-4592-924a-510ca879c167", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932001, "uuid": "71f25901-2332-4d08-b7d0-00708ee1de39", "value": "gurruMH.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0083181f-8e42-11ec-9275-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1644917466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917466, "uuid": "7b2e7ec6-4029-4a98-8c11-450596a9a378", "comment": "Malware payload (Pony)", "value": "ab26ed76142d7939465c7be9a67427cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917466, "uuid": "d30ad2a5-776a-434f-b4e4-5b84b1933387", "comment": "Malware payload (Pony)", "value": "8ec2c238e503fa897571575191abe23b5ba2d80f523473e710c390c51063d9d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917466, "uuid": "5d075437-046e-47da-8510-8928200bb969", "comment": "Malware payload (Pony)", "value": "da95e0aa6da6392689b6e650bb46053d275a8d3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917466, "uuid": "14ce9dc1-86b8-4b21-92ab-7ba8c5669eb8", "comment": "Malware payload (Pony)", "value": "316aa177829d7d65259bc44f4256063d8310c3242845164923ccdcb0fb3c345d6ba4d55bd7f742cf10c360c2e5301275", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917466, "uuid": "c2e1d3ed-0d50-4abc-9fe7-c3a9a487d270", "value": "T1FDB47B4FB49290B2CCA03E31F6999679B3A85D346E314C7EEE8C64776B731426703B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917466, "uuid": "de53b203-f4e1-4598-a18b-6089c910d3a7", "value": "d6cd9cecc12ba283fd2bf86a18ca964e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917466, "uuid": "a87bb1cc-4966-4e08-a0ff-16bddbd87e07", "value": "6144:4OvVU8cLOF0BpJkxchoGtdFgGFpkPlsdOw:FU8cLOikmhLt3gGFpglsdOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644917466, "uuid": "dd4d994b-a786-452a-a432-abfcd6546453", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644917466, "uuid": "4c515ec7-c47f-4308-82b8-9bc42b7d5b0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917466, "uuid": "ae61e3fa-b37f-4598-aacb-6508ae40fffd", "value": "ab26ed76142d7939465c7be9a67427cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3a31ff-8e88-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644947846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644947846, "uuid": "0d872235-3e90-464f-b85d-a32528b86260", "comment": "Malware payload (Formbook)", "value": "43fa0881260ddefe1d44b0d6706669eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644947846, "uuid": "11872cd5-5fb2-4615-bf04-74b794e7dfd0", "comment": "Malware payload (Formbook)", "value": "918c630d007a2736849aecb7b620b92b99e966d9e4cbfabb4bdd6f1b510f14cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644947846, "uuid": "db103df0-d71a-411d-8910-240ac684f93a", "comment": "Malware payload (Formbook)", "value": "9a54643123a7285ab587cc860e2851e0f565472d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644947846, "uuid": "8ea0a7da-0a84-4352-acdd-a9e7720d7618", "comment": "Malware payload (Formbook)", "value": "49ef922eee67f5702dc887989a290a24cc296c72cd5a3376b407140c052032ed358f0dbe44dcdb96920c6d3b7a6768ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644947846, "uuid": "3244e78a-acda-4eca-a3b7-4477f2ad25d1", "value": "T1BDF401047BB37750C8720BFA98A196811BB6659E5123D63CDA9334CD0C17B90CE7BA7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644947846, "uuid": "49c1cd01-1976-4824-a560-841336aefe8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644947846, "uuid": "7891923c-c09e-427d-a610-52dacda85a22", "value": "12288:pMR5k+spVBN1m5R76X18+sc1x7uQ5/ll/InSR919FCUL+Zxqd+cwq2JM:GRalpDNl8Hc1x7uGNl/Inq9FmjVc+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644947846, "uuid": "dd3bc0c4-487d-4ccf-b2dc-7e7d82c99720", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644947846, "uuid": "ba1b387d-5867-4efd-8af7-62f7ac216637", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644947846, "uuid": "b338342e-53ab-4725-980a-ee4c0e119813", "value": "itens que precis\u00e1vamos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d176cc8d-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644931990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931990, "uuid": "a5af9d6d-ed8f-4dcf-9c71-7adcc95999bc", "comment": "Malware payload", "value": "37182d65226403126ffd85a6c8ad1a1b", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931990, "uuid": "403284c4-8a5b-43f2-8aec-67e54c522c8e", "comment": "Malware payload", "value": "91a981019ebf1be203b31573efbdf353939607c8c02b3a08d14452491b455c88", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931990, "uuid": "ce3a0e9c-05bc-4316-84e4-35323a9cb9ca", "comment": "Malware payload", "value": "8ea55a2f2540ad68a139746f858ce446cd598f4e", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931990, "uuid": "bcf0c506-91bc-4312-93ba-0425dcc96064", "comment": "Malware payload", "value": "35751a1c1a7b95ec6b2d58d1c9f75e50601e70dd1c94e40f15b81feea6c0c4b361419ae948805cad9d1cac21c4001677", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931990, "uuid": "ed974d77-b3f2-4d9a-9768-652d856b19e5", "value": "T1711309B30613BDCF56260E41E40C3515DC59ECB772D89DACBF4888E58BE8118ADB8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931990, "uuid": "ee9dfc5a-b163-45e6-9cf9-7d04bb4845a7", "value": "768:fAR2xT4qIKaeqDA0qjmfUaGfwdYsmp82kfgnt/XpXc3X:f3WqIKxqDAM8aGeYjpvkfgt/XK3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931990, "uuid": "1d0bbcfc-3228-408b-86e2-19ef8914dc69", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931990, "uuid": "d3ed3372-6664-4034-89d9-fd2676823dfa", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931990, "uuid": "96f230e6-22af-457b-b327-6ef023ca56a5", "value": "gerente.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228d16d6-8ea3-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644959185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959185, "uuid": "593d725a-46a5-4eaa-9e64-ae0f203e9f61", "comment": "Malware payload (Formbook)", "value": "3247f8db646f5e524df32ea6a29e33d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959185, "uuid": "9043f997-4d49-4527-af08-5ce7b60cefdd", "comment": "Malware payload (Formbook)", "value": "921628eeb649a7c9f45ccb4b95ccecba8a76e273a88bdf8478c7e63cef2fb10a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959185, "uuid": "4bea6b14-9d5e-4d1d-94df-b65b8c61421d", "comment": "Malware payload (Formbook)", "value": "2dd2157329e16150e476e058224f77bf0c2d1abc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644959185, "uuid": "0b3dd1d7-43d1-4a62-bfc0-4847ee26ce43", "comment": "Malware payload (Formbook)", "value": "8831080186dbed7d100abec1b06a77cf489277f2c4d81befb06c0c3840f7571fd308b7be00300281612e148968e6e056", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644959185, "uuid": "1d04cda4-ce52-422c-95f7-6ab1e0efc020", "value": "T16305011BB73BAA7AC47416B500DFE03113B15B8D2673DE3A7CBA32EC196236109B5539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644959185, "uuid": "27418424-5403-4d1f-87fd-36e25a68b1f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644959185, "uuid": "1eb1614d-cf4e-44cd-a6e9-ae63e5439e3a", "value": "24576:GpPyANR1AiUEYDWt4T9FLrP1oV40/h9A:0PyAH1AiK84T9FtoP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644959185, "uuid": "3d41c5ab-4514-4d77-835c-066a86248578", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644959185, "uuid": "9338b7e1-83d5-4011-a1be-9e1c04c5c348", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644959185, "uuid": "01a5c8ba-d498-4fdb-80dd-dbef550d9744", "value": "3247f8db646f5e524df32ea6a29e33d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3192ee4-8e60-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644930624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930624, "uuid": "ab2a07ae-b874-46e2-940f-b25f1c616b31", "comment": "Malware payload (AgentTesla)", "value": "e8bb2f7082c796b9dbcd71b3200589dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930624, "uuid": "5d21e51b-cc64-4d28-9f34-ebcd1999c7c6", "comment": "Malware payload (AgentTesla)", "value": "92cc6d240adfc468b2af5cf33a61c349a1df5f7e36d770c12899e6129e71a327", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930624, "uuid": "02b25612-c3f4-4b6b-80d1-b30c4ae0d7f2", "comment": "Malware payload (AgentTesla)", "value": "d5a20b0503f78d41519e509bf0923a79a4825b70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930624, "uuid": "fea6d566-a58c-4126-9178-9c4f2a50f478", "comment": "Malware payload (AgentTesla)", "value": "e07321998555e22da2e51f8a752dde22275eba74dcfac2d13ffdfe1b50d251f516f7d4fee9bb31ae1abe914234cf5055", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930624, "uuid": "2fc9e271-be2a-430e-b535-22a953853db7", "value": "T110058B6595F7C8BACC6700BEA02085886E61EE9F7203FFF99449F83DD8387815686537", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930624, "uuid": "44095261-babd-4d32-a09a-f5df53172b68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930624, "uuid": "e589afdd-0e15-48a5-b228-5fc1e2ebac97", "value": "12288:5vasVVL7l9oWa2o0B7WUUq7lTonH02k8:Qs37leG9B7WUJ7lTonHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644930624, "uuid": "128298cc-3c80-4b3c-8bbd-c41fdcd6d2e7", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644930624, "uuid": "68f96ca2-f76a-447f-8a12-b5da28cbc60a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930624, "uuid": "7bef3b9f-d6b5-4a2f-9bb1-4fb437ce2210", "value": "SecuriteInfo.com.Trojan.Inject4.25937.27917.6774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d6e2c0-8e7b-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1644942109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942109, "uuid": "2bb68c8a-f083-43cb-93c9-1074ab146806", "comment": "Malware payload (RaccoonStealer)", "value": "8600ec4fb3c61cb8f3d28827b868364c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942109, "uuid": "830fb28a-2f8d-415e-9944-d0aa12c04ac4", "comment": "Malware payload (RaccoonStealer)", "value": "92ed5fe726d72de97c72643a8f0ebb5ccbf473f857c9ff1b0cb31efd03a72558", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942109, "uuid": "22b021e5-55ec-412c-ab24-5ce8cc5a5422", "comment": "Malware payload (RaccoonStealer)", "value": "12fd5ecf801ca3082250ce57ed8c418b418e0361", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942109, "uuid": "054d0556-e337-4b6b-9135-17ca214ee063", "comment": "Malware payload (RaccoonStealer)", "value": "d72b387b81232552d37a9b4e1205b4379155afe7f48e52e46fbf178e0e036ac825c8bb308fb500ca76fa77380039cdcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942109, "uuid": "34a8052e-6451-4a82-9cd8-1311029e3dba", "value": "T1D74633DD5A4023C8CA96B7705F8DA71046C9836430B524EDCEAE4C9D6D908A6FF1BCED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942109, "uuid": "4260ba69-7a77-4dfe-b217-083892641f5a", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942109, "uuid": "b31f7668-ecca-4ace-a871-5dbdd7160322", "value": "98304:rXcs82I6AEZsHpmggm5b6Ls9aQauG8MwFKpugfverMWVJs8DX:rsdVOsHptZ5uL2aucrugerVVJs+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644942109, "uuid": "c9499086-7dc1-40f7-ab1d-0ef04d7319df", "value": 5367808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644942109, "uuid": "c8e14583-6405-42a7-b2c9-e000fc29e2be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942109, "uuid": "f7dd1345-7956-4195-b5d9-2a400ab6a5ea", "value": "8600ec4fb3c61cb8f3d28827b868364c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e7f4e8-8e3b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644914707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914707, "uuid": "ce6aedc1-a6b6-484f-8d8b-03a8038b3ace", "comment": "Malware payload (AgentTesla)", "value": "6e868fb30e00facd28bcda931b83d0f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914707, "uuid": "5c4a3971-7940-44a5-ba2a-18e0ba41cbed", "comment": "Malware payload (AgentTesla)", "value": "941cf7e7294eb09467229b6912a5ca94ce3b93162716ff6814c9de93f9cf7fef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914707, "uuid": "e8664976-6b50-4d54-a668-dce27bb82212", "comment": "Malware payload (AgentTesla)", "value": "ad830ee5ae79b86ca6ad8325e91bbbc673852895", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914707, "uuid": "20313f4d-104e-47da-9ca2-0f8445c08846", "comment": "Malware payload (AgentTesla)", "value": "7afbe50430bfd7c7d153341b1781111e0b449b401ccd4e1c3a7530ac4bfc367a6bf254d519032446d17a152c5977ea65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914707, "uuid": "d7b2335d-c59c-4c8e-ab50-0eb8e7f494e8", "value": "T1E0152364BCC0DE63E257B0B7E886E121917CED61131FC8A3C70B7AA8A971F61954C47E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914707, "uuid": "84032a0c-8d55-4ab4-b864-85d5d4cb696a", "value": "24576:vXUC3iZLXDufaF+UtlnHJ3SDkmbU5IZCBgAXV4Jq46:sCSZLAaFvtRw3bvZsgAXV4t6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644914707, "uuid": "b5960c03-0bbd-4acf-837e-5f8046695b47", "value": 916456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644914707, "uuid": "9b7e9a4d-7379-46aa-889f-5f343838d0c5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914707, "uuid": "5b249441-af23-465d-a6cb-800757b6a08d", "value": "Purchase Order 21522.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4ebbfc-8df2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644883318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883318, "uuid": "60de61a0-9e67-4b89-bf0c-c198587b3b0b", "comment": "Malware payload", "value": "64b892b27f3776d11fdf559584487e8d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883318, "uuid": "d5f282f6-896f-4885-bcb9-9734a1fc60a5", "comment": "Malware payload", "value": "946c5717df456e97122befa2585e110ea7ad9dcc7d9954e9e49cb79667788338", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883318, "uuid": "4b2b91f7-6d15-4516-aa57-a6e1b2c3835d", "comment": "Malware payload", "value": "629fac3fd0c2ce5d24c46b8467bf61be1195c2ea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883318, "uuid": "86ebfbd9-6c34-48e7-bd1a-c04f379244ab", "comment": "Malware payload", "value": "c71a461096eb22593889b2f36f83a594ffa1256abbd0fcac1d2e9373fca68a9ad667cd29fd036d81fbfc2db215e62dcd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883318, "uuid": "c107f763-ad09-4b54-995a-15bda2fe56a2", "value": "T110A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883318, "uuid": "16cbea18-95fd-4994-8537-17875a98d2fe", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644883318, "uuid": "d7cccf1f-4c10-49bc-9605-bc0434051d10", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644883318, "uuid": "f80e3c34-d9e1-4296-a5dd-770b24bb6280", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883318, "uuid": "7e810cd5-315f-4514-a2c7-91bcd5a58b5f", "value": "946c5717df456e97122befa2585e110ea7ad9dcc7d9954e9e49cb79667788338.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3119b4-8e7a-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644941669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941669, "uuid": "c2cdc799-d46f-424e-8eef-fcdc72d620fe", "comment": "Malware payload (Quakbot)", "value": "60812f02ebb4c383915dee3c94912aab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941669, "uuid": "38412c45-725f-4100-a348-adb470ccf026", "comment": "Malware payload (Quakbot)", "value": "952f250cf5c482d80c8f521a263baecb35696e27b91672cbda69fab6c021a419", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941669, "uuid": "cb213e20-bb34-474d-910c-44fda83373e0", "comment": "Malware payload (Quakbot)", "value": "243fced241370fed48f216ed95c2203a330bc6a9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941669, "uuid": "f772a986-6f88-485d-89b0-cbf739f73383", "comment": "Malware payload (Quakbot)", "value": "00c0c853f24b72553fc5be5cfa6d73958bfa2e779b7f35daf4abfe307c37c0a2c75adf21a514430843f2c5bdbe205a03", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644941669, "uuid": "e881ca25-79ef-46fb-ae1a-19ea3861ad89", "value": "T1044401565900D732F9096E3CE89659CEBE34286BB011642F1C65ABC3CBFB5431FED226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644941669, "uuid": "539e14fd-f6be-4c94-a455-6d782f22f7eb", "value": "3072:EcXPSSOtJOM8NpvCEbOQCkICXgNeyD7+ndIhZKF2UxTp+SZFM60EpPtuqd:kO0e2k7Xg4yD7HZexUERpPt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644941669, "uuid": "94f3b3db-b817-48cc-b356-57fe52d8b5a7", "value": 264069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644941669, "uuid": "309caec3-590f-4d71-8c10-2a23a47cedab", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644941669, "uuid": "75312c14-92e2-49de-8258-eab84e93bfaf", "value": "DV-1027811316.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a1c2e5-8ea1-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644958646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958646, "uuid": "19a20ca6-ee65-4d40-8470-7d5414b15af0", "comment": "Malware payload (AgentTesla)", "value": "dc4268bc70a23a585bf1426ac91d3980", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958646, "uuid": "fae7a9b9-5ade-43e5-9052-5295fb2d5b26", "comment": "Malware payload (AgentTesla)", "value": "95909dd178ff05628ceba421b088e8be135512ee4b9d2eb026e6ebbc0c9aa37f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958646, "uuid": "e82290ae-51af-4dac-b811-1b0f9c27d491", "comment": "Malware payload (AgentTesla)", "value": "b1704632927f9cf5aa3b8a1ba5fd06c58971aa68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958646, "uuid": "50a64673-a44b-436c-a920-5649cff15a5d", "comment": "Malware payload (AgentTesla)", "value": "002f2b722925273f5438c2fc2ff0f4187dbe239c21c54c6eb49b5c00e3d6ec859fb880b6e04fc721ce4c45f96124cf5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958646, "uuid": "d21d4e24-3aa5-4193-b89b-c022fa58455b", "value": "T1B8050100B7B73785C5B607FA54B188811BB9B66E5517D63DCA9274CC4D22B80CA3EE3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958646, "uuid": "0b917b02-b99c-464d-b8a1-0946fbbdda53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958646, "uuid": "2a579e88-465b-4466-8d77-4d71d9c9fa76", "value": "24576:uaFTtVAQzGjFukd47iO1YgEkEadMwf5NVDK8/K:3JtW9jFfMxKgbqKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644958646, "uuid": "809cedf6-8713-40bd-87bc-2104b467e8b5", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644958646, "uuid": "a878e045-10ab-4854-8833-c88fb4175b6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958646, "uuid": "37ec3034-0f09-4aeb-b5f6-007fb7300890", "value": "dc4268bc70a23a585bf1426ac91d3980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9084bd-8e9d-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644956759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644956759, "uuid": "a64e2c79-c3de-458d-a794-e5d4c9091372", "comment": "Malware payload (Loki)", "value": "8fb11ce4d5db5a41fe56fcf892282990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644956759, "uuid": "f0c30fec-922e-4c61-8490-b0ad764d02c6", "comment": "Malware payload (Loki)", "value": "96d4f14f8d1be02a21feb4533eca4f270716e7b0feefe6e5a477454f13db99d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644956759, "uuid": "5b2661cf-c0f0-4f8f-b547-0f1af94e1540", "comment": "Malware payload (Loki)", "value": "dced50dc761e87184e1f53f7d100c3490fc557f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644956759, "uuid": "1cf94df7-0cc8-49f6-b601-bf22e545812b", "comment": "Malware payload (Loki)", "value": "9f2908119915951f2e8f95870122a39b6b6218b389825225e0b1643ad285720a060afeccbc689f41a41c802a455b61ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644956759, "uuid": "54c91fef-267b-4e3b-adf4-1124213145d4", "value": "T1F444BE1036A3C433E6A60171A875C7B55A3BBCB2593492877BD16BFD9F312E2CA17342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644956759, "uuid": "c00bc2ca-5c0d-4891-8f1f-7ccd132ec1e4", "value": "8d72d9e8390e0a6fb409a21cc742651c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644956759, "uuid": "053f2a6c-03e5-428a-8701-5d2b9fcd3ed5", "value": "3072:PKCzTv0j1HhnOogZnihkAbN1ZIYmpzEQSOkeIVWppvIl:iCH8THgZnihkAR1ZIYmQemWzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644956759, "uuid": "b4ac1a7a-d69e-4321-ba7b-9ffe6895c88a", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644956759, "uuid": "f465d2f2-f6e6-41f8-9296-a4a8206f2db7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644956759, "uuid": "4a1dc71b-092e-4f60-baf2-a260f9a9232a", "value": "8fb11ce4d5db5a41fe56fcf892282990.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8323d9b6-8e96-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644953763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953763, "uuid": "7074b9da-9492-4994-890a-563d24039c05", "comment": "Malware payload (AgentTesla)", "value": "0df0227b6b56b7b3554f03e0ca71b2b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953763, "uuid": "2e3676a3-4167-4faa-abbe-0e0292825d08", "comment": "Malware payload (AgentTesla)", "value": "971c5350b47c5f1710f23ba9dc46bdf2db53789fbf049c5442c56543d432b095", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953763, "uuid": "4976f2c5-80ed-453f-a612-6c29073a1fd2", "comment": "Malware payload (AgentTesla)", "value": "524729df7417b75da55b515ab14bfb157e57e1ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953763, "uuid": "a83b33f2-6716-4ee5-8e6c-6bf5b24c2c1e", "comment": "Malware payload (AgentTesla)", "value": "2c66f7c8f0711fdd4ad9ba8ce71ec32783e5a6bae02a3b4779ba25edeaaee39efad0553334609012e2bce6f1d75e3949", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953763, "uuid": "d030ccc9-5737-440d-8448-eab94ef86220", "value": "T12C050154BBA77B95C97C47B5B096C07382F1A67D7322EB3E4DE2B18C15823E185B0239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953763, "uuid": "283265c0-1a57-428f-9fc4-0697c2bf7baa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953763, "uuid": "90524372-3186-46ba-b8f9-6e458ec59c9d", "value": "12288:VJky/m1j+iTbarShZGUodfmX3F5dZC64Rhkk6jLLj+iZB2rHTB:VK0ej+iTbaehZGLfSVsr2jfj+if2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953763, "uuid": "c92bc2c7-d1b7-499b-86f5-d0fa3f5d7637", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953763, "uuid": "98fae372-500e-400e-a08b-af8c6a9b471b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953763, "uuid": "feec3b70-6eb8-465f-9b37-f65b54234be1", "value": "0df0227b6b56b7b3554f03e0ca71b2b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a988ee-8ea2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644958945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958945, "uuid": "e1b8405b-d530-49b7-ac49-bcabdb5b3851", "comment": "Malware payload", "value": "9e74d59c8f4e093f2fd66863ad767307", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958945, "uuid": "3d10c7ee-e250-49fc-80bc-5ee005c78162", "comment": "Malware payload", "value": "97f93ceae1adf1e9f5ee683a1c9d1fdd07ace3ec6f8f05435f4bfc434d7a66ab", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958945, "uuid": "8d8fc60f-0502-402e-bb07-c1970ee988c0", "comment": "Malware payload", "value": "9d4f0ef7bb8c1ffcbce4f0846490dd76b10a4495", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958945, "uuid": "bab249e1-0f0a-41f1-85f1-dfce27ab86f9", "comment": "Malware payload", "value": "1e77ea699d4cad27e27448c91867f75f1fb6c2f2822a14e092481348f3c1212b3e3d2898ed69e590aefba74f97cc6fc8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958945, "uuid": "c0dee53f-5818-4221-9399-89474b615143", "value": "T170C21AC5F9815602CAC7617BFB4E43897B6A4758E2DE3303692B6F213B87A570E27141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958945, "uuid": "dbc8b648-aa44-4d65-b7a9-4ab605e75d70", "value": "384:p/V5NQ0R/13WxAE7uMtFVVgBVWT26Blwi4+qXD1bOHFQvTePK:p/VL/13AAECMbu49oi4+U1ZrIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644958945, "uuid": "5a9f8e52-fb12-42ff-b4eb-050af0a8c5a0", "value": 26972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644958945, "uuid": "7bd78970-1cb3-47bf-ad1d-7cc9ba29b232", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958945, "uuid": "8c26723d-fdb6-4f50-ab8e-804f4b89f3ac", "value": "beamer.arm5-20220215-2102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69a1636-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932026, "uuid": "081bfa96-fe14-4686-b5e9-ba25d0a7deb7", "comment": "Malware payload", "value": "64c77172f08b872ca6d1930ef43359f4", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932026, "uuid": "83e67294-90dd-4128-988e-d67665b650e1", "comment": "Malware payload", "value": "98720f8485a2b7823f2ea2d04984414b26eab98b3206ae01dd3277ac872e5e05", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932026, "uuid": "dde6286d-66f1-4acd-bc66-30b2d9f8d1f4", "comment": "Malware payload", "value": "4455aa142e0156f5acb2e0f1e25f115a8e0a14b0", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932026, "uuid": "e21a5557-5aa3-4749-8557-95706e693852", "comment": "Malware payload", "value": "d6e5a52272d78e5343f373419cf56ace43c2c5254e7ed5f85028408ae81631428cde6d518c49e4d2b76d8a377bc05b65", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932026, "uuid": "59570d1d-13f7-427c-9824-400da343e226", "value": "T1C85309F616175D8F86670E59F40C1300ECD9A8B7F3D991E8FF4A8AE589994188CB0DBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932026, "uuid": "dc4a532a-cad0-4189-bee6-8553b389f2bc", "value": "1536:YV6b6hWCto8Yc3eQ3Xg+/xg7ofypmKHnCeupqEhHERhdfvB63qRkBH:YV6bRCQcuiw+q7ofypLapqEhyhvCBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932026, "uuid": "5db671f3-0e6b-433a-a103-c18f59f71428", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932026, "uuid": "b814ddf8-7846-4911-92da-9e5d215a38a0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932026, "uuid": "d231a8a6-e037-49a3-9c9e-662841d9387e", "value": "jesusamado-asyrat.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42c76cf-8e79-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644941444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941444, "uuid": "03e184c3-004e-43c4-95ea-39b1fa79cfda", "comment": "Malware payload", "value": "1ca8921a54b9e0b83898b465bcb825ec", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rdp", "colour": "#BC576C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941444, "uuid": "0df9d394-8fa2-470d-82c5-d5cf849de70f", "comment": "Malware payload", "value": "993afa5ca786935ff44f01d5495e0583034008d30d93eaac100e6d4325dfb89d", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rdp", "colour": "#BC576C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941444, "uuid": "9e8ceb5e-0862-4c44-8852-c5582b24522e", "comment": "Malware payload", "value": "a042692fdfb66396b030db8eeb62ed9661c291e0", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rdp", "colour": "#BC576C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941444, "uuid": "e9b7eb6d-c329-45a9-a112-7bc2c8830183", "comment": "Malware payload", "value": "60675f5f084cfb7f1160c5dbd198a5383c0f2c538ea2e6d478452a5789c7593c2254ef7c0a962fea055bb686d13a85bc", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rdp", "colour": "#BC576C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644941444, "uuid": "65579ca0-89bf-4f4a-ac66-6d897615870a", "value": "T19E936D41F3E202F7E6F2053100A6726F973663389764A8EBC74C2D529913AD5A63D3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644941444, "uuid": "e04e2ce3-86ab-49e5-885b-8b8427bb7e3c", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644941444, "uuid": "8fbcdc8b-796c-4d6d-a440-7e854c4ca02d", "value": "1536:L7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfGwJOc:H7DhdC6kzWypvaQ0FxyNTBfGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644941444, "uuid": "068e0d76-76be-4035-a2af-f9bf1ef726ca", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644941444, "uuid": "2ed71855-4960-432f-8d5c-ca63730c47dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644941444, "uuid": "f732136b-adb1-4aa8-a799-455800ad3f57", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062015d4-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644953124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953124, "uuid": "952e8ef4-43ae-4d31-8e1c-f8d72270f136", "comment": "Malware payload (AgentTesla)", "value": "57af3be6195cbd75dd8d2e6cf99fd636", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953124, "uuid": "8f06887a-5e66-466f-8133-a4907e341c2f", "comment": "Malware payload (AgentTesla)", "value": "994259df676650ca7cf11afdac2d016292abcb58f0c472387ba048bfa7a0f3cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953124, "uuid": "4a9bf9b2-2ee8-40c2-908a-3ebd726fafa5", "comment": "Malware payload (AgentTesla)", "value": "f4252534ade75024356780f5a74ed9e1f5bcc89b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953124, "uuid": "1cd0282b-2216-4fa2-9c0b-bee9b8981f39", "comment": "Malware payload (AgentTesla)", "value": "185e480be47c7c2a1f9b3937717e7f26f03b942d899d57ee6a3a9da85e187074a6ea79ffb2b67aa86c4173e0800fad2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953124, "uuid": "6bb26372-6050-4419-adb7-b4b46e33f47f", "value": "T108B49D97F7D40A0BED22437C05E29F6476B2EE966A73D71F02D5B9119B33BDA22094C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953124, "uuid": "2cb61821-9000-4c52-978c-10cb1affefe0", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953124, "uuid": "e2770b51-30b2-464c-9f0d-aa082512df1f", "value": "6144:DwRvf/7B5VnbGgbn71SQ9ch7jRV+qABr7+uApKeKzasnUFRDHCJM7ocpIzm/rInZ:cnbnxLeRD+BGKp9nUjom/rInDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953124, "uuid": "78bcfa7e-1d0a-4e63-8d22-0d5acffd6133", "value": 498981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953124, "uuid": "bdfb6cdd-eca5-4936-8b3d-0ee10ae784eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953124, "uuid": "45a64a94-bd2e-4ecf-8305-7a3dfa3eb1cb", "value": "DHL AWB 6600070035.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2006959f-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932122, "uuid": "00656319-a0ef-45ed-ba56-c4d245637ba5", "comment": "Malware payload", "value": "c5e8e6f461f7878acc786ef27e602449", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932122, "uuid": "5414b7d1-8aa3-416d-b5fd-db11b1ef6b28", "comment": "Malware payload", "value": "994c120c552c53c0cb6bac7866c837c8ee29fdade9a919e152dd54118d52c5e0", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932122, "uuid": "353cd093-adf8-4084-9217-49e9015ebd75", "comment": "Malware payload", "value": "a74a991f64b76c6c263dce81e6768e5ebe7b5fa7", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932122, "uuid": "e17482f0-82a6-4008-af77-d9a68473a249", "comment": "Malware payload", "value": "36c425c059ef407f1faf6a7b061f1c1ea0e26ccecbb2fd80eca0ed7f4adcf3c821c592c8943ce4443391da6afcf856e8", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932122, "uuid": "afa34913-5deb-4367-88b3-66139d1337af", "value": "T1F1636CB71315FCBF1F0A1DA4E10817411C7CACCBE6EC91A83B4139FA95865589ABCEB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932122, "uuid": "57272c58-8526-407c-8cb3-f7cd46588af5", "value": "1536:j4sd3fjZ9Udv032Qm0yDzkfCgUC5hiOcEgCh+BlF2QN:jpvjoMmQVyPkf1LjTHh+BlM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932122, "uuid": "e4e33fb8-63f1-4742-8252-d884b8ad6f93", "value": 70316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932122, "uuid": "a5d32b44-5fdd-4bf9-ba3d-88d5bda9c5d2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932122, "uuid": "e362f872-a886-48e0-b8b1-f8dfd401b801", "value": "nuevoproxy.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71bb1bd-8e01-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644889829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889829, "uuid": "b3e7ca46-24af-43d6-97b7-1caa10d7a70b", "comment": "Malware payload (Loki)", "value": "83218468d1c60ffe59ba5a7c5baae713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889829, "uuid": "0fc7bb96-b2e5-4c81-b14a-707590b789b0", "comment": "Malware payload (Loki)", "value": "998ed32fbb6ea4071abf6069a88a0140d3428d5823ddee900a072c66446ae0cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889829, "uuid": "94b0b03b-1aec-4f6d-8a47-dd0d82e56ceb", "comment": "Malware payload (Loki)", "value": "83f837109c6d8fa2a0f12e5b536e914446dea324", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889829, "uuid": "28c35452-c21d-4423-ab6b-33339d4c1b5e", "comment": "Malware payload (Loki)", "value": "95a8ee2d4f46ddff7566cd5de3a795591e83c051a788fb67b67998f4a0eb6b178d11265791ef2d2cd3915ac80bc82bcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889829, "uuid": "1f5fbb35-2a77-4be0-b39b-5c42f6c22aab", "value": "T149252200BB37767DD8E10BB685A2C13A1AF9AE8C1492DF7BA97730DC167336540B1876", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889829, "uuid": "13ab45fe-cc5f-4ece-b3e1-f681e2194141", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889829, "uuid": "61cabfb4-5cd2-4c20-9f71-cbb21c1643b2", "value": "24576:jyg3JKBGswujSfNb0ZzLbMWWU2DWLrbt94j:jygckImfNb01LzWDD8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644889829, "uuid": "b6310a80-89ab-445f-962f-8dcd704f04df", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644889829, "uuid": "de110b77-65b8-41d9-9915-a7e4170f027d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889829, "uuid": "2cff4c90-9648-4934-8f81-c39ccbcecc08", "value": "30KAWa3eSAssEG6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45c2569-8e97-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644954329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954329, "uuid": "33bed7fc-89de-4bd2-9cea-82f24014df92", "comment": "Malware payload (Formbook)", "value": "a66809bfbade6d73f6a317cc68228d97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954329, "uuid": "1acf2b3e-2527-44b7-ad17-250aae216edd", "comment": "Malware payload (Formbook)", "value": "9a0379b9363f704c49db190841ceb559ebed609d90f795df77ccf3b23765fa5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954329, "uuid": "aa480c87-4e9d-42b7-bd7e-9bf50aee5a24", "comment": "Malware payload (Formbook)", "value": "5bffc326918e3e3e4d9ef00de4794fccb7ce2e9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954329, "uuid": "bb3ff78a-43c2-43b3-97a9-dae494ae6872", "comment": "Malware payload (Formbook)", "value": "fa2167f1a41897938275bf7ad1c21dd971688b6b4102b13c123c06078595cf91a1246f0a515d929b0fbd7ccf61830aef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954329, "uuid": "5c7d0981-cea1-40ad-845b-dc1bb024cb0f", "value": "T1C1352204F773BAB8D1B007F596F0A5B906F85EAD2117CEBBA5B370C61A2734A6470439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954329, "uuid": "54a5663b-ffcb-4973-8642-ce19c919ecc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954329, "uuid": "edd1ca06-5af4-496b-b236-afa99047eb67", "value": "24576:Lg6Sm1IIJptGS6vS3gh2o0zkSBzhZGKlSg2c3dlZYyT66t5GGU:Lg6Sm1IEDGS8IgAoFSBzhZGKB2wqd6tK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644954329, "uuid": "1b45b91d-4c00-436e-9bb1-a1153e569eec", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644954329, "uuid": "aba9cecf-fde2-4c0d-a865-9927fa920163", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954329, "uuid": "293be99e-054b-41a6-9fda-b4ca4299d546", "value": "a66809bfbade6d73f6a317cc68228d97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b87ad9-8e78-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644940970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940970, "uuid": "4989095b-f8fd-4ed0-bb2a-7459211332e8", "comment": "Malware payload", "value": "c8bc7f901b1c154566bc70ce6af6dd5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940970, "uuid": "ac3df76c-93dc-490d-9b85-9a590f040637", "comment": "Malware payload", "value": "9a5244a47aa5903cc6dd7da65c42d4a34128ecde14ec90ef6b5c6760f8f7ad76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940970, "uuid": "d4d2325b-47dd-43cd-aec1-d6c74d82108f", "comment": "Malware payload", "value": "4af3f72fe3a99bdb8cd3e9838046db51a6b03b66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940970, "uuid": "9e4d4c75-20d3-4a7a-87da-5940196c6a82", "comment": "Malware payload", "value": "25a2c69ffdd251d2dfb21aadfb84819dca625dcf6aea2506ccb5badeaef1c2f2f924e27c6a08f582f1dc75d1411decfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940970, "uuid": "301d04c4-96ef-4ad2-ad06-ca2fc960db6f", "value": "T1B823090433878389D468657940F31A3103F6B7EF3273D65B3D9511A92E2A7E18B86BCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940970, "uuid": "2519cee1-3ed6-4451-97c9-6b80a8185bb0", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940970, "uuid": "52726a05-d186-41b7-b9d7-dcf45385bbde", "value": "768:HND9ytoTkDfIvkFXqPLuC2zG3IqEffffAEnnnEEEEEAEEA1nxn1EEEAqEAl8EE1i:HNDoSTCGkFqPqC2QIqEffffAEnnnEEEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644940970, "uuid": "11d751c4-1632-4392-85c8-51b7d4785e02", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644940970, "uuid": "de99a921-ea06-4287-b727-6acc13b6e93d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940970, "uuid": "48ac522d-bf1e-46c0-a9e1-5d3b4a15edd6", "value": "c8bc7f901b1c154566bc70ce6af6dd5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a63317-8e4c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644921819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644921819, "uuid": "46134e55-f23d-4578-9d88-72a83f5526f3", "comment": "Malware payload (AgentTesla)", "value": "c37816f7c8be54f83ffebd2bf9cbfe2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644921819, "uuid": "2cde0f78-58bf-4ea7-af07-506efc4d8d87", "comment": "Malware payload (AgentTesla)", "value": "9b31d6096c3ca19891d4a7a4a3f4e751e9a7c21f7158d29f84869fd817351899", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644921819, "uuid": "26c0ab89-33a6-4891-842d-576b4962e824", "comment": "Malware payload (AgentTesla)", "value": "530cf4b2af37c025b4ea5deafec3caed0f5002c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644921819, "uuid": "d72100f6-898f-4e79-b481-4de36a64d9b2", "comment": "Malware payload (AgentTesla)", "value": "78fcfa827931b63c5062de90dbbbf11880068f54558eab0036737a39be70b8245a01b3de907e86f1779ab044bd9e0842", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644921819, "uuid": "dcf4e3f3-35f6-4225-bda5-246d67092ec2", "value": "T1CEF40200B733769BE8750DF448A252C687F041D9A5ABDBFE4D9236D990D2FC12A704BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644921819, "uuid": "82fc3896-3ca4-42da-bdf4-1b18bab421ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644921819, "uuid": "0c75e8f4-86e0-44de-b5f4-cfed12fc0315", "value": "12288:EXaw06QEDn864vocv7t9BLE74DZd2q1rhn9hfimQm4fA9O/Uecoxwh5k+:p6QED864AsDEEIsln/imQnfF8e6ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644921819, "uuid": "f50cec92-9b59-4e42-b582-96ec8c1096ea", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644921819, "uuid": "23b1502c-da7c-4c83-ab38-4cb3be7c345e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644921819, "uuid": "9ac194d4-5238-433f-91f7-f4ed14e44810", "value": "SZ062117A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e879f11-8e62-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644931368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931368, "uuid": "daae9105-f096-429d-a27f-028df57797f3", "comment": "Malware payload (AgentTesla)", "value": "ac5692e53918f259646878e5cd7b9fb8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931368, "uuid": "20c14c8a-dc84-40b4-8688-20d17c44c9e6", "comment": "Malware payload (AgentTesla)", "value": "9b92b1370297bd06ea4cc16661f7a05ab30fbcc48429b543953419105dde3ab3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931368, "uuid": "c7e437c2-1508-4b48-ac74-5a23f4c06e3a", "comment": "Malware payload (AgentTesla)", "value": "84c7f420217a22274085ebd74aebb072757cd799", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931368, "uuid": "92de988c-a97b-4a50-aba5-cfcc2a94720e", "comment": "Malware payload (AgentTesla)", "value": "c486c1eac317c28b3e625885de08bffe4b89cfa8737a8ee6786eb0fc3df2aea7e673f73c72d492deb84c2edf10c010dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931368, "uuid": "abd2352d-addd-4b91-8723-0e498163413c", "value": "T1B215AD62A4B3C8B0DC2B45BAE42188885F11FD2FB461FEFD4944F0BDE5BA2D5426345B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931368, "uuid": "b071019e-6ba1-4b4f-9f7d-8b1be7654606", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931368, "uuid": "ac1892cf-6114-4782-8050-5286eb0c300f", "value": "12288:hNasVFR9SV0DtnZ+Kk9VtoLtPq5TAebA6oErO/DmoIdmdRU5tG5h5FN/hVD:WsWV4b2IPK0ebXoiWDmOdLjb/hVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931368, "uuid": "c69dc78d-03d3-40e8-824c-e62e8085e2b2", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931368, "uuid": "416c0820-096e-4b0d-b297-dd0a043e92b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931368, "uuid": "8499c49c-55e7-4d8f-9f67-f6811ab68eee", "value": "FINAL_DA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f540c4e-8e1c-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1644901278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901278, "uuid": "5f8bdf4f-98ae-46e6-a927-ffaabb79ecf4", "comment": "Malware payload (DCRat)", "value": "af961b4900f34eb5c1ce70e45e671873", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901278, "uuid": "c82eece6-66ef-4506-835b-23737929f1a3", "comment": "Malware payload (DCRat)", "value": "9c07c93f9a190f10c080d8077dd34db1deb715a4e928509767c9b80a36ce8753", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901278, "uuid": "baff720d-cacc-4879-8251-84bcc8fdbc97", "comment": "Malware payload (DCRat)", "value": "c719741d6c85e99f0e0d6ecf61daf24bf72222c8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901278, "uuid": "9cfac16d-4f30-4d14-af8e-d9dd925d1041", "comment": "Malware payload (DCRat)", "value": "7a58a6a93c89813eb7eb723a4a5d1ec4a88c96c6737feaffc6e812c1ff59a0156328db5d4951f5fbf350c62748b040b1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901278, "uuid": "916a8f75-70d4-453c-8b31-287f4a8250ab", "value": "T1D0556C027A54CA01D06A9637C9EF441443FCAD427A62EB1A7E6F33BD21617AB1D0E5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901278, "uuid": "6c6c912f-c45d-49dc-b779-d15c284fa2ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901278, "uuid": "5bfe1f09-4a35-4cd9-9ac5-52f5e7eaa590", "value": "24576:ZPbhoqqOPpKUTkfCZnH2drfD45Jbg4P9TeNpNpbDSnOEj18U:ZPrkqHIfDqJxTUEPR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644901278, "uuid": "789cd8e3-075f-4f83-b01e-9beadb67c9da", "value": 1324544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644901278, "uuid": "4dc29ad1-f5e8-4e51-810a-8d87ff9c5c2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901278, "uuid": "4a1fc59d-c155-4bcc-b104-915b579c441b", "value": "af961b4900f34eb5c1ce70e45e671873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1289f2d7-8e5c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644928664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928664, "uuid": "ece9ea48-cc64-4a3d-b696-9040f3420009", "comment": "Malware payload (Formbook)", "value": "c9f832b768eec3dc038228f836282d0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928664, "uuid": "3413ba89-e8d5-4e09-8ee0-76fbfc8cde5c", "comment": "Malware payload (Formbook)", "value": "9c4f8b76224562025127d622105346856558b314a57bf42fac2d7bf61de8b22c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928664, "uuid": "06c6ceb0-8fcb-4c50-9a4d-23afac3f98df", "comment": "Malware payload (Formbook)", "value": "d46ec47535c2b3aab71a098d258267769ccf7a6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928664, "uuid": "cef99ea4-1cbd-40c2-92f3-6bc8870dee5d", "comment": "Malware payload (Formbook)", "value": "f59190072222995435731cd1a5510a06973698df12430cb688ec0924d5669a6050e9d56fd21f471c5301dad3eaf1f0a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644928664, "uuid": "e61e64b8-34af-4c21-8324-2be6e7454b22", "value": "T13FF38D32D642C031E2B242F5F26D1B7B883E0D34235561AAE7E119E16EE49E6F56D30F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644928664, "uuid": "0527c169-91a9-4b0e-9d7c-8619647263c1", "value": "3072:WjJFJxjZUpJcTLPA2eMIDHIfbztbM3WNuTXKiLl/VpfQ:WHJccAhMIjuHtbM3WMDKAls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644928664, "uuid": "2ee95a74-ce76-48bc-afd3-ec98def764e1", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644928664, "uuid": "5bd64de8-a678-4fe1-b814-0f5e6a8cad68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644928664, "uuid": "08e23cd5-8b49-4e6a-a3db-f689659b4e6d", "value": "n.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8862b530-8e97-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644954202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954202, "uuid": "39022066-a8a1-4e79-9ff3-6e25b935fb33", "comment": "Malware payload (Formbook)", "value": "bc0ed6a045b6597c7851218087341d4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954202, "uuid": "680fd5cd-cc39-40dd-a483-b47a2a365840", "comment": "Malware payload (Formbook)", "value": "9e84d9e04413f40cb77c68b0e0f107368c817cfdaf9708fb4aa995c964eeb223", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954202, "uuid": "bfe03a0f-dd03-4f60-9e96-4c3558b1e934", "comment": "Malware payload (Formbook)", "value": "ad2d54a2f305e2214a1bc388845af663d6cc4347", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954202, "uuid": "33a2137d-c8fc-4a9f-8abe-8a88aed4e816", "comment": "Malware payload (Formbook)", "value": "bba8b383ea3690e9e6617330677da00c15f5d0482604aca0dd653c64d5034588c7ac9a45c7f9f7c46d98057137e8699a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954202, "uuid": "d00c3036-a194-4669-93e0-3ad591e80389", "value": "T1B705021BB72BEB74C565127500EF81B413F1AA985173CF7B6CBA32DC09523A10EB953A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954202, "uuid": "a1702ed8-9c05-46fd-8158-9a5202eff5d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954202, "uuid": "4a948ff0-67ec-4554-a05b-c57c82280785", "value": "24576:CstwIS+zTgZaY3PdZcv8r+6n2RSQZFgDt/fw:9twMz4PdZcMD2RS/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644954202, "uuid": "fafac0a1-5af5-452b-9b61-851a9c3ec698", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644954202, "uuid": "abf4d22f-6b6c-43a1-b429-093abcf650d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954202, "uuid": "3cc02bf8-5579-4e2a-86cc-097dccd043e9", "value": "bc0ed6a045b6597c7851218087341d4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471a44f9-8e38-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644913290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644913290, "uuid": "4423c976-7367-4d18-8be9-e440409adc97", "comment": "Malware payload (Formbook)", "value": "573bc080de2db9863ad38e52cbe9bf24", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644913290, "uuid": "5522af06-aaf3-4e1c-9ac5-e7feea5a51b1", "comment": "Malware payload (Formbook)", "value": "9f2c631a5d4d65ae73dc47e3ef545fa665f258cec417a1472e42353db6c1675d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644913290, "uuid": "a543e871-b7a7-4ed8-a3ef-b27c0a2a1a00", "comment": "Malware payload (Formbook)", "value": "07df209ba3cba23e904a3897216a0f36922ebfb5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644913290, "uuid": "93ef60ea-6c43-4036-9f81-72e54610bbbb", "comment": "Malware payload (Formbook)", "value": "68d18cbf19dade9cfe9fc4734a8f07bd9d04959e914a563e227b81bc153430786db90bb8d38084ee50ec3f465e78b8ba", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644913290, "uuid": "24122e8b-f634-4ee5-b3f6-a7e493a69c84", "value": "T180A4232D117D2E832A887CD7EF53E8C252BDB5246065FD24E31BE5B36CB5586CCA3026", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644913290, "uuid": "c5e0ac08-0786-4077-9087-c7bf8af25650", "value": "12288:Ztj+Iq0JGGrOpNp3355tA1WbHNWxOC7xAVGJUzQ9uYKW:Ztj+0JDOzPLAiNWgC+VGJBsFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644913290, "uuid": "686b3942-4a15-46ae-ac55-cce5da09e821", "value": 456047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644913290, "uuid": "1e9bdef3-3e28-46b3-9160-773070c9ca52", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644913290, "uuid": "edc697a5-2b2a-4b06-90e5-66fb7d7f3688", "value": "1644905147.Vfc11Ib6c018M744357.dynamene_Lista e Blerjeve.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33e9abd-8e81-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644944905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944905, "uuid": "f583204a-b9d0-429a-aa9e-d80bd0a9c7ce", "comment": "Malware payload", "value": "23911603c7decf5ec309218d874f3ca6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944905, "uuid": "0b7515c8-1354-4b6c-b63e-33325e0d9ac4", "comment": "Malware payload", "value": "9f71561a220383f7f54ce808974913db4271bc6b924aba57c1c8c72af610ebc1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944905, "uuid": "f9a78c35-e158-43bd-9596-145be00aea5f", "comment": "Malware payload", "value": "1d2525c03b630691299f91f5d624784f0b18bf1d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644944905, "uuid": "d20d4ae4-1c89-43c8-a15c-f111f2d1d621", "comment": "Malware payload", "value": "2fe22899c956228edfbed8b8f1862a81a2a73ddab1745125598f2694370e11c8f6d35d60d51eaf4b9ffcf696d22f45b0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944905, "uuid": "40038719-af4c-44fb-8925-38cf0237261b", "value": "T1DFE42342A9C03DC8B0A8AE1B2E4E550D919AFFCAA568F78711C497A6105D35C6FF333D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944905, "uuid": "fd384643-447f-44ca-9409-7aa5e1d3a4e2", "value": "12288:G1Hx+tbbZpxMj3urJSwvhgUXrgt6gmVB0xuP+GDlZN6O1qyQj7d8ge:G1HxKBpxMjuBd5QUP+GDxDQjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644944905, "uuid": "1bf747cb-e2de-4195-8cc7-68f6ca53c5b0", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644944905, "uuid": "7fffa0c4-8aca-4185-9297-606abbcde2d9", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644944905, "uuid": "6e485380-8038-43c9-8331-37b2c96494e6", "value": "9f71561a220383f7f54ce808974913db4271bc6b924aba57c1c8c72af610ebc1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548e7261-8e3c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644915030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915030, "uuid": "074773cd-c81c-42a1-90c9-55bd96e2970f", "comment": "Malware payload (Loki)", "value": "a449dc46f0b65dc8f13e3d1c2b3b5da4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915030, "uuid": "a3e51063-79d2-45ae-ba6a-1b06321dbccc", "comment": "Malware payload (Loki)", "value": "9fc1caace18b3a02fca3d4a7e03113ee3ff8a822aaf6b28ecd16ad80f520671b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915030, "uuid": "c90cbcc2-3883-4c63-bf61-b6e2dbf277f1", "comment": "Malware payload (Loki)", "value": "d84966ccf2cfdc6963edc0d72764e7007e383c3c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915030, "uuid": "38846c2b-f438-4ed9-9df6-a1c6fe2b44d4", "comment": "Malware payload (Loki)", "value": "aff419026c1c8305bc96addef2d7127cce6343ea97789923027d6fb2a3fd92f13a1e8d8228833d7e6404ae2860668a13", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915030, "uuid": "c5a6ba27-e6bb-4ccb-990f-28f939d2e4aa", "value": "T1861412E477BC2665F206A67F4102817D28BAAC1AB31CE4545D2E3226DD3F88844D7DFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915030, "uuid": "71c390bc-5884-4073-ae97-62218a1042bf", "value": "3072:cXSjUtFQNv+buNAHey/A/7N2vH4ccyS2+ZOTVIkFRVVHKU3bQqoz07hTZIcp7Rdk:2FqWbqAHeYuN3yb+WFRVlVbQZzuTjzdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644915030, "uuid": "9bd10123-b94c-4c5e-8148-14d71ec4b21e", "value": 191624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644915030, "uuid": "d338bb5c-12e0-4366-960d-6355b45cdef4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915030, "uuid": "1769196d-ede9-476e-a4a9-5af4f3b6f1d8", "value": "ORDER CONFIRMATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402a0e7e-8e0a-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1644893521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893521, "uuid": "5c9ca47b-a2e2-42c0-8e6c-3164ee086180", "comment": "Malware payload (Amadey)", "value": "9f94aa07beeb6406806d88a2011cbdc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893521, "uuid": "a96df27f-520b-41dd-a9ae-e325099b1afe", "comment": "Malware payload (Amadey)", "value": "9fe981e335659cb047d63d55f87f6a8070aeb6352e6b69e0cf2ab646613c4b82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893521, "uuid": "a717a287-8e10-4746-8243-10afabe6109d", "comment": "Malware payload (Amadey)", "value": "33a07c80bae650b5b84b6bde2b582c29642fd1d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893521, "uuid": "c6a06107-42ce-4836-a871-6b6838145990", "comment": "Malware payload (Amadey)", "value": "78245d432753c60e6228a69906ec5d3fa07ab22f7b97034e33e50798efd5a1ccfe8237139ebdb78e304f4c6d7554a6f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893521, "uuid": "cb9e6200-b948-484d-b520-8cbb21ae9720", "value": "T17A659E01F101A136F8B340BBCEFE552DD658AA61130954E7B3D85A4F8BA2EF27932257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893521, "uuid": "fce7a186-ecc1-46d5-99f3-4d49a9b4218e", "value": "ad3a151ad8b2d4eb1bc6bc14ded2be3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893521, "uuid": "ba9747b0-f738-4ef4-9d8f-86c95300719b", "value": "24576:UxYJPFYCon4U+qbgH15zBJAfv7jDPD/fYjOs2otTYLk:ageCo4U1bgHnAfv7XPDnYis2gTYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644893521, "uuid": "d7df0b62-efe7-4794-a793-17d31cb94932", "value": 1464256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644893521, "uuid": "1e3e1d1a-63c4-4e20-8d2d-73d3e7c9ec62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893521, "uuid": "9a4cf37c-198e-4a3c-86d2-007b0dc033b9", "value": "9f94aa07beeb6406806d88a2011cbdc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9e1332-8e57-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644926669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926669, "uuid": "5845a5d1-9a15-4a66-b271-e8ebb761b3ff", "comment": "Malware payload (Formbook)", "value": "cd1801462694799d05d2eca33097b1bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926669, "uuid": "099c4c54-4a73-422d-a08d-0e0cd2ae442b", "comment": "Malware payload (Formbook)", "value": "a0498dad46971848cf7b2bde020f6ac1ce8bd8508aaf920a2616063098acd6d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926669, "uuid": "fc2522c5-8002-4d0e-8827-bb3059644ba6", "comment": "Malware payload (Formbook)", "value": "71934c5b58caabe508d052323720a0c74c57d6fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926669, "uuid": "fe92c40f-7f40-4955-997e-63acd7e13d71", "comment": "Malware payload (Formbook)", "value": "0b39f6aa5d1d10da85789286e3f53b75d3ea447f2b7109f3bdbf0bb02ac10432434ecab0b8401fa83369bcdee4ad39cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926669, "uuid": "7b71413b-6d48-4d49-bcb6-05ba4b469a42", "value": "T13B73A7C6FA0095B4EC2A97712A36DD3116037C7E95B42A2C3DCE3E7B3EBB4629411853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926669, "uuid": "eab1456e-276c-442a-8612-87d91ae3bf2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926669, "uuid": "d1a4d25a-fcd3-4392-91e3-a0ee8995a6dc", "value": "384:dqH/YeMBxuA3J7W0UZilZq4KCm+ApH1ThO/FZ:dqfYEI76ZilZq4O+wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644926669, "uuid": "6376e6b0-22e6-43dd-a2f6-0035fbd633c6", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644926669, "uuid": "3283adc9-9af7-43f2-ab0d-5a7e5c5afc8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926669, "uuid": "52768976-c440-48b4-9095-1c77745567e5", "value": "Scan_PO021522.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc2630a-8ea5-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1644960061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644960061, "uuid": "f2e49412-3648-46fd-9ba0-e32381006048", "comment": "Malware payload (njrat)", "value": "b46c782c58c825206c0641b51cf43599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644960061, "uuid": "f696d9bc-8a60-4dd7-9658-a4968535676d", "comment": "Malware payload (njrat)", "value": "a0ffdf30527a07da8149e4c77d77a128b4ad1c5db544daad46a55756684a54dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644960061, "uuid": "74615d54-e0f9-418b-8230-1df70ce4aa02", "comment": "Malware payload (njrat)", "value": "8e9463442b836348f2cef9f5b8e4ac4d2ebc7fbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644960061, "uuid": "f699c6ea-3e35-44b3-8cb9-da87df96e41d", "comment": "Malware payload (njrat)", "value": "1131a58d52d88ab1bb4089cd21af402a6c617d3931016396aacb42b7551a56f7f2c41c47e87c27bd3bf9a25d8a74e572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644960061, "uuid": "45734a86-6646-4b5c-a880-b5f38967a6e0", "value": "T1B27733AB82C008B2FC5246725B9238F96D1CEC9C5EB6D55319E5B7FD70301C44B6EA8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644960061, "uuid": "7f5445e9-1f12-4067-821c-44772045b4c0", "value": "710b4c559675f6d65697110d8f6c48dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644960061, "uuid": "481e9820-eda3-43fd-8dfc-0d605774cf35", "value": "786432:jBenld4nCtdPlBe/H8ZWu3d5Mv8W428C633I:jBil0CSkZH3/RW4g634", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644960061, "uuid": "f4d47b59-6997-47c6-822c-4422b7ae1097", "value": 34637365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644960061, "uuid": "f56f0b2f-a180-445d-9c03-1bee335457bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644960061, "uuid": "13817efc-589d-481f-888f-3a489574a5df", "value": "b46c782c58c825206c0641b51cf43599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f223ad-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644931971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931971, "uuid": "8349eb24-bf47-4a0b-9faf-fcab4584f79d", "comment": "Malware payload", "value": "fdad82c355225674f6232eda507711a2", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931971, "uuid": "024f7fea-98fe-42fb-8c81-9f99377c69fd", "comment": "Malware payload", "value": "a1a5ee96bdc32b95041af9bafb2327888c32908150c2f82d926e68945f1c6a72", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931971, "uuid": "490dd5e8-602a-450b-bac3-abf836ceeaaa", "comment": "Malware payload", "value": "b190bfbb10439c912118b229fe1d4f68618429f1", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931971, "uuid": "58948860-f5f4-43da-9c77-9339b52598e7", "comment": "Malware payload", "value": "7c35de7ea9e01f768b04a4fc54aab98f479c5642466bda3af62a6b975a540edace170ba0e8b4a2e06e20fc95d9bb6253", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931971, "uuid": "6d8518f6-3870-4db5-9a3d-2c6d45bce9fd", "value": "T1E5130AB30213FD8F56220E45D40C2115DC9DE8A732D999ACBF4898E98FE9118DDF8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931971, "uuid": "e3ea24a4-ffea-48c6-85c3-4d66783ac7a2", "value": "768:kGZxVu+TwKa4Wfbm9D2kfgnt/XpXc3ltT:kGZ3xTw3Zfy9ikfgt/XK3bT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931971, "uuid": "c89c84d5-8278-4c89-b0dc-1494126a7ed9", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931971, "uuid": "7aa11ba5-9b4a-41b8-8d37-c71316511bef", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931971, "uuid": "9d4489f0-066b-453e-a08b-b42e989d7056", "value": "bart.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1748db69-8e73-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644938550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644938550, "uuid": "17149c4f-a17c-4ada-b3b1-46ec02f8045e", "comment": "Malware payload", "value": "c90dc06c52beb8667106b7e37529f055", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644938550, "uuid": "87986b9c-4cae-4bb4-b939-0a0fa14eea3f", "comment": "Malware payload", "value": "a1c4b8343b6701c8ff53a20593f687c2e3eb84ef520d2070506c49014db26618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644938550, "uuid": "86d219db-4ac8-4484-84ed-d28276cbeae1", "comment": "Malware payload", "value": "8cf58a26a54a986bb85fd0216b59b16d114a9e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644938550, "uuid": "2e25612a-6c80-4d82-b4bc-4e6a874f2c40", "comment": "Malware payload", "value": "b00a4b969a2993120258f47f20ca5ec36beb2e9a04b1d561ee59c7ab4c403bb351e403991ebb3f8d0e4f80a22d7eecad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644938550, "uuid": "dc60f57d-735e-437f-a84d-0b02c4f2676d", "value": "T187F4D3A831A3F5AECC17C4B69A545CA8AE50E86B730BDEF39013D5BDD94C5968F010B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644938550, "uuid": "8bae3696-bb55-47c6-afc0-f847f169ba00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644938550, "uuid": "bbd9aafe-4a67-40fc-9a1c-eb9db0c1b0f6", "value": "12288:JmCb/kQWOv+XvKi/COKMD3Hh36kLcYAs8bny8KhwT31izS+q7v2WboAasV:Jl64li/Ts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644938550, "uuid": "fec14e58-3ab1-4615-a0d0-50303faa8307", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644938550, "uuid": "0d7e9e96-f340-40c3-8218-75855004ab3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644938550, "uuid": "90d40792-30fe-410f-bc60-169c36536d04", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de54fefb-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932012, "uuid": "35d985af-7cad-401d-aeef-a744a8f9f509", "comment": "Malware payload", "value": "bd34c2109b341c46ed48276a94412639", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932012, "uuid": "3f60c26b-2dc2-421a-8c3c-4eed0a8d758f", "comment": "Malware payload", "value": "a2c6324d7d7b8c9ec60af7964a3b119492eca05b163dce046812f618dba8862f", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932012, "uuid": "5030f6d0-6a9d-4e2d-975c-068688c65f04", "comment": "Malware payload", "value": "a38ee4f1ef01c490472356a73676808e1b22363a", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932012, "uuid": "2ff132f9-0624-47e6-b15b-16d92c596726", "comment": "Malware payload", "value": "7894014620373d975e332e252ed46923840bc8ae1d7088de0a6861056b42d58938a2b0becbb51980210c89de8d0c90fc", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932012, "uuid": "2adee5d2-c24a-4792-8b0c-85f41f254796", "value": "T17313F9B30613FECF17220E41D00C3115DC99ACA72198A9ACFB4899E58AE9118DDF8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932012, "uuid": "aa288836-1cd4-4d7b-8aa4-c36674f175cd", "value": "768:YGZ6xSsYNfS++m8YJsjoYIobm9d2kfgnt/XpXc38:YGgYVf7+m8YJUIoy9Ukfgt/XK38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932012, "uuid": "823f6b1f-ba65-452b-bc0a-2e05122e9403", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932012, "uuid": "438705f5-b7cc-49ff-b0ea-7c430e8409e5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932012, "uuid": "4d70033c-b275-421a-a7ae-acbdefb29073", "value": "jak.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f1573a-8e27-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644905980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905980, "uuid": "e7b09237-fa75-40b5-8d3c-7c5114f6a2cc", "comment": "Malware payload", "value": "b786a3b14d6d9ffd7b29a0bfa8b16568", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905980, "uuid": "58f23c61-d199-49df-9c11-58e50b007197", "comment": "Malware payload", "value": "a2f34ddc895bd9b672d488f687495333351e75d214f16569e3ff5a4846dc3da6", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905980, "uuid": "f1b8b0f0-1faf-40b1-9797-16a08fbc9d93", "comment": "Malware payload", "value": "40908cbf737b828d30c5eea428e5d6819c16e4b3", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905980, "uuid": "c4df47ab-cd51-4578-ad98-7252ee5f3b5d", "comment": "Malware payload", "value": "7dcfe5b9c4e9fac881d458de15edfc7277359a3122bd40eb25d935bd27a0390b5eddfaa50fb547f6481d11d36002677a", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905980, "uuid": "9cb40189-b34e-4943-ab12-4ed9f6dad6e5", "value": "T13DD209730E43FCE42FAA1C46E64A64D50D8F3D5B93789DA8FBC9089550D5222DF6E828", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905980, "uuid": "5d19b217-51de-4fbd-9912-a2e0b6869afd", "value": "768:tsldJFztWpd8GQwAV5ZWdj8Wa4Lpx6ywvZ5bAWELka:tslHFzopI5EdjcI6ywEWoka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644905980, "uuid": "cbf11faa-97cb-4a60-b571-238741221fb1", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644905980, "uuid": "3a64a90d-cc6d-452f-b73c-7a347451a5c9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905980, "uuid": "ade93061-8afa-42ae-922b-1b5ea62d5c1d", "value": "f3dll (2).txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008d94c2-8e6e-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644936364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936364, "uuid": "a40bd7e7-18e0-4498-b745-21beaa36e578", "comment": "Malware payload (NanoCore)", "value": "86d1d959afcacafcf0c1250e0b603278", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936364, "uuid": "ce18e8fc-d415-4d0b-ab63-88af084ffe41", "comment": "Malware payload (NanoCore)", "value": "a30622ef748dbcae11f6a12cf32c096527e55364b32ae546ea1b729c121128ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936364, "uuid": "82eb0d50-1ad9-41a0-a749-2b5dd45e1b1d", "comment": "Malware payload (NanoCore)", "value": "65b76cc64392b9b26dadd58bfe2d8f73d7242819", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936364, "uuid": "9fdd0f7c-730d-4918-94b5-a8d8866e18d8", "comment": "Malware payload (NanoCore)", "value": "8a42da3290adb03db6de784b206b32870c01d294422f875d317bb064c1e61119d05904fe9afb73a511c6286dc20f4add", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936364, "uuid": "f35d4efb-4b9e-46f8-a896-b36504b90562", "value": "T107F4020436B73B80C1370BFA49E595924BB6765E5127E63DCD9230CD1D62BC08A7EA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936364, "uuid": "64c3d1e7-9996-4f40-aab0-07cd54295b26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936364, "uuid": "ce67b270-046c-4eb1-9f7a-bc28b9302bfd", "value": "12288:fsi5k+zQyKVovVc0o+Plc8Awc8OeQMyqs2KfjoGemPA6o9U:Pa3yKVo9zAwFOev2bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644936364, "uuid": "42b96e66-d769-4f91-9481-ef9f6f23d628", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644936364, "uuid": "ecccc200-878f-4598-abf3-f85c25b99422", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936364, "uuid": "1f36e071-8d40-4f2a-8b5b-7c605f2720a6", "value": "List with Specification-DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8429b1c-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644931948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931948, "uuid": "b4c4d0e0-d912-4b65-b880-b8fbecca6db6", "comment": "Malware payload", "value": "524e781cc572c2571d94a02be3049cc8", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931948, "uuid": "297690ae-3b72-47d8-9607-4292cc9ea975", "comment": "Malware payload", "value": "a3add463db8647e4fb8dfe9ce5e4bda8bac125a35c9b1c36701b862bc332d0d3", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931948, "uuid": "444ecd8b-e1f4-42b3-b484-eff46c43d6d7", "comment": "Malware payload", "value": "4841df474d23d070595d0ec1b71fb6b25fe7d9f0", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931948, "uuid": "5bca2506-5c83-4637-aecb-097a58051248", "comment": "Malware payload", "value": "87bd2d8306f70608a39e28bdcba1165127c240f9c5983858774639f7ac2b267f508afff4d36240d28d3347276da8bc96", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931948, "uuid": "2ea2ab63-7392-4c5a-acad-80d09551feef", "value": "T14A1319730223FDCF1A220E45D50C2111DC9DE8B732D999ACBF4898E99FE5118DDA8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931948, "uuid": "f08cd9c5-6d0a-4960-bb84-47cc17a533ac", "value": "768:kGOxSL+TwKa4Wqbmpv2kfgnt/XpXc3Ptf:kG2Tw3Zqypukfgt/XK3Vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931948, "uuid": "39bf2c4e-33ef-4a65-89e3-3fa473b38000", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931948, "uuid": "bc90a5b2-ad91-42c9-acf5-f853c069ed51", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931948, "uuid": "39604d81-c1fd-4037-a62b-72999e22c22f", "value": "ali.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6dff75e-8e1d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644901854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901854, "uuid": "7ff9fb2e-d4ab-4d52-ac8a-380195240d8b", "comment": "Malware payload (Heodo)", "value": "1c5d1a444084940e1b7edee0403c2c1a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901854, "uuid": "49b3998c-3295-4a41-b548-fe1ad0ec359e", "comment": "Malware payload (Heodo)", "value": "a4548e6c31258ca20093c2c519f8b454e9f850ec68930ce4b702d55c2dfaa8ff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901854, "uuid": "8f064f67-76c6-4918-afda-eb90f1e5b206", "comment": "Malware payload (Heodo)", "value": "8f71ad4e53950d33c225f5729989225ee08cf1c8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901854, "uuid": "376b7c90-e98a-4427-9f70-2d9e8f828fee", "comment": "Malware payload (Heodo)", "value": "2f3f2a983bd5dd220ab71b3a64a4dc2681b62d555d9fa1715026ece9e6ad89b8833368f94de91eff56fc93b46756e210", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901854, "uuid": "af9170aa-5038-4d40-904a-4884c2d6378d", "value": "T15905CF80EE8984B0F7432A3600B691654FEE690507E1DCCFDF88F9667F25CC196794AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901854, "uuid": "ea37232b-9466-4644-9c1f-bd40d41e39e9", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901854, "uuid": "0a3d34f6-4ee9-48fb-8bbc-917ac6c69fee", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTvf:wfv1GVFF+765nFvFf6dlzzSzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644901854, "uuid": "8bc4625e-d99c-49a9-b9fe-9573960239cb", "value": 852396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644901854, "uuid": "0c4d13cb-2433-4fc0-a924-c23bd845f7f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901854, "uuid": "9121536f-de7e-4776-8598-554cffdccdd7", "value": "emotet_exe_e5_a4548e6c31258ca20093c2c519f8b454e9f850ec68930ce4b702d55c2dfaa8ff_2022-02-15__051050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8bcb0fc-8e14-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1644898045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644898045, "uuid": "a2be7100-36fb-4c67-aae6-3acb650db5b9", "comment": "Malware payload (RemcosRAT)", "value": "341c85f2161dffac1cc88119fdff3f50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644898045, "uuid": "a718e5a9-a7f9-43e2-a7bc-673ead6a3815", "comment": "Malware payload (RemcosRAT)", "value": "a46649d0ef6a07a530f6082f91a102f127b235b8cb7bb1bd26f104bffcbad930", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644898045, "uuid": "b8be1219-24de-4db7-aec7-209d26d6c0d4", "comment": "Malware payload (RemcosRAT)", "value": "3f59ad8a550544410b539ecb2c47bcd9f2e5cc63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644898045, "uuid": "576f65ab-cc3d-4e52-b475-5c5174edcdd8", "comment": "Malware payload (RemcosRAT)", "value": "001f01e3fe9deb2756cef2958383e795723fd567dc5c2fdfaf1fc544631758785009eb2f6053f2e5bf914299b0751a49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644898045, "uuid": "7d2aa501-73bc-4abf-890d-cc6d4e6eadb3", "value": "T127A4BE11BAD2C072D97251340D29FB35DEB8BD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644898045, "uuid": "569d6ee8-9399-403b-b327-89a23a109095", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644898045, "uuid": "b83b1d8d-87c7-4793-ad0c-7ec8e321f042", "value": "6144:hOFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcU6yg:hOFtiNBuFgawDB4NOmuwsfZP5yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644898045, "uuid": "4979bf0b-7681-488b-8a74-8bbea103e516", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644898045, "uuid": "9b904e86-3628-4757-b125-db819a429de3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644898045, "uuid": "fbc6aa9e-76ab-4494-9122-d505d2d57314", "value": "341c85f2161dffac1cc88119fdff3f50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adc571d-8e78-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644940918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940918, "uuid": "b67f72c8-4d9d-4c9a-a76f-4ef1469f46fe", "comment": "Malware payload (Formbook)", "value": "802065ade587ca9b2f9627bb1c1b63e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940918, "uuid": "8cf79779-fa20-47d5-a276-4283ea62ae23", "comment": "Malware payload (Formbook)", "value": "a49a78b4925decc0dc56f7d6b51a49b17d028016ebd820de985c6982957eeac9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940918, "uuid": "4351ded3-20d5-4148-a01a-52d1ae8947bc", "comment": "Malware payload (Formbook)", "value": "5e2182dba4444a5161530f5f74e878d2d32b84a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940918, "uuid": "813af449-6028-460b-bc28-49b3a64244d3", "comment": "Malware payload (Formbook)", "value": "34011610f7cad70e35db69875be46a35020de589ec639a205063e1bbe51075623289314b130d9f616c1a4f316965a19a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940918, "uuid": "f491e57c-6709-428e-9bcf-04b81945a398", "value": "T1D1F40214B7B73B51C0331BFA98A5C5861B75B55E1526E23DCE8230CC0C27B918E7AA7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940918, "uuid": "e6a264a7-7582-4c54-ba1b-bc4a1eb74c2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940918, "uuid": "3ee34f4e-eee0-4380-8d47-2561d3ccd845", "value": "12288:9P5k+XiURfG3YVrbFnip1AdKYG6pUZrJLjFdBH5uSyZ2uVQ2mPNeV:VaQ9Y6bFn01AdK0UZrT5u5Z2uVQ2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644940918, "uuid": "ab3df430-d86f-4917-bcbb-c38ac475a188", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644940918, "uuid": "6a74a7eb-0bd8-488b-ae3f-82a00b0dc786", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940918, "uuid": "2c3a517c-12a2-4747-a238-f669bd3a5f75", "value": "Yeni Sat?nalma Sifari?i.Pfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e3eb79-8e04-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644890899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890899, "uuid": "fab28bfe-27a3-4498-8963-2c9201df374d", "comment": "Malware payload", "value": "266a69c83925f591fb5896a16228aafb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890899, "uuid": "1c421c04-55c9-4436-b6ad-545da0125178", "comment": "Malware payload", "value": "a552d919a1730b7460d40f2ebe3f651b24fd79ff975e75a7707a0c7e11dea5c8", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890899, "uuid": "f343a8aa-344f-4f24-a33a-5b7140c9430d", "comment": "Malware payload", "value": "31630ad87766454e9a14e4984cc692007d62ef05", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890899, "uuid": "fffe22aa-72be-4da4-995a-10832b0df66c", "comment": "Malware payload", "value": "30f00b0adef60c59eaa0df9c375adf59ee3b384c8f5754c6f9a44db1d491909628b007c27f583e5a5d23aad0a599847e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890899, "uuid": "407c388b-0689-4ccb-a65c-372fb5ba7fe6", "value": "T1B9D56B26B284763EC46F1A3A4537A3589D3BA771AA128D5B17F44C8CCF365802B3F647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890899, "uuid": "d44f372d-8e90-401a-b7cc-e3bde20f6cd9", "value": "49152:fTEB4F4zxBwVmdxYSrw3JQpklB3gBRTTMjrUOYGEA:YB4F4zqmwlQMjIOYBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644890899, "uuid": "68c3cb81-a248-4b7d-bc25-e435156da981", "value": 2960384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644890899, "uuid": "bd7b895b-4ebf-4208-a730-8377829d6348", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890899, "uuid": "48d4a202-15b1-4400-be85-b4aa39272a5c", "value": "Archivnow.FactEndesID1502.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb0db9f-8e30-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1644909974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909974, "uuid": "9779fbdb-7c36-4387-bea0-ba0315db18ff", "comment": "Malware payload (njrat)", "value": "ae68f525110174d36fd0a78f728ec1ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909974, "uuid": "34c82525-2191-4cde-b902-646851fc012e", "comment": "Malware payload (njrat)", "value": "a5e7d573e91033eb9bc300186f754394a91a114c73a6661d31dfb8225209030d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909974, "uuid": "ee19abfd-afd2-4308-a17c-282db5bc836a", "comment": "Malware payload (njrat)", "value": "a1e118f23dfc15269400bd059d5960caf01a6ebe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909974, "uuid": "c93db951-e467-48ee-8894-b6fc18070672", "comment": "Malware payload (njrat)", "value": "6e044a5ef1314150a831592504722f9e4cdc19b8c59677930d5323ae455bb0f3d85aa8c4c316f7b69e9af75e658a3412", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909974, "uuid": "7966d268-e8f1-4628-ad0c-efea88dd9324", "value": "T1A2647C41F341831AE49500BAC0FB0B344BE5DEB7173691C7FF89B6891E612E2AE559CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909974, "uuid": "27442db3-fb7a-4cc0-ad36-30fb36947688", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909974, "uuid": "3cef05d9-9dfa-4b1a-b04b-5b3389392809", "value": "6144:yMNCha6O+chMWnhE/deKaG6+9DzZzNIT9OsUp9kBbCSCH/:yMNCha6O+EMcKFJ6+93ZuokBWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644909974, "uuid": "beb91f34-92b6-495c-bd5b-004eb020efb4", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644909974, "uuid": "f434f5d0-a9d3-4430-9d86-8f733f57479a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909974, "uuid": "e0243405-f851-426d-8884-9a40562eadc5", "value": "ae68f525110174d36fd0a78f728ec1ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bde48f9-8e75-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1644939443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644939443, "uuid": "4730f808-4197-4dc1-83dc-424c53206c1c", "comment": "Malware payload (Gozi)", "value": "634ba554b91d0d6323f9372de126bc16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644939443, "uuid": "dc768797-f4d3-4b7a-b358-11e3ce5c1738", "comment": "Malware payload (Gozi)", "value": "a64557709ed6caf4e2397ee89cddf139b5319f34d14a740a58958db9773a852e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644939443, "uuid": "d773e2f5-f7b5-489e-b248-1047fd635fda", "comment": "Malware payload (Gozi)", "value": "7755e7ac7dd6c0862ca7536bcf2ddf07bfa2503f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644939443, "uuid": "5ff69ffa-d35a-4639-80bd-64883fea809b", "comment": "Malware payload (Gozi)", "value": "cd990188c3383ec4da321d4c20daf9e00220e1e5ab114a0073f524f29cdacdb74ecd192e91d9d243e9585f88f33af905", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644939443, "uuid": "05f64206-c6dd-4a90-b0e2-c38e91d56fd6", "value": "T100346D6AA2E50A96FD7BD6B9CD53C227D7F238491B64C31F13B0CA965F47321B218342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644939443, "uuid": "a0a98e31-e03f-4d06-a875-55c4fc812c39", "value": "6144:RyihnaKbEFhck6xW3SJ5gtS3z9pjFAl2kO4anpf:Ryih1EF2k6S/SD9pyl2jnpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644939443, "uuid": "e650f508-ee25-4167-ba9e-f4f24335ab88", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644939443, "uuid": "bcc48d25-d59a-4205-a097-c847aa70533b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644939443, "uuid": "bc734b54-2cc6-4558-9861-07540ac692eb", "value": "237ddc60000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a471fb7-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644953131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953131, "uuid": "f6838332-3b7e-4c44-a7d2-fa451798abf9", "comment": "Malware payload (AgentTesla)", "value": "f2db2c61ac1a8a00c0efaf3361ae8cb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953131, "uuid": "8dc51068-fe73-4d15-89a7-120294acb62e", "comment": "Malware payload (AgentTesla)", "value": "a787c254e2dd230db7fbdd451fd7415e6419b28317109e1731055734b267e725", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953131, "uuid": "c9dd2e3a-8baf-4979-a62d-40d1210ebdbf", "comment": "Malware payload (AgentTesla)", "value": "a69efbe2f621494234530e55fb03cc15a55c7dfa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953131, "uuid": "3ff8a6d7-1912-4df4-b4ee-d5adde2a94c4", "comment": "Malware payload (AgentTesla)", "value": "76b53662772847e316760985500b1ab8b492268279e62de3fd7d1cb54d6d1513326d3e9bb91a5123f9e4f6ccb2e6f030", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953131, "uuid": "35d8c997-3219-432d-90b6-59f3c82671a1", "value": "T1B205020BBB2BEB38C47816B500DFA07913B59E9D0173DF7B6CBA72A809123521DB5179", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953131, "uuid": "fb342141-22f7-495d-92cc-5bb1a519c482", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953131, "uuid": "d8542a3b-101d-42da-8c62-067457dc2266", "value": "24576:79VLNemK/yaWxwJwEnyv03enSOAXtCguIW5:7HL8mKWxw+eB3r77ud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953131, "uuid": "be3b700f-15cc-4b16-972c-e5e24573c4bd", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953131, "uuid": "b919dc36-ed7b-4007-9270-985f4fe5cbb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953131, "uuid": "216a62a8-600e-4aef-9bae-c1fc772c4d55", "value": "DHL Express Shipping DOCX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883e1d03-8e03-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644890636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890636, "uuid": "509a2914-9a64-4b05-aa94-11c97dc0dcdd", "comment": "Malware payload", "value": "247fa370920a748e856535eabe8f4083", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890636, "uuid": "43afc27b-8881-4d8e-96f8-971d0d94daec", "comment": "Malware payload", "value": "a8055f50ec6818f43e61200654fa29c6ce37e3ea631924a16e2ce0f9baadbbc3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890636, "uuid": "df525ded-66b4-457d-9ffb-0af4c654229a", "comment": "Malware payload", "value": "8386e615ee189ff4b65e19e9953b91b7d1aa41ce", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890636, "uuid": "27392e07-2426-4626-a357-dd8c90a08abb", "comment": "Malware payload", "value": "7a0f1fb4ea3b8b644beea0474ffe1e084dcc8b4cb129a36449a0aaf6ab5a881cd287031246b94af52c80d4f060517bb5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890636, "uuid": "c5beb79d-82fe-4d9d-a830-405a5dcf0f11", "value": "T1AD44AEE0674099D2EB9E9797D1596D9C2236317FAECA20CC4046FFDA2B773418A0DCC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890636, "uuid": "b9007201-d054-4ee2-b224-e29f8be923d4", "value": "3072:vwn9uOZCpLqE2Mpxvznskox9ogTVitXZ6kKJvw4DUEHSk+GB:vITZCuE2ytTPoxqPP6kMvwqPf+GB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644890636, "uuid": "777245f8-a738-443f-a585-7eabda3d85f5", "value": 261238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644890636, "uuid": "b366ff4c-f4d6-45d7-8761-84af32fdf7d5", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890636, "uuid": "ff45b20d-f4b3-4294-9b9b-1952574426f1", "value": "85767629937021522.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ae42cf-8e1c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644901522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901522, "uuid": "73eab1df-dccd-4789-9908-0cda608ab28d", "comment": "Malware payload", "value": "9e5a8e18894d63ca79a257db3061b54b", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901522, "uuid": "2a78fa6b-5914-4a27-b940-5f3dffea8f06", "comment": "Malware payload", "value": "a9088ba954e1c94bb7658d6c85bf5ca03191154430e979e41103ddd608d9dbc5", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901522, "uuid": "ac5334f8-adf9-4da5-b54d-cb74210a5642", "comment": "Malware payload", "value": "d51808e44c0aa5a8b2f42d3893f8f3b4e0a811c7", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644901522, "uuid": "eb694c02-0220-4f1f-8666-95fc32cc588c", "comment": "Malware payload", "value": "e449f6bf2d2becf7b1a8029ae308614dbcb251a95c8a6480f6fd8e26e36082ce2b60263e70f484bee13127465abac4ed", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901522, "uuid": "f593c79c-67c5-4471-a455-decf584613a4", "value": "T1495194382706F65A00822A95DE2288D9EF1B93FA15FD592072FCC101ED1604D933B2AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901522, "uuid": "b3f42ed9-1aa1-4eb9-83a6-803ec52d0611", "value": "48:MiaivCE+MTUEZPIEimb7qEaDnfovn9E3cwbs5D8QUs49PRkKQj:h/vMG5PV0DnfoGMLusoPRkKQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644901522, "uuid": "f71f2a0d-0a92-42cb-aa83-9853f4e86d36", "value": 2766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644901522, "uuid": "04a3090c-7593-4336-bffe-1ddf10f9b8d2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644901522, "uuid": "14c65172-5fd9-4734-b084-5c5fba8327a5", "value": "B6uStbcT.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7fd72c3-8dff-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644888971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644888971, "uuid": "4ac239a1-dc0a-4243-b9f8-041bb3aa5ea3", "comment": "Malware payload (RedLineStealer)", "value": "a92468e2ea9047d9a2279e64d3159a86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644888971, "uuid": "ceb91313-f8cd-46d0-9dfb-06bd4f1c8807", "comment": "Malware payload (RedLineStealer)", "value": "a923e0bf883740849cb98c9b0ca59bc9f0d16fc23bdcc162cdddc7749b22623d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644888971, "uuid": "7090dee0-979c-4c6d-93c9-2ea2b8cb513c", "comment": "Malware payload (RedLineStealer)", "value": "dc7ba0603f5c195d3c46458d8761827e0c3a894b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644888971, "uuid": "7dc64f1b-1d8b-47d4-8079-ead089c6f13b", "comment": "Malware payload (RedLineStealer)", "value": "903d281200dd5e8347233514b79cb26d228a2d53a42ce44f612dc9c417232b9c2c5d45151f33fd174e12a20d281f9c45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644888971, "uuid": "e3f9944d-e8a3-4e85-adf1-74c70865acc5", "value": "T1D5B4B43439FB9019F1B3AF75DAD4759B9F5EF663360BE84D204103864A03B82DE9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644888971, "uuid": "049a9f66-01d1-4180-aef9-4b4190aa4da5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644888971, "uuid": "5f2f30ab-3999-468a-b893-016f8049c625", "value": "12288:flQBXKH6w2QQ856M690ldD3zVwnnzbAV6PM5JYCo5IVpsBofnEDZ5ByZg3bkznbl:g5NZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644888971, "uuid": "dcf78f1c-1ee6-47f7-8929-622371b193ba", "value": 501248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644888971, "uuid": "4a2cf433-6836-4d2d-84d6-b6613847b5e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644888971, "uuid": "427162b5-1d16-4266-8229-26a1b6923450", "value": "a92468e2ea9047d9a2279e64d3159a86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef704dac-8e77-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644940631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940631, "uuid": "1a208dc8-e8b7-4ea4-9277-53a9b96ccdaa", "comment": "Malware payload (SnakeKeylogger)", "value": "c622295f848fcf98c323d61fe3e0779a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940631, "uuid": "83c55182-63ff-49c9-b92e-6e05c50e20f0", "comment": "Malware payload (SnakeKeylogger)", "value": "a941080e1b93d4e34a44c7dbbae376214f9bb303e0a1176c258d88c87133bdfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940631, "uuid": "bae9211a-221d-4a5b-b0c6-bb5fbfe38ae7", "comment": "Malware payload (SnakeKeylogger)", "value": "76c778e8001958470b31299b63710434793e83d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940631, "uuid": "632be0c7-8173-44b8-9828-ef6ebe597114", "comment": "Malware payload (SnakeKeylogger)", "value": "adeaf94a71dcfc4f52eecd7fa752b97d92a2aa3b7497e2d02249ff09932defbd6af0c84373beec73ba7704f04d03a905", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940631, "uuid": "d64e5823-6830-4126-ab84-a573dda2eb2f", "value": "T19EE4010077B33B84C07647FA55A195821BBAB65E1123DA3DCD9230CD1C67BD09A7BA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940631, "uuid": "4c16ce5e-d185-4ba5-aa04-fe82f9900150", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940631, "uuid": "8c16308d-9c15-4cb7-8462-6267df0172b0", "value": "12288:AT5k+ZO4yds7NFlnm6fMQrUD+sMVzsBGKLgCSQ5WAurU1gAbSkx43H:IaINJm6fMq4tIzsBGK8CSQ5n1gYSkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644940631, "uuid": "38aee9ee-2cbf-4ef3-a39c-f44012ba8ef6", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644940631, "uuid": "fe37cedf-0e3e-4b05-b028-c2eb27c14ee2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940631, "uuid": "c1ab0139-c3c1-4125-8127-446775f59e28", "value": "Halkbank_Ekstre_20222501_073653_270424.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3fcb0a-8e2e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644909190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909190, "uuid": "48d4a44e-a476-4b33-b45c-a02e84928412", "comment": "Malware payload", "value": "6cc8f5883fbf1edf7bec0d86362d6f18", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909190, "uuid": "691c3400-7f21-4562-8272-da416033fb9e", "comment": "Malware payload", "value": "aa1a3f2b71e18203d3687f2d31fd5d86bd29e6eb84212082c48ac32657706ae5", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909190, "uuid": "c1cd66bf-6069-446e-99f5-094e836ff091", "comment": "Malware payload", "value": "06233f418df2333043b7b89ad698c72f0b435725", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909190, "uuid": "82a0f03c-781a-48d2-be08-70bbc488bd55", "comment": "Malware payload", "value": "0919963c034e54e8109ef0b18e5572795b42f439263268b015e86c7d5545571b234f1fb327526801c44cfae061a6dced", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909190, "uuid": "549d43d7-c328-4dbf-9f64-49a2f22f9b6c", "value": "T1841319B30223BECF47270E42D50C2155DC99E8B771D999ACBF884CE58BE51189DB8EB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909190, "uuid": "bec31b15-9971-4873-a83b-a98e6bf05235", "value": "768:1exjGt4KaeqDA0qjpfUa2sHhBum9b2kfgnt/XpXc3T:114KxqDAj8a2GhB19Kkfgt/XK3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644909190, "uuid": "2d046785-1131-4f7a-9487-f3a1958762c1", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644909190, "uuid": "dd4ed90b-6190-4318-bde5-66ecfaf37a7e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909190, "uuid": "03c46740-9ceb-4579-8d6e-6cc44bb7ba3a", "value": "2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f6e60f-8e74-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644939088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644939088, "uuid": "ffe28c82-64cd-41f7-8661-81c309919e4c", "comment": "Malware payload", "value": "844de817040ca6221e724240dbe72cb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644939088, "uuid": "c7a5c0f5-add0-4b47-99ed-be19ca91bff5", "comment": "Malware payload", "value": "ab7336506d7289fb71466d6abd0a29ef04eb80fc2ae541254eaa7fdefdef65b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644939088, "uuid": "510631f7-4ca6-42e6-98ab-c8bd93414d1c", "comment": "Malware payload", "value": "5b744aa3e35a84a723efae347d051d6c23b71e82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644939088, "uuid": "0f313299-d49a-4096-903b-f6a9ed5eea83", "comment": "Malware payload", "value": "5bb1db01cb62666878b437afa3c6ebea0a95e047f2a8020259e2f56ddcf5cecc39286699407de6d093ccea99d1e68355", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644939088, "uuid": "8966bef3-7d2b-44d3-a4d0-de8874aee65e", "value": "T13D05F5A831A3F4AECC57C4B69A545CA8AE50E86B730BDEF79003D1BDD90C5968F150B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644939088, "uuid": "40f7c5a5-6899-4432-bf9a-77118e5243f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644939088, "uuid": "90875f1c-09b8-4803-b21d-7515bdeddf7f", "value": "12288:DHeaqL7zopKdmEE2xbtGt4CMEzPM3YDEhSq5fHiSbwK+zDOguhXQaXE17asV:DetnzSKdm2vC7I2U5xds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644939088, "uuid": "a0db0dd6-cd0a-4d57-aebb-d431042591aa", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644939088, "uuid": "2d633d39-fc58-43d9-9e4e-a3fe01754f67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644939088, "uuid": "6021eb30-a1c9-4c14-b1c7-3e4f924c366d", "value": "Payment Transfer slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7073242-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644953448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953448, "uuid": "a60749a5-c80c-4679-aa1c-0135d6354a5c", "comment": "Malware payload (Formbook)", "value": "c4cd0f1de5d2bb3ca656b421f3afbf28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953448, "uuid": "ba9a8d13-7e71-4d09-9ddc-ff523537827c", "comment": "Malware payload (Formbook)", "value": "ab90e014c91318ac3616338c4340c31f1639db056f37e44ba794fe53ded87ff2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953448, "uuid": "f68dac94-66c4-4457-b62a-801d1dfcf813", "comment": "Malware payload (Formbook)", "value": "cefc7dc0e7056ccfaab89fbfdc6365f96cfd533d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953448, "uuid": "a39083eb-43dd-46b8-92b5-3454a47faa1e", "comment": "Malware payload (Formbook)", "value": "ee0ce1fb205fc618bc7d86b42661a98490e373191d82a46741c8a353968678c326cfb1b806493526063947ea5b95649b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953448, "uuid": "4e6f2364-59a6-4a3b-8bf3-2d76d1c2d802", "value": "T197A4C1D2F69EACDDED794CFB04F5A3C67861AE1D0B0297C1D3A53A99937A2123C0C449", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953448, "uuid": "24d653ae-2f48-4644-be7c-3a9613f8852e", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953448, "uuid": "0bc26d7b-c048-4379-a199-e5b8411233e9", "value": "12288:GFaiaYta+wywNh5K2evmxcl9Shq1Vyx79:GTwyWLK+xIJW79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953448, "uuid": "1065ad0a-bb75-403c-b9f7-a39322779d63", "value": 463526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953448, "uuid": "881d9fe9-fa5a-4500-97e9-a38c5f8f4311", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953448, "uuid": "ac33dbf2-03c8-453f-9659-a68030935ba0", "value": "c4cd0f1de5d2bb3ca656b421f3afbf28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d57f83c-8e86-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644946855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644946855, "uuid": "48d33c34-66ec-4a22-9873-1d73f271edf3", "comment": "Malware payload (Quakbot)", "value": "2d052c998853edd6186279ee1c96c412", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644946855, "uuid": "c7f49f96-57c3-4fe4-9f59-a26f44dedd05", "comment": "Malware payload (Quakbot)", "value": "ac435e965d0ac8c246ea9707d9e4545d287879d665479ce3dcfeedc914f25809", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644946855, "uuid": "e27e0e6a-0793-4eed-91eb-5c181ec290e7", "comment": "Malware payload (Quakbot)", "value": "e24ef5bbdf7b2d73e8ad1337a2bd358c506ca8e9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644946855, "uuid": "00e671ab-15a0-45a8-89cc-43619b538af9", "comment": "Malware payload (Quakbot)", "value": "46bad36443610e3079cff771fba7a830bfbdfce0ac67c0259540bba86e295e4785383abc2779c3a810d5471d92e2abab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644946855, "uuid": "a5c0dbc0-96ab-4626-acc8-a55cab785ba1", "value": "T15C358D3271C1D5BFC4B236BCAD6A71A988257D521D2CCC0DBBD80F4E0D7A691673229E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644946855, "uuid": "c8c7df02-8de0-40f8-a6da-8ab3ffc6f40e", "value": "220ea7972e993d1cdbf761cab8a71a9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644946855, "uuid": "2c6c8294-c1b9-47f1-ae2e-a264c635ce1b", "value": "24576:muwgYKvPteX5lNEZYytPKFYY22OlWc971Zkqtu2K0FCFYB:hzle4Pa122S9k2Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644946855, "uuid": "35d010e1-1a89-4a2d-b6c3-74609116bf81", "value": 1097200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644946855, "uuid": "f4f65b33-6261-47ab-b568-b117a084f8b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644946855, "uuid": "682d15a7-a123-4961-8a14-4cf253cab635", "value": "822330420929752.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156a2081-8e6a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644934681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934681, "uuid": "e9789a26-8af1-4642-af93-6aa239f8cbc3", "comment": "Malware payload", "value": "ff68aa8143fb6b4a3b05dc51dbac74a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934681, "uuid": "a80155d9-3cfd-4f4c-aab9-c893cbbf31b5", "comment": "Malware payload", "value": "acc89ea7362b5ab28d887613d3081c91a9fd0dd1d15de79c3fe09e1ed871ba80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934681, "uuid": "088d028a-02f9-4150-9850-66ee8c3c5ff7", "comment": "Malware payload", "value": "e10baac025a80e68f331c3da0caaaff8dae38f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934681, "uuid": "5436d6c8-eea6-4f95-ad68-9039da9edc0e", "comment": "Malware payload", "value": "d36ee4caab54185e92151fbddf982b9f55d68207a04bf9a7caaaad1a90ee22e95704f095737f2f9bb53f7faa0fda2a36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934681, "uuid": "259a7f0a-a5c7-425a-a762-36363c34a315", "value": "T1660505A831A3F4AECC17C4B699545CA8AE50E82B730BDEF79013D1BDD95C9968F050B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934681, "uuid": "d80469ca-e26e-4092-bcee-c4c75554cceb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934681, "uuid": "12b19ef0-24fa-4535-96ce-0a766721b40f", "value": "12288:2x4gGRn1psZnim89xLFBexdBL74496Y5/3ikJYdP0yDasV:Jfbm8/3e/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644934681, "uuid": "d9bf9354-5b75-4265-93a0-4bca84b7e4d6", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644934681, "uuid": "8a7660d3-1669-4f9f-bbd9-37e1ce6feb8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934681, "uuid": "a268b283-1a84-4e1b-8960-74f27c4fd96b", "value": "BL COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e71bb9-8e3c-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644915217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915217, "uuid": "4d57274b-6117-4602-9c80-5170a2be654a", "comment": "Malware payload (NanoCore)", "value": "8956027ab8a0e2fff70f5b1f17d9c540", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915217, "uuid": "239cd493-2191-4078-bf3d-da7c407259cd", "comment": "Malware payload (NanoCore)", "value": "adac602d329a95580921b519350a4eefa10c98f593b6be76855b31d8bea64909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915217, "uuid": "6c713c6d-ecfb-4298-a621-2f3db3d53582", "comment": "Malware payload (NanoCore)", "value": "f6da0466ba697c77bbe61f188ccff2fe9577df00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644915217, "uuid": "da661e4c-0d1a-4509-80d5-736948513807", "comment": "Malware payload (NanoCore)", "value": "f5a815fefa67ba3112fe6577639e68fffe4abfca368ca099d80f71788067ae5f0a09ead2ab6f06c4073b277dd9a4abd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915217, "uuid": "0cd34060-75bf-40a6-be80-891cbb958691", "value": "T1ACF4AD2A51F3D8B1CD5B85FEE560C58C6F65EA2FB142FEFA8844D4BDD0AC3904682523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915217, "uuid": "5a217f11-3e5f-467a-88f4-ef6ab50c558a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915217, "uuid": "a4cedc31-3c23-40df-b804-38e6eacd75f4", "value": "12288:xpasVIjcTaPQl9hvXPNBCjitYqcCJe4gbLyERgbDs1:Ks4IxbCjdqbe4gbOEOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644915217, "uuid": "21850d7e-2026-45d3-89e6-2ae8566f0908", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644915217, "uuid": "bc5743de-f2cf-4698-a9ce-4e0a48578ba8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644915217, "uuid": "d1e4473c-6b58-4211-aac9-7c3297721839", "value": "Quotation Request.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af60f881-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644931933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931933, "uuid": "bfc2a1c6-81b7-4f2b-a44d-87165d1987f9", "comment": "Malware payload", "value": "c8f871040733d2f59621e4759f6fad08", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931933, "uuid": "1a0f410b-026d-4775-815e-8af12db6e2c7", "comment": "Malware payload", "value": "adff5083e4f79bc5d94c5756109da939fae795721f61ce1d8f5b24fa97d99aa1", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931933, "uuid": "13b890fb-d428-4d6f-be74-965a501547fc", "comment": "Malware payload", "value": "b43b59d225f695c50622013aa30945da34e719e8", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931933, "uuid": "d5a25a04-a915-464c-859b-d8ea19b126c3", "comment": "Malware payload", "value": "ac2c9e2e581fcdccbacd973ea292cf96d8a312e19f8e397273756f8af9ffe1358fc60f61c089bacfb68b6d823f9c784c", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931933, "uuid": "03bb169c-1e28-41ca-880d-9fff76bc383b", "value": "T120A33DF742179E8F8A370E40EA0C0652EC6CF8E773C884B8FF455D565E569089DA4EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931933, "uuid": "db71dc75-a10c-414b-b1e1-f1bc5afcbda7", "value": "3072:YzQr7VUK8PdEa7NeZABhpIssuWUgc8mMp7Nb:LrM97NeelIfu3gcjMxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931933, "uuid": "fbba07a6-1a72-40bf-9d30-e42951214435", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931933, "uuid": "5135ab8a-5280-4a66-84bb-24226d1c3eec", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931933, "uuid": "ccfc679e-64d4-4cfb-a07f-d2bbde8fad30", "value": "33889 send.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb101857-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644931953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931953, "uuid": "500f7295-d677-4af5-9ca6-0ad0f5a33343", "comment": "Malware payload", "value": "08739fd9eae33bbaf87b425d5430f7a3", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931953, "uuid": "167f46bd-285f-439c-ab54-6519e00bd75e", "comment": "Malware payload", "value": "ae23dc18294e8f9263a9658da594432fe4543e32f9daae346f0ad954917b706a", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931953, "uuid": "f068f195-cb0d-4205-ac23-ebde8a963817", "comment": "Malware payload", "value": "332bbb54b631871272072534bb30c72a57224b3b", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931953, "uuid": "4bb1285a-d925-4351-aea7-e4e8af8e90c1", "comment": "Malware payload", "value": "c86423602f093518218dbe6d99b05b3d3f0b253ff938f4ce49255f9957f9157273e4c4b8245fbd6330db2d7ef40392ca", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931953, "uuid": "baddf6d0-9156-4a43-b2a5-275ac11aec9a", "value": "T1CE130AB30213FD8F56220E45D50C2115DC9DE8A7329999ACFF4898E98FE91188DE8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931953, "uuid": "24777609-d24a-4bf4-b17f-229dfb80710d", "value": "768:kGZxkK+TwKa4WfbmcKxe2kfgnt/XpXc3lti:kGZyTw3Zfyhxxkfgt/XK3bi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931953, "uuid": "9d61d7b6-d1e1-434f-8b0e-6288dd9cb036", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931953, "uuid": "852edb21-7cc7-454d-816b-204733a07b6c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931953, "uuid": "c05337a3-9877-4d3d-b669-9df8121e2ecf", "value": "alik.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b8ae19-8e4c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644922141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644922141, "uuid": "842a8909-f73c-4505-b8ba-43ea49a99a95", "comment": "Malware payload (AgentTesla)", "value": "680f29a7fb57e89aab794f1da07c4dc1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644922141, "uuid": "ec6d1443-c2b3-454a-bb17-8732c3aa117e", "comment": "Malware payload (AgentTesla)", "value": "ae6a173b72d76800f97290db4e15b8a847d932a15912b67e919ea00a69e520b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644922141, "uuid": "d04c2779-80a5-44e9-8b9e-495f5d80c3b1", "comment": "Malware payload (AgentTesla)", "value": "bfac129dbc0cbb3493155934286568ebc8304bed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644922141, "uuid": "0e45b5de-759d-4540-9393-a03ba6b6a503", "comment": "Malware payload (AgentTesla)", "value": "aa2a6e63c08e978a5abb075ea3ed38967a1fa05effb80d04f389fff28674e6b7200418211f4a9872fb24a3d9bedc81ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644922141, "uuid": "f77c53b3-85ab-485a-8458-07f79ffd0e5d", "value": "T101F40284B3777AABC83804F4086252CA57F49449796ADAFECDE231C886D0FE556B413F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644922141, "uuid": "1be8de81-f9bd-41ae-817c-1f6f0847cc96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644922141, "uuid": "662533bb-0a3c-44c7-9cf8-40a219d00c72", "value": "12288:XuZFtLKwJ41H2E6iDrSjIfxnIz9FLevlWqLO8ionmXWGDenxXOJZ++Rj/w1vD5k+:XK74136iyjzzivJO2mbOdOH++m1vDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644922141, "uuid": "c38e1559-1bc4-40dc-a640-6736cdfc9a9d", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644922141, "uuid": "54c8a282-96e8-46e2-b45c-3e1f2ee7cc9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644922141, "uuid": "ca225ebe-9851-4ac2-bae2-1f1108148ca7", "value": "Pending Invoice 38129337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329013cf-8e04-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644890922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890922, "uuid": "0a947ea8-1f4e-488f-9d80-79e6a6a7d131", "comment": "Malware payload (AveMariaRAT)", "value": "c30a6e7569e4c64f16dd2c1f8412b199", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890922, "uuid": "3770d7fa-2a80-4e6a-ad44-a61124e308a3", "comment": "Malware payload (AveMariaRAT)", "value": "ae996d077fdeee06e175f2d8f47f39e63a55fb474e8ebd45395e6ce3f81b3675", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890922, "uuid": "c9fdadbc-eb8a-4f52-b248-520fd727b8bd", "comment": "Malware payload (AveMariaRAT)", "value": "6feff2bc491fbd07e69145d7ec0befc9b20b7529", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890922, "uuid": "2f6d0256-b656-4b24-b0bc-1cf457cc4333", "comment": "Malware payload (AveMariaRAT)", "value": "d79e9f6897b9b09cf41fed7e688c6141bdba24a42120333b983ff0d3e58211b74b4b5f874493ea0496349141ed491f0f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890922, "uuid": "bbb98b24-8470-4c0d-b4b5-d173f1f73be3", "value": "T11D35226722F510B5E6FA4335A4F302975632BCA66739C57F5281A1FA0E237E0B075B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890922, "uuid": "343941a4-505c-4536-a4a8-e4ce8fc56e80", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890922, "uuid": "31d72390-eb62-4533-af06-cbca51c2cc08", "value": "24576:DBy1vsfsy1JUTOO7cESGhuQfc0d3pkM2otaRGPae:Y0sy1SHSG/nbVaR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644890922, "uuid": "1bbae961-3a97-460e-9dbf-2854e1848255", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644890922, "uuid": "f42d7a1a-df99-47b7-a2a0-f55f08bc0363", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890922, "uuid": "077ccf55-8041-4d90-a7ae-e7db2aacde0f", "value": "30710489927_019_00003_00000095.pptx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74efea4-8e60-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644930739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930739, "uuid": "ccaa4350-f768-4667-95f1-8bc8c1755d96", "comment": "Malware payload (AgentTesla)", "value": "b2d943d713b598cb260ed48c0c1cb50c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930739, "uuid": "e21c8755-4681-4c4a-a412-49e9b6e7fad3", "comment": "Malware payload (AgentTesla)", "value": "aec1f9abb2e31f3997c315640a78fd758eba3ff255c42ff8682d5e9da92f6649", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930739, "uuid": "4f043a06-930d-498a-85e5-eeee08b8fb2d", "comment": "Malware payload (AgentTesla)", "value": "15b66e1cf0226d3bbfcb3840bc03af06687a877e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930739, "uuid": "4855f84f-39ff-4c95-859b-a6c06b8538f1", "comment": "Malware payload (AgentTesla)", "value": "b4ce8df6a0b9b229468f1d7f0c276d4a5b99ec5fd247227d502e5f8e4f822af4ca1a5256547ed423bd350ba75fd8c9df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930739, "uuid": "ee811f2e-2fc7-4944-8229-6b4e011ead38", "value": "T1C705120073FB7B40C17657FA44B185810BB67A4E6532E63DCE4234CD0D66BD49ABAA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930739, "uuid": "41d065ef-e1fc-43d1-a635-f6598c3212d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930739, "uuid": "72fdf507-a7aa-4ab1-a0ea-624cbefb340f", "value": "12288:6ylm5k+Xw04hxeVr+sLZGI8bM1PcvnZwafWRasPo1bv87qezeksGP:/maZbewuZGzbM1PuZwcW7Iw7JxsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644930739, "uuid": "cd94830f-8e9d-4ee6-a945-7003e40f4f0f", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644930739, "uuid": "52370d94-2f3e-452b-81b8-ef682245ee10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930739, "uuid": "4d9235c0-1f73-4288-b581-9cce924edd90", "value": "Purchase order Enquiry_CRM003764009156 - Tender Ref 469825350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e953778b-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (Arechclient2)", "timestamp": 1644953505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953505, "uuid": "1d1ea658-dc60-4aa8-9c0e-c5640dc73978", "comment": "Malware payload (Arechclient2)", "value": "7140dd8a069def9e915c618aa9dbc375", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953505, "uuid": "e8456dbe-cf17-472e-a5b2-ccdea8200575", "comment": "Malware payload (Arechclient2)", "value": "aef0d786d2290cdd422140ae93198c9e08eb7544f372cc42aaebdc8a36b625b2", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953505, "uuid": "c2363821-d4d8-4d6e-a40b-e5e316732182", "comment": "Malware payload (Arechclient2)", "value": "c58430489f456747567006306d20f4c0309d2df7", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953505, "uuid": "90dc7d85-b814-4afe-bd6d-a5f18432718f", "comment": "Malware payload (Arechclient2)", "value": "787069115efd1835dd41edcde4666b77e032b74e2f864aa84f843e4e9f26f284488ebbbd3ecc8017ac8665d2e6ad6d4d", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953505, "uuid": "7edd7dfc-212e-461f-93fc-70f3e563a251", "value": "T134451216B3B3ED41D07413B7C0E649950BF0BB0DA462DB7F2D9621CC0562BE659B2A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953505, "uuid": "c765af81-21da-4b6c-8b53-505505cc2fad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953505, "uuid": "c55080de-37e6-4587-a785-5203e90ecbd2", "value": "24576:cyaFj59hojFtqmfN3R6KAI0p8LiSOiFDAeUA78:cTtVKdV3R/QXVuDAeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953505, "uuid": "25d1cffd-6ab6-4889-a957-1b6521e94009", "value": 1221632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953505, "uuid": "782fcdd1-b4d2-467f-89c6-9651d39232e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953505, "uuid": "3a1e3f69-788b-412b-b789-fa9216c766d2", "value": "7140dd8a069def9e915c618aa9dbc375.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a8ad64-8e6e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644936663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936663, "uuid": "a5acd057-7b15-4b88-a1e2-0fe6583c9194", "comment": "Malware payload (Mirai)", "value": "d0ab34d87a6d297f939d85e088ebbc06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936663, "uuid": "d3b74c4d-3dc6-4bb3-8b53-07b726db9424", "comment": "Malware payload (Mirai)", "value": "af7d603f1af5ded727630e7b510f793808898e6781c82f70187c782a1631a03a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936663, "uuid": "7ebca15f-39d3-4d3c-9725-b95bbcbeab23", "comment": "Malware payload (Mirai)", "value": "879bb1a4f5f58169010508475ad1cf5d68bc1593", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936663, "uuid": "7d6b7704-ebec-4b08-92f4-8800c182ad07", "comment": "Malware payload (Mirai)", "value": "d5341228830693cb1166f7c782eee865595965c3f70c353722d02cb305bb5a111c6aad295a4e525e2764e0a5398e550b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936663, "uuid": "a597748e-253a-4e6b-ae56-4550355519ab", "value": "T14D439D66E42D5EA0C04542F07468DEBD0F23D8C093777EB19E9582B96043EADF658BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936663, "uuid": "44a4c08c-cc67-4c56-948f-ca504864c58b", "value": "1536:Vah0wttNJ7V7Oo9V2QkcEzf5e7lCcaIqLAwP:V8067pnG5e7l7qH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644936663, "uuid": "ca88c90a-e6cb-48d2-b752-940bc5dc9634", "value": 59324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644936663, "uuid": "19f84493-809f-4cd3-ae87-3e2b509b28cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936663, "uuid": "fb9b2679-2de2-430d-b249-2c9c61fd8d67", "value": "d0ab34d87a6d297f939d85e088ebbc06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6d260a-8e8e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644950236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950236, "uuid": "47dd9ef5-3dd3-4248-9701-1c091dbdf46f", "comment": "Malware payload", "value": "9308f38a984c45ed2325dfb0bd32d202", "object_relation": "md5", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950236, "uuid": "8605cfe7-b37c-4700-8510-255ee077a69b", "comment": "Malware payload", "value": "b042d104e9d13b78bc21a1e0c0d65282937ddc65c42396951cbc10441c4f8ba4", "object_relation": "sha256", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950236, "uuid": "ac0b3e4d-ac38-45aa-8a8d-c0a7c81e8a3b", "comment": "Malware payload", "value": "7990b585c3601bfb49f0129869d3d96ee6791e87", "object_relation": "sha1", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950236, "uuid": "c0fb6d59-6245-4d8e-b600-ad04ecc3ea6f", "comment": "Malware payload", "value": "747ec9c28b7050225118265fb1dc0ab29f92dcc3e78aac5556fd9e3c265ac1a8a5d50c330fdf73a335fb38f6510fc924", "object_relation": "sha3-384", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644950236, "uuid": "ad2f3816-cb31-4325-9545-0eb0314ad97a", "value": "T19AA423EF3521D8CCC36E727C9B7D557DD4010D98FB66AB4962043B249906B1E82BA2EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644950236, "uuid": "321df66b-2ab4-4bc1-b678-e3fbb7309ae6", "value": "12288:a4ajlreUp9YB3tFTluJ4778nH5SkEVpawvScqLk:a4RUpSBJv778nZSDt1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644950236, "uuid": "aea211bd-efe0-4385-b6fd-cd1fef89dcdf", "value": 456598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644950236, "uuid": "9059f71f-f796-4a0a-a7f9-cb3fb45fee6e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644950236, "uuid": "16bb15bb-105f-44e1-9520-3175d195c909", "value": "BL COPY.XZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6c876d-8e27-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644906002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644906002, "uuid": "8e03c33f-51ff-434f-9bbb-e0c017d21391", "comment": "Malware payload", "value": "462766e2b5fb633920b6b4b1661dab80", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644906002, "uuid": "a754ecba-5f6f-4bbb-9f00-6a8d477b47a1", "comment": "Malware payload", "value": "b0be7cb97ea55c7538ce2e3d130e7d49203c898cd6047340c5dde56781794287", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644906002, "uuid": "a6f046b8-0e0b-4348-84c4-5c61d7be47de", "comment": "Malware payload", "value": "0a0368c3ee9649c75ce29bd92bb544e8f2c14a5a", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644906002, "uuid": "03885511-a055-4ec3-8644-8f96449d51f5", "comment": "Malware payload", "value": "2e39a9703717c6fb33c8f1525e6dd6bfb047a8fd98c41e14138eb1062d5a42c88201ac2cf3ddcd026f6f5a0c61f8cc71", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644906002, "uuid": "55c94ac0-0838-43e8-8db8-f8fae510d8a0", "value": "T1EDE2714B34ED40846053BF839BB3FC6686FDFBA929BFA64D41940D0DA1D2D40E593B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644906002, "uuid": "8fad341a-168e-4b79-b93b-813bf37e373b", "value": "96:EO7GCxoKFPHmY4TWmY4Tsm49/17v1R1Y94dMw5Z9RAWxn2Jvy/+YioFjnh57OQHv:cCvFPHZZZlL99hTY4MEZ9iIeI0oE/9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644906002, "uuid": "23a1a177-a49a-4a34-93e6-64c5243bfc55", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644906002, "uuid": "7cd1437f-f68e-4d77-8fed-dbfb048e459f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644906002, "uuid": "78e731a2-c536-4dd2-aea5-861f45d7bb68", "value": "INFORMACION DETALLADA DE COMPARENDO ELECTRONICO.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8817ed-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644953031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953031, "uuid": "0b7fe93a-74e4-4799-b3c1-1c1e54c20f5c", "comment": "Malware payload (Formbook)", "value": "2281b468def8442d836ba250e4b8937d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953031, "uuid": "9c2a1711-8f1a-48e5-abae-a7e69f79b568", "comment": "Malware payload (Formbook)", "value": "b1520fe13b446dacbfeb2826ac0ed92bbbbb3816339696a4cb0a4addc02cd352", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953031, "uuid": "51478ee2-75f1-4420-b4ad-6132b35add71", "comment": "Malware payload (Formbook)", "value": "2d956586691992c08cafd2fdb779bccbe45d3b8c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953031, "uuid": "0869e829-d15a-49a4-b56b-ab54cf53578e", "comment": "Malware payload (Formbook)", "value": "1f898e4c9987a3b2e08f9ccddbb522d9fc1243b56a32f342730d761a8b426787de63b982fe4d49beb27f9fc290fb043e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953031, "uuid": "26f87a73-850b-4766-826a-da943fbbda3c", "value": "T15B1412472F363CA4E167923F7748871A0022DE9E5D2E0C262B7F776D0CB831A5D69349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953031, "uuid": "2e5fa3c8-3326-4de4-b7be-27c556bae445", "value": "3072:qym0TYyX32zzpcNHLhNGkzs3iD9jTNVbFkCQgItWDMUaHaM/Z68M4GjDr7Uw+VCV:fmSLXGxcNrhB9jTNVJkjguLHJ67Z/7UQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953031, "uuid": "f84f5dd8-845c-4c9c-967e-7e9c6a0f3ff9", "value": 191784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953031, "uuid": "d7f8508f-6954-4e8f-932f-b4917de7f1b7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953031, "uuid": "7ec87832-fcf0-4a90-be84-5738cff5bdb9", "value": "Order Specification.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8542eba8-8df2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644883329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883329, "uuid": "f1a01181-2b0b-4f28-b663-e5636a4bcb74", "comment": "Malware payload", "value": "887e14e9199ef66034b880ab3a63fc72", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883329, "uuid": "4c4f13ef-2ac1-4280-83af-28717651404d", "comment": "Malware payload", "value": "b1b8308d882329d9d10fed76e51cbdcba10a899abeeda81cda4764f61a4804d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883329, "uuid": "f4a16d5b-0be0-4acf-a79c-b801041ee108", "comment": "Malware payload", "value": "966df308a696e886cf2246a2a631adefbe1a9b7a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883329, "uuid": "38fe3764-4ae2-4771-bd0f-60f32b4a21af", "comment": "Malware payload", "value": "6a8c9cc67deb6a5dd6cf0c50cba309c63ccb73fa23b149a5700655b861f6f91b760b2e11b0949096895c6d48d395c5bb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883329, "uuid": "9d0c8680-cd9b-47d5-9faf-85bbf5e20a4d", "value": "T1BFA1F850112C1AB17246597AD26FFB92B50EC81B097B7B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883329, "uuid": "17ef40cf-26d7-4c8a-a0d3-d7843adb6326", "value": "96:dRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:dRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644883329, "uuid": "444e1a0b-cdc7-43fa-8a54-345dbcf473fb", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644883329, "uuid": "5814018a-66ad-4b52-819e-586d06abd9b5", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883329, "uuid": "8cb7287b-2c72-4c48-b403-f050d25e6e88", "value": "b1b8308d882329d9d10fed76e51cbdcba10a899abeeda81cda4764f61a4804d1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8e55dc-8e61-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644930826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930826, "uuid": "d1eeba4a-2e29-459f-a2fe-331d6f04e3a4", "comment": "Malware payload (Loki)", "value": "a3ce860c5ff3518cb96939070559bcdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930826, "uuid": "92c2dd4d-2c36-434c-8f70-1e8b470851a0", "comment": "Malware payload (Loki)", "value": "b20256d1444836e3b99830ad0e6039478db5252eaf692c968f5e0ff76151d89f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930826, "uuid": "508933be-b84b-4386-9569-fa59e27ca783", "comment": "Malware payload (Loki)", "value": "a9c0b0cd9268ab478c163f7dd7fe6994fa759c25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930826, "uuid": "108b7364-9151-466e-acab-154bb56f54d2", "comment": "Malware payload (Loki)", "value": "0c68b926af1d178a3d5f21a3c838aad3c839daf8f8d8625fee7477b404592bb5dce59a35b881e7fdc700d100a63e3b55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930826, "uuid": "ccbd79ff-06bd-4b45-a65d-d29285c4ae96", "value": "T18B64028EEAD15CDDCC2BC7B4183ACA21D372FF1AD141391B26927AA514E359B04357CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930826, "uuid": "207e6f60-79d1-456a-916b-9cfd15c09b5c", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930826, "uuid": "9c9c646c-7ed3-409f-8d77-c46784d73d20", "value": "6144:LwEi6soo8aj6eHe+9Oe6igG+4Qr3mfbxDLstx/heVAuuDezLQeCHfy:gb9OeWGUWfb5ex/htDb1H6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644930826, "uuid": "d4aec6af-947e-4cc7-9774-52e780c61df0", "value": 326240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644930826, "uuid": "6c1409c9-fd51-4e7a-919e-87d57e777fcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930826, "uuid": "26985baf-6a8d-4dc3-8f22-ec7cf66a8f49", "value": "TRANSBUANA .pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ff083f-8e03-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644890573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890573, "uuid": "6ac43d63-50f4-426d-a4e6-2e0a5a69847a", "comment": "Malware payload (SnakeKeylogger)", "value": "53fb27028f098d1df6e3c664ad545afe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890573, "uuid": "3ea2cabe-996b-4993-8a36-f2ef6c530ad0", "comment": "Malware payload (SnakeKeylogger)", "value": "b2e786b08de5350314dadcab93bf6b41ae62006f1dc611cbcf60a246e1643138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890573, "uuid": "9e1da6cd-1e65-4d1f-9ebd-61e7b16304bd", "comment": "Malware payload (SnakeKeylogger)", "value": "91e5bc2e60816cfaa31b77284d6325acbfa4b0bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890573, "uuid": "700c05f1-fffc-4a7b-816a-751ea77b59d3", "comment": "Malware payload (SnakeKeylogger)", "value": "0790a3359852a6e351e57a919bf7574f3c5c0c5628bbe329f4f6d2085b24f914daeb14382681a3b6f34fa574d9cde508", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890573, "uuid": "9068135a-6404-410d-a34d-fa8df86f0e41", "value": "T128F4010163B89736E47A53F86934513813B63C0A61B4EF8F9EB2A5CF5C36B815811F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890573, "uuid": "0ac263bc-2793-4362-9dbf-758ef7e2c8cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890573, "uuid": "f40fe7d3-6602-4570-beec-7e066418dae5", "value": "12288:eYjQk3/igUcFxMRhFbOW1RHWQdqruwqMrx2Kut4S/C31+0Lz+BcrZAae3ELIjH:J73/izexUFbOObwqMre4iC31HLSCrZAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644890573, "uuid": "4d8ad944-798c-4349-9c23-a09329b5862f", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644890573, "uuid": "3e8e7905-31a8-45bb-9aad-9274302cdb32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890573, "uuid": "bb44053b-ba64-463d-9808-6dec0ebc072d", "value": "53fb27028f098d1df6e3c664ad545afe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14441d64-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644953148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953148, "uuid": "da4730b1-a87a-4d45-9a4c-4c84215f96c3", "comment": "Malware payload (AgentTesla)", "value": "79ff57ef517ed690f088c8190f7db637", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953148, "uuid": "64a97f01-6230-4114-830d-a2a9faa32c6e", "comment": "Malware payload (AgentTesla)", "value": "b3652c60fe30724a7855e4a00d8107a0952c9acb6b8747611f04440be3de0684", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953148, "uuid": "6a96602d-dfd3-43dc-a151-f11eb851be5a", "comment": "Malware payload (AgentTesla)", "value": "21150b4fdb7bc425a22dd841ad8948ea28033a2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953148, "uuid": "195b0960-9b14-4b1e-8027-bac7dcd46ebd", "comment": "Malware payload (AgentTesla)", "value": "c27553d8cb146ceaf4aea269c86fb5a34dfbd63096f7854adbde1dacdea2eabd33c991dd1cb706bc303a28472aa86989", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953148, "uuid": "ee0fe378-8f8f-450b-8a66-92ecb09a9848", "value": "T1E715F10BB76FEB3EC56402B140FBD0B107A59B9F1173DD7678E9729C1A5226209B01FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953148, "uuid": "4d9e514c-6e51-4407-9e53-529c4e2e302b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953148, "uuid": "6a4652b2-7593-4c9d-b4d7-b3909e17883d", "value": "12288:AATLacszcNUfxB9F+JjnL0Y8ABkNkBMnd4x476+lDv3bQvUdd5C2WE9nROaKmDsw:AATLPBI4x32DDr4ahDsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953148, "uuid": "7e91d94c-a8f6-4a63-9050-d0c5b11dfc15", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953148, "uuid": "68db473f-d872-49a6-83d0-37c9ed05e7da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953148, "uuid": "17a7605c-e024-4ad1-bc6e-df81b3f983e0", "value": "SHP2152022-DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1c67d8-8e30-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644910023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644910023, "uuid": "26ae89a1-9044-4b49-8742-fd2dbce20941", "comment": "Malware payload (AgentTesla)", "value": "65d779e34530e1711133b7cad8c372e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644910023, "uuid": "a1187d44-dc4f-436d-a936-659d83e363af", "comment": "Malware payload (AgentTesla)", "value": "b38142dd7b11f53b80192c479c3b462ab95e1292d90e395036cd4f43448abe89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644910023, "uuid": "6d9bc271-f594-4260-a339-bb7e831ff432", "comment": "Malware payload (AgentTesla)", "value": "8f845c6cfc432eef2e30d83a8588739efd1f623c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644910023, "uuid": "f56ef71d-4746-4db1-9ff6-50b471ce2f4b", "comment": "Malware payload (AgentTesla)", "value": "52a6c5dc39f3da349714b0825eb856a7dd2d71277e801cb87e36bf9912f0d92e3b060c6158e599472ebaf06cd3b8ed8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644910023, "uuid": "7a07c89e-926a-4510-8ef5-d24f5a6a7f46", "value": "T12145E016B277FA6CC02446F300F6D0201BB1AD5C5A7EDF7ABA723BAC0A7219215757B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644910023, "uuid": "eb70381a-2609-4401-a6ed-73cead9df331", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644910023, "uuid": "f631bccd-4fbc-43cf-a003-c0e5c881ad80", "value": "12288:Ip3YHrNkpxNkzqoN8JUR0fRCzbKe45Y7m/MJyF7lUVB7rV/GBnpyeUC+A:Ip3YHrhzqoqUR4Yad5j/kTVNJuBnMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644910023, "uuid": "d43230c9-004c-4c8a-84f6-89efabc53c4a", "value": 1248256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644910023, "uuid": "abd91604-6a7f-4f46-b248-b7b7ceaa1d98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644910023, "uuid": "db88beee-aa99-4cbd-9412-62de419c8f73", "value": "786AI-786-2021 Original.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94549ecb-8ea2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644958946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958946, "uuid": "d060be6d-c367-498d-b088-b3faaae5f7bf", "comment": "Malware payload", "value": "65658c1e72f1bffd2ef41b2f686b9bc1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958946, "uuid": "0d58ad26-0c38-4caf-8642-e37a8765e27e", "comment": "Malware payload", "value": "b3abe3acd1d489ecc0746e3a41f8e587f84d0a8b8655127fe4f794311e0ac2ea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958946, "uuid": "f533bfea-cb7e-4aaa-8029-4ed1dc66fc39", "comment": "Malware payload", "value": "0576337a8a652b1b29247e97300ebd344ded5a85", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958946, "uuid": "c09789f8-1556-450e-b0aa-9927b0c56f74", "comment": "Malware payload", "value": "c3937f0b9e64d3018e5420b834f02678dd816e90d45d3bfcb51cf5196e7b2464f213ff03f8a07d2eed7ef8793b695728", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958946, "uuid": "72fd2794-e947-492b-bad4-af4b74bcd4d0", "value": "T158B30956E7808F03C4D22B76BADF43513323DB54A7AB23065528BFF43F867AA4E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958946, "uuid": "c55d91f3-b430-495c-82cb-8eacd9f6f41e", "value": "1536:d1nb5kOgaBmCoCHv3ClH1ihr4Yd7YDF7t3TSdzSuDdPRzw/9n0YTdtfGsVy:1EaBmCobqr4Yd7e7t3ezFM/9n+Ky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644958946, "uuid": "578ca727-f4c1-4e22-b258-57a221a124d5", "value": 109251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644958946, "uuid": "4779ecbd-c267-4f06-92f5-be6ae361d0ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958946, "uuid": "e8665b46-e76f-4af1-8ed7-c09519a9edee", "value": "beamer.arm7-20220215-2102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0df9688-8e60-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644930620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930620, "uuid": "b7ab88f4-9e4b-49cd-ae87-c0e0773a20a6", "comment": "Malware payload (Formbook)", "value": "0a0bdbc0ca35148497f489d4354dad2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930620, "uuid": "798626e9-201a-4ea6-a2c7-d24831bb1654", "comment": "Malware payload (Formbook)", "value": "b3b6f6f58e9df22dda93da3c41997e4c36b48b4e8e851a217c572a0b78ce4b83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930620, "uuid": "98a17b80-0374-491d-bc6e-8119feb5b516", "comment": "Malware payload (Formbook)", "value": "90145f41391e049d2b1a66017c23480ec6b5a621", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930620, "uuid": "9fe62875-fd1e-4704-aee8-8ce9c4418da9", "comment": "Malware payload (Formbook)", "value": "b2a09e7a6f0fe4c57c98bf735f1e733b81339808ae110ad74bfb8f4abf3b836aa03ba47836ddfe45cd4189b71b75b6ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930620, "uuid": "f8442b73-ce38-41ae-ab55-cf201d13ef17", "value": "T1EBF4010077B36A94D43207FA54E59A811BB9654DA937D67ECE9230CD0C237C1DE3AA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930620, "uuid": "0272d002-2d0d-4c09-a40c-ebb77abe33ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930620, "uuid": "56645dd9-4e4d-43e9-8e00-0280d8f6f5a6", "value": "12288:Qj5k+oJdrR+v2yU6xsd1jXywJCGfFqX/OAP7CjDElvXj7OpGKWwtlp/D:Ia1rrRo28x6BfEvOAP2jAlfePp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644930620, "uuid": "0fa6a279-0327-4133-97fb-840f42a7cabf", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644930620, "uuid": "98f58608-8602-43b0-ae5d-c98a3413ad9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930620, "uuid": "3ceec8ec-4eea-4502-817e-6d4b44006c53", "value": "SecuriteInfo.com.Trojan.PackedNET.1197.7712.18516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4844a501-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1644952806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952806, "uuid": "6afbe99f-4b76-4cac-bb59-e8239492334e", "comment": "Malware payload (GuLoader)", "value": "a7f4ebce0c80d8d84d34b2b5b616c00c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952806, "uuid": "ea0ea3ee-3c31-492e-8fbd-82fed5cdaccf", "comment": "Malware payload (GuLoader)", "value": "b434e54b1f162ec9a1f9e943e8829069c8e91ff4998acdb6f0e5aa34ceee1cc4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952806, "uuid": "d304dbb2-3e93-4a0e-8793-3cb4a70b62b3", "comment": "Malware payload (GuLoader)", "value": "b208e1d04afe1e4dd9d13f2015eef83a91813fe3", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952806, "uuid": "d594a7eb-222b-4f6e-b682-078d2600cbb6", "comment": "Malware payload (GuLoader)", "value": "a8f2702802368466ca68b5ed7070ce49d315b31eb9dfa432e4ccee24d930d84c48f507c35e7eb9930f4a355eb0f2d1a8", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952806, "uuid": "cb2db8fa-6063-4a1f-b354-79aa0e9c13f7", "value": "T1B625E0EB77CA7FA0E2BEC2B6C2F9892D56B370B35561A78A654041CD69113538D30B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952806, "uuid": "05d8e034-c8f7-41fb-b610-c6ae6b2f9f18", "value": "53e0abb1d2d83c9124293d124a46bccf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952806, "uuid": "a21ba131-73fd-4b1d-b973-83960d32a1fa", "value": "24576:wn35pPX1DBY4ZyrE7K3yt8PeVooA/lB2DePExV2wFEFueeOEibqy7r6rJ:oV2MNzNyqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952806, "uuid": "96b781f9-2876-46e5-8377-519ced94ab02", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952806, "uuid": "3f32db09-e24f-418b-92b4-18778e5747d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952806, "uuid": "9dc128bc-9f14-4d35-9ea6-1e1b97e32edb", "value": "creditnote.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2227520e-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644931696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931696, "uuid": "fec866fb-5bdb-4dbc-979b-0b4af686e3a9", "comment": "Malware payload", "value": "cbac18710535564c0e2aa5448732ab76", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931696, "uuid": "1f33bcf3-cecd-4360-9dfa-a918aa46d6c5", "comment": "Malware payload", "value": "b4fa3088597b4db1f6bc73be8eaaf9753d8c0b4aa1da4b1a2b9f63f44e0197ce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931696, "uuid": "70b69da3-108f-469e-b586-b9264580f9e7", "comment": "Malware payload", "value": "50e6d830a7883a936924abc79060204fbe4614a3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931696, "uuid": "da46a87f-f083-4d53-8967-c9e0d13bb970", "comment": "Malware payload", "value": "a228d4f51e19249f0341bf9400a8ee1c4a37d3179b99d0fe194ade02bedbb6f5e1e611235ec8a227d54e461ca0f5646b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931696, "uuid": "e4654a98-c751-402d-9533-5d0abb6978ed", "value": "T1248197C64F126611D4EBB3F0D0787B602B0AA14123FDEA069064FD42B5C30AED9EC66A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931696, "uuid": "1cfec764-db79-4ed6-9e80-c5399b78465c", "value": "96:U9leve2eYp76UAUch5lV8i77aZRWg8WXtWG3b:Elye2eY1uRqi77aZsqgG3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931696, "uuid": "2daf4a65-a53d-452f-be4f-f12a8cf28815", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931696, "uuid": "81715392-0e2c-40fa-a605-f29814368e86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931696, "uuid": "383922e3-6e03-4fe1-8c1f-7a3b17e44ce6", "value": "dxv3.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631fda6f-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1644952851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952851, "uuid": "357a5943-58e2-46b6-9798-ba241aa7872e", "comment": "Malware payload (GuLoader)", "value": "c0ca29155bf319033b71424250083edd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952851, "uuid": "9c8c940a-734a-4d82-a26b-54c1bb858dcc", "comment": "Malware payload (GuLoader)", "value": "b57d7de33914f91073e29ac243cc026716b4b4a2ffd3ad9235e407c73fdb4be8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952851, "uuid": "8037d791-6da5-40da-818b-c34ce56317f5", "comment": "Malware payload (GuLoader)", "value": "2a091f7b88dd5759c79807bd9165fbed3eaf8773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952851, "uuid": "a234e1a6-27f4-4abf-ac24-c8e35e465bc3", "comment": "Malware payload (GuLoader)", "value": "6e5c6b3a2ba4067ec4d7b7989a7edec0c7ee57e5445fa2cdcce53fcbe808736b5b90677f2d70c3bdb78f4de26ca7be9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952851, "uuid": "20e8b9d9-a1ed-4edc-b8d8-983deb2ca847", "value": "T1217412607AA2987FC5621A3539777F929FFADC2490FA5A0703647F0D3E736824A0E351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952851, "uuid": "8237e783-5533-48d7-9abc-b479e22d26bc", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952851, "uuid": "d384e2b3-a9c8-4839-9b80-205a1cb3d137", "value": "6144:sbE/HUjvaiyEmoiPHVcBMrbCtLiVaNTCG5w92oUjGmmpJpG1d9xvksNBk8UAuz31:sb/yiyoiPHVAMfCtTCow97UjGmg0d9x2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952851, "uuid": "8fcaadb9-ac51-464b-963f-9db439ac1975", "value": 360608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952851, "uuid": "7b8b1afb-2f39-4c91-91c5-13da86503efc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952851, "uuid": "647400e2-5e0e-4a34-af97-a3dcb437ad11", "value": "AudioAppZEXAQQHUTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffac79d-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932095, "uuid": "7aa12fa9-5443-4a92-a9e0-567853e210f4", "comment": "Malware payload", "value": "ccad3c4ea1dcfd536a8993f6f95ee3dd", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932095, "uuid": "e250fa02-769c-40d9-a3f2-0e0890b09b0f", "comment": "Malware payload", "value": "b6a4dcc1847eb8f9752d4899eb6a2d6a9d28b998d1f020aeeb4d917632abdbb6", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932095, "uuid": "709b1b9b-a01c-4d98-8f8a-7815780e4952", "comment": "Malware payload", "value": "0720533c1b45ef9b967ea56a6160ff2060969866", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932095, "uuid": "10c27940-9869-4a21-ae6c-209a2b24a7d2", "comment": "Malware payload", "value": "c65321001a9567683be055561c974e2039d13e638bdc56d6c5a0ada6c2849dba9b884513415429f4020f86285668d526", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932095, "uuid": "50ca3e57-b0bc-4432-994a-9642bb49aff9", "value": "T164130AF30153BDCF16260E51E50C3211EC59ECA771D899ACBF8888F58BE9118DDA8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932095, "uuid": "cfe7d672-2e58-46e7-8f23-9348b0fa5b0e", "value": "768:z3/Lt7hpYKYNfx++m8YFbUVm9X2kfgnt/XpXc3o:z573Y3fY+m8YFbU89Gkfgt/XK3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932095, "uuid": "c4e14bdb-0072-47dc-8654-b0cb9872a49f", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932095, "uuid": "4a3e2d32-45ea-4774-8267-d4261e759e17", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932095, "uuid": "f46f879b-589b-4ed3-aab1-5bd1f3334e49", "value": "multi12multi-comienzo2022.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5356f8-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644953457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953457, "uuid": "b39b4f8a-8261-413b-b3ee-3ed98df940b7", "comment": "Malware payload (Formbook)", "value": "9fec8dfedc3788e690281b2617d74b45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953457, "uuid": "05fd3189-54ca-44c1-b988-9089e8ed8097", "comment": "Malware payload (Formbook)", "value": "b6a5f7a958bdb00a9223004f9068976331ada2a513e921ab248ab71c5aebd59f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953457, "uuid": "0b6d0053-e1c9-4b41-8742-0565381fe4e3", "comment": "Malware payload (Formbook)", "value": "469326df6104c211d9de5031d640acfd9d53736b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953457, "uuid": "fdfa4f4d-613b-44c7-8c70-73dcc71e9dc9", "comment": "Malware payload (Formbook)", "value": "677d5fd4848f720b3e8635f9cb539e43b8087a68bc4adcb127f325df69c67a311d20eea1f72d6a5ad1b796698f8d9142", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953457, "uuid": "1a2f348a-abd5-44af-a074-923c378aef4b", "value": "T1B8A4D2D2F55EACCDED794CFB04F5A3C67C61AE1C0B028BD1A7A53A99937A2123C4C449", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953457, "uuid": "9768c90a-f101-4a7b-9b3c-788c4602bfd1", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953457, "uuid": "94685a06-a1ea-44e1-b7fe-f3fae4ea146c", "value": "12288:GFaiaYt958RSR+/InB4gr91PL2+p+dSiu:G5mRSR+/KJrrvpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953457, "uuid": "8e54d503-c916-48c3-92f6-60093ac94cf7", "value": 464322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953457, "uuid": "dfc6740a-4ee7-4698-9556-d9316b5731cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953457, "uuid": "00c72994-f2a1-458b-bf22-f298e2e3925d", "value": "9fec8dfedc3788e690281b2617d74b45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e30e26-8e67-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644933478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933478, "uuid": "9dd4177f-f02a-456d-a7d6-9723c0f5966d", "comment": "Malware payload", "value": "73d9bb426866f2cd42438949b7832207", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933478, "uuid": "971e783c-01d0-4fc2-b5de-ad21ac1c6211", "comment": "Malware payload", "value": "b744cbfc532b38500658430d361d337a5c11dc093426af6eee8fbe612b06a898", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933478, "uuid": "f6ca0ec0-b184-4232-b206-6df73cf5d729", "comment": "Malware payload", "value": "02c71cb4c5ae8d7c7e49a74e53df24b1c4742d03", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933478, "uuid": "2aabbb20-67c1-4954-a001-b2538f089a72", "comment": "Malware payload", "value": "1b4d4031b61993962bc022d82e91578151b59520710a3b6b5a9c2359bddde0edb2cd93a8e4686cbdf749112c3cd6ca2f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644933478, "uuid": "1f258048-5cbe-4515-930c-fdf8de890f20", "value": "T1B164E99EA155DC32EFFA63F551E5CBA3C15B8430236848BFDBFD9072153CA989238582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644933478, "uuid": "ca4d676e-17b0-4c2e-ab47-8865d71c251d", "value": "6144:cNU5LwA22222GgngDrDRVyYli/ci2tEGW78ODQiEK:x5w7YM/cYVV7EK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644933478, "uuid": "363096d3-dd43-4744-90d2-d61708db2585", "value": 310600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644933478, "uuid": "56adc8eb-9b48-4c7a-941e-580ae18e3758", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644933478, "uuid": "11758ee9-4be6-47a1-860c-3a989d27242c", "value": "emotet_exe_e5_b744cbfc532b38500658430d361d337a5c11dc093426af6eee8fbe612b06a898_2022-02-15__135753.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d629cc8-8e0a-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1644893463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893463, "uuid": "29fef20d-4595-4d89-85ff-1126d955f558", "comment": "Malware payload (Amadey)", "value": "ec41364ad0b6d53febf0660623d85f12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893463, "uuid": "fd9885c2-0e26-4164-98f7-3a47fd410f2f", "comment": "Malware payload (Amadey)", "value": "b75fb008c284cbb30cf9f2ccb638528e478208cde9bcb39d7cad901476ea2f59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893463, "uuid": "67312498-d532-4ba1-b3d9-7e1643d758f9", "comment": "Malware payload (Amadey)", "value": "7e59c3cabf3fc25b4e927e5e5d4aa7ae87776c41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893463, "uuid": "39f15edd-2281-4c99-91b1-65e23055116c", "comment": "Malware payload (Amadey)", "value": "64d418f9a6be4a112200d56cefd3a27fb82ef603e96222d753a55d013a52c791d27f36d4bd0568f62bca96511932fc47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893463, "uuid": "c8dc5ef7-a35d-4d36-a750-6c9c918f5ea2", "value": "T112659E01F101A136F8B340BBDEFE592DD668AA21130954E7B3D8594F8BA2EF27D32157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893463, "uuid": "7c6ca837-776e-42e2-91a4-6123c1b43df8", "value": "9448342be389a0b205628cd0ad7516fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893463, "uuid": "cdcaffd3-9ec7-4c0e-aed9-3c7f6cd04329", "value": "24576:MVNRBsF8n+wfrUgm5zIf15A+7zDP37Y2FfkutTzqze:MzROF2+wfrtxf1PrP37Y2JkutTzqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644893463, "uuid": "944f6d24-f5e2-4820-bcee-4be6bbbbd9f0", "value": 1464768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644893463, "uuid": "0a7113c3-7aee-454a-b42c-af717cb0d782", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893463, "uuid": "b03d8f0e-86ef-4d3b-ba6a-c689bffb2126", "value": "ec41364ad0b6d53febf0660623d85f12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d695bd74-8e48-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644920403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920403, "uuid": "79bfc398-cfd8-4d9d-89a6-f81ad1221057", "comment": "Malware payload (AgentTesla)", "value": "c2ecf75fb18ba5cfe6272801c1342b34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920403, "uuid": "a17514af-dc4b-4727-a818-98de8dc5c01b", "comment": "Malware payload (AgentTesla)", "value": "b7c392fdfb83df479372c77f3fc1e91fde1f1317ec3c944380e0262df33638a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920403, "uuid": "8b3f2738-d50f-48be-b799-647fe939c98c", "comment": "Malware payload (AgentTesla)", "value": "3f43209ea7e1ebcbfb25077ff4b5d7d5c2417571", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644920403, "uuid": "e0035843-10fa-4162-a337-40ea33dbd97d", "comment": "Malware payload (AgentTesla)", "value": "9eeb0e83523bd7b4219934958a25c77b4fedbd310e8c9a6f551ff5bf79e812fa1ffcb11bdb85655e60df5b56def855c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920403, "uuid": "c6fc3936-b78e-4f32-b9a7-a6153d2a3021", "value": "T1CAE49C2611F3D8B1DD9B86FFE510C98C6F64EA2FB042FEF98444D4BDD0AC6904686963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920403, "uuid": "36c8a0b1-9cfb-4789-8587-0d47dbfe0242", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920403, "uuid": "809ff3dd-c35b-4fe0-b0ad-3b4fb8d76159", "value": "12288:NaasVh+Dwa6+v+y61ARkcuKR1G3Wjmjkk+3EZqOMoWeVUE:9saDwa9RwKRfjmgZ3EkIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644920403, "uuid": "956a7321-faeb-46a0-af45-f09d62d0e9c7", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644920403, "uuid": "3717e944-8a1c-4ba2-bd76-7d5d90f7aafd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644920403, "uuid": "e1188782-0561-4dc7-80a0-5cda7694490f", "value": "NEW ORDER CONFIRMATION 359274.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c88c92-8e8d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644949800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949800, "uuid": "19e14d3d-abff-4fb0-822d-6b2d4d6df9ee", "comment": "Malware payload (AgentTesla)", "value": "3da7abf8fd67a2347f93bd37aed79aba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949800, "uuid": "cfe9b5d6-456c-42a0-81c3-a551a163e27b", "comment": "Malware payload (AgentTesla)", "value": "b7d03fa9a0dd9b482274592bb678ccf1a4c137ddb7e2a80add2d880e2b896dd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949800, "uuid": "8005d869-b24b-43ec-b655-9bead7fb301d", "comment": "Malware payload (AgentTesla)", "value": "a9ad985552a8ee9b083b096e4ee39a0acb8a6834", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949800, "uuid": "2a479496-2ee5-413f-963a-854682235073", "comment": "Malware payload (AgentTesla)", "value": "bc0bc3cab682f64f101c77374fbd6614b15b30d2983ab129c38e73c4786f91517918f6cd5e7794bf426d3021ceb283b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949800, "uuid": "028c8942-9539-4c3a-86d6-d359858d977d", "value": "T105B4239039314EB6EDA517F47BEF7E37B89882FD478321884D930E12437E51992B894E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949800, "uuid": "f05e7d6c-0e80-4224-b1dc-72c4b191471e", "value": "12288:Y0BA4NyJ+TQAlaCtwljSRNYckRFcHQElzQGg+q:YJai+sAlaCJNY9zKQ2zA+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644949800, "uuid": "1981fe48-033b-4f97-a53b-3f2c6a75bc65", "value": 533454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644949800, "uuid": "8237cbd7-34e0-4c12-9137-94d4fe598711", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949800, "uuid": "6a9f0567-40fd-4098-8fee-67543e3bab7c", "value": "FINAL_DA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9202da7f-8ea2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644958942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958942, "uuid": "dc012df2-da04-4ece-954f-387f3f32a579", "comment": "Malware payload", "value": "6161c92c1ea9f53dae28a2ecc1a4f5e2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958942, "uuid": "4847348c-2bb6-4df0-b9f3-6671a1578ed6", "comment": "Malware payload", "value": "b8047f767bad5a758b31e7a74eb13c2abb86a8ce22a7522fcc49ab58fa61ea27", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958942, "uuid": "77681d93-5ed7-4755-be78-72a074693ee7", "comment": "Malware payload", "value": "f8f4681dbeae960b7c4ba9a9392dd98e149e75a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958942, "uuid": "8a6128c9-3602-42ac-9ea0-11294169c541", "comment": "Malware payload", "value": "0856dafc990431b98f089b4c4b1edae6578ddd7071847c1f2b97c9c8c4831fa71947d9dfeebbc3c8217c0153208e6fb1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958942, "uuid": "3a261a89-64a3-4f1f-b431-4fd2a862b3b5", "value": "T1CBD22A85FA815A13C6C75277FB4E438D7B270798F2DA33039A1BAF213B87A570E26151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958942, "uuid": "ec8b14ed-2658-45ad-a833-0266fa8960b7", "value": "384:uF3ZN7MR/FfEnxAc7uM9FVVOBwKa6BlwzIadEVfHcwFTytiXYfYTePL:uF36/FfAAcSML8BIzIFV7Fv3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644958942, "uuid": "73235224-af39-473a-bb76-3a1425bc3584", "value": 30096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644958942, "uuid": "a5423d11-1152-4966-8a15-9dd2f70a89c6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958942, "uuid": "ea1cf6b4-3ab2-429b-ac15-ec0e9780a314", "value": "beamer.arm-20220215-2102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9359a4e3-8e8b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644949066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949066, "uuid": "383802f2-b326-418e-9124-4011e3c11227", "comment": "Malware payload", "value": "176c491d20ae855e423688ccd5934054", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949066, "uuid": "514781ff-9de5-4293-9136-cfbb6a841d16", "comment": "Malware payload", "value": "b8a0e1a22a8f6a47cbb335d4d968b1302c3d6f4883ffafeed566383a22d580d5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949066, "uuid": "d8390e0c-410b-4c5d-a93a-4c65fce9ea6e", "comment": "Malware payload", "value": "3c08d6901cef145047905e4f16039ba1fd0ee43e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949066, "uuid": "c74e529b-6f57-419c-8153-7f6de0f20393", "comment": "Malware payload", "value": "d81b739bdd2a9e9a486b473163ad052f0dd80bdbb76bde3eb1a39111d37e0c33c92bce139783a8353d28c51a73f68056", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949066, "uuid": "dcef1e7e-141e-4d16-8fb0-7031e74b5748", "value": "T1F4953345BE0EFB33D0BBA0BBDA9545C34FD5D849B2C9A5E005F074934AA825DE7B420E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949066, "uuid": "8d369908-c9fb-4556-8afe-ec85c50f8006", "value": "24576:xnNpJce79569WRklO/jNylL6jqjm2MUVR4W81k7lLTBrC6vz7irWEf3ZH7ukwYEB:xnXzlyUwGjq0UflpLTB+66RHKtYEQKEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644949066, "uuid": "09ec6dae-b4a7-4bd6-87d3-e223d16aa343", "value": 1920784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644949066, "uuid": "ed0af01d-a6bf-4b1e-a2be-35f32a9c5d71", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949066, "uuid": "a8ad6cbb-70e4-434a-9eef-f0210184915a", "value": "ge9ckm498c_Receipt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335b120f-8e82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644945040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945040, "uuid": "2fd14756-57f3-48e7-a915-4446260a68f8", "comment": "Malware payload", "value": "7da994ca9c99858f02f1c73b11d71f89", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945040, "uuid": "74a5924c-7eab-49be-a145-b5a1c0cb82b2", "comment": "Malware payload", "value": "b92e77fdc4aa3181ed62b2d0e58298f51f2993321580c8d2e3368ef8d6944364", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945040, "uuid": "59cdf7cc-1758-462d-9acc-3c2618f1d92c", "comment": "Malware payload", "value": "a47692b3c1eb781ed2a31a1579dd351c8de80fb5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945040, "uuid": "0fc62355-80d3-4d18-a717-a4c42b6ca5f3", "comment": "Malware payload", "value": "e3e09376067ba7081a0b071b4736ba7a321119ffb069e09470f6a37c18f578e45f6100a9735258ee85de432d9d89974c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945040, "uuid": "02cca2b6-3bfb-4ead-b037-51f053e682bd", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945040, "uuid": "ae640334-e463-460c-bf75-080f3e2943e7", "value": "3:TKH4vWJP63FBCTuEv5v:hgGB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644945040, "uuid": "ececb938-a372-41d4-928d-165235afc863", "value": 47, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644945040, "uuid": "2984a6a9-20f2-4f23-883d-df7799f8b61b", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945040, "uuid": "2b96bafd-7d57-4d76-8daa-c48d0db743e8", "value": "slow", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631974c2-8e30-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644909901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909901, "uuid": "b15d00c7-e308-4e0b-a601-270c42c29d73", "comment": "Malware payload (AgentTesla)", "value": "3bc5d48e059091ad7bad2314dd61be65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909901, "uuid": "7e993b06-e9b9-4c0a-9273-13486da62e9c", "comment": "Malware payload (AgentTesla)", "value": "b940b5de107ce0167b1c0571795e10fe2ee4dbb38cd0eb658ac9979694eb24dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909901, "uuid": "cb433412-017a-42b5-a738-12aaca11ebcd", "comment": "Malware payload (AgentTesla)", "value": "c663be995787911a7b4e7c8cd0743954cdf46a78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644909901, "uuid": "1041a077-5d7a-4abf-84de-e64059fded6c", "comment": "Malware payload (AgentTesla)", "value": "d2301d5a4f9cb4cd83e0f28735968b08afac9df86472636cfb705492d50692f5c69c8a7bbe7b68fe91726100f2f4375a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909901, "uuid": "9a1a7de9-c7a0-4d3f-bada-285757608a79", "value": "T144F3F1153640C87BE5A79330493A67BB4EF9E63125A64F870B517EB87D333918A1F322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909901, "uuid": "f51d1ed3-dd78-453b-b804-6115d111fdd3", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909901, "uuid": "1d8e36e2-9943-420e-a397-7a5dc54b1bb1", "value": "3072:jbG7N2kDTHUpouDT/FjbQMDROyYnF62uby/ROr7Ey0tACPQ:jbE/HU//5QMdqnFjubY4t09I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644909901, "uuid": "aa48c7b3-bd19-4da3-88dc-209149a24651", "value": 162824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644909901, "uuid": "52b16142-ed93-4d3a-a654-62cefb8ec6c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644909901, "uuid": "6abfd225-e127-4a8a-8ddb-92c990810cc5", "value": "Pejlestok8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2b98a2-8e56-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644926344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926344, "uuid": "b39cd269-a46c-4347-b88e-1ad8561e4f06", "comment": "Malware payload (Loki)", "value": "029ee59e93b91e7b53aea68aa3d31906", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926344, "uuid": "caf762ab-807d-40ec-bb14-0fe21fb4ab07", "comment": "Malware payload (Loki)", "value": "b98d87718d8368b86ecc76bc0e95a1455a78239b8ef076c535f3219587861be3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926344, "uuid": "cd58b900-e4c3-4852-935a-ca94af73e486", "comment": "Malware payload (Loki)", "value": "619c1a016360d7ff0fb630cf073343904459d16d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926344, "uuid": "9dd13fef-5114-43f3-bc22-35105d1c96e9", "comment": "Malware payload (Loki)", "value": "b67a63a57e4d3b7c59f2d6d9e59048c5c0f5f66bbb7ff9014b61612a70bb718585106b2ff1fc9bb130ed67c113c6ce19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926344, "uuid": "2efa0ad8-0ff4-4fcc-9870-1beda7d32e17", "value": "T1F254121DA6D98CEDF2DF127221778927EBB0AF0036506A4BC7940E2B7C944D7DD28693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926344, "uuid": "6d853528-ae83-49a5-a8c6-697f09634d5d", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926344, "uuid": "e19c2d91-7b1f-4d8f-a8ea-f4f4367971b6", "value": "6144:owNC21FAg+IwmJ8UXx84uKBRgDlYp1PJ4wCREW8qKAB0fo75p5G2HQDVA:xCNmJx0KBgle1PawCWWMAx5p0BA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644926344, "uuid": "239f7f6b-ee15-4b86-812d-563cb1be0c04", "value": 288363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644926344, "uuid": "17602f2d-dcce-4bdf-b6b7-8c1700055843", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926344, "uuid": "b4b3ea70-03c0-48c5-9db3-27a46f3c5c85", "value": "scan_01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a38fac-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932019, "uuid": "8579ce45-a5bf-4b7b-9cfe-03b2f20d37a2", "comment": "Malware payload", "value": "1ed78e0b7e106bb448cf727fefc48219", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932019, "uuid": "4f4f92fc-c292-496b-a66d-1cd69daeb7e0", "comment": "Malware payload", "value": "bc6256583dafe0aa5112ceef24a6a6c959ac4686ea5506f2250410bca3fc72f4", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932019, "uuid": "aa257e15-bd30-4def-96aa-27a6532af895", "comment": "Malware payload", "value": "7335d8257069471492bf000e10d644497d57456e", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932019, "uuid": "ed4f1170-de62-4f0f-a101-feec76c110aa", "comment": "Malware payload", "value": "0bcfeb30f5ce88689e2321e4116f96990c1ce0792f29be4d43ef9765f7d9cd83480a774bfd778592a9aa1e4f2b99d51f", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932019, "uuid": "e2782e41-946e-4215-baac-02bee5e427dc", "value": "T1B11308B30623BDCF17270E41D50C2151DD59E8B772D999ECBF8888E58BE41189EB8EB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932019, "uuid": "dbb92944-d690-4428-8d79-ea8586875b06", "value": "768:9fpxjJt4KaeqDA0qj8fUaoz1wx2BQAm9u2kfgnt/XpXc3Y:9/4KxqDAK8aoZwaQ/9hkfgt/XK3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932019, "uuid": "3f474cc6-0fce-4f9e-88b1-35d54a95be53", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932019, "uuid": "d8e0bb14-9fed-4de1-b483-415cecd2a808", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932019, "uuid": "3013495e-4d28-4298-ae03-b3998455f04c", "value": "jak09-02.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35b2703-8e60-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644930732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930732, "uuid": "396e4326-0393-45d0-b384-f7193236dd98", "comment": "Malware payload (Quakbot)", "value": "ea69f15614a74d40507da78f384e6a26", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930732, "uuid": "3dcc3031-e324-4752-831a-b6d3afa6a1e0", "comment": "Malware payload (Quakbot)", "value": "bcdecf8b43d8ed3c3faff97989ddf1aea315b4dd8c6db67f012b1b10b45bc7f4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930732, "uuid": "6376e6d0-0d61-4468-9c1e-f78fbe209aa5", "comment": "Malware payload (Quakbot)", "value": "54a683d88a66a549dc7fb3ffb359141ae1c9c063", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930732, "uuid": "eecd0c42-e0a3-43bf-b7e1-2f160806ef2a", "comment": "Malware payload (Quakbot)", "value": "79c57d50ca0dd688ef70e6d88bb5736036d4b456a995654348057627e3d90db950958f93e2b31892550f2d7865c10aa6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930732, "uuid": "041e40a5-a578-4bf7-97c9-82a25877c2fc", "value": "T161050A9DA3D01ACEF1DA28BC761823D90F960FF10A7EA073E1132C8516B51F94E66B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930732, "uuid": "0e424de7-0d43-4348-a444-826913d53d06", "value": "d8b6fe98d2b0a8d6f73ca1ea92363dc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930732, "uuid": "4ac8fb7b-12bd-4cd2-9ea3-21cf165e77b6", "value": "24576:g74I8i4ZOpi+cQcFRnb9lgo+1TAaKBsXg:5i4ZYi+cQcFRb4o+1TAaKBsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644930732, "uuid": "d0aeac43-4a60-49b2-ad25-a505668505d8", "value": 821282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644930732, "uuid": "0210911e-22a6-4d81-801a-100e1c04f39c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930732, "uuid": "a5924723-e921-47e1-b960-d13f1484b322", "value": "bcdecf8b43d8ed3c3faff97989ddf1aea315b4dd8c6db67f012b1b10b45bc7f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b833ef3c-8e0f-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1644895870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644895870, "uuid": "462b56bd-237a-483f-a94a-32b20a806926", "comment": "Malware payload (DCRat)", "value": "affa90aed3528b47230bfc38628fc409", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644895870, "uuid": "b7f0090a-dfa4-49be-aff4-eae8ccb3eb91", "comment": "Malware payload (DCRat)", "value": "bde5677139804801b06f481a12938995ea2f2d214bd2dd0070630d3de8ae22f5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644895870, "uuid": "46625472-c64b-49bd-b9d5-360818dc672c", "comment": "Malware payload (DCRat)", "value": "853c565c23051c6391767aeb89f079fb0e7a08d8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644895870, "uuid": "d27393d7-248e-49e4-b8fc-0f5fc1a8452a", "comment": "Malware payload (DCRat)", "value": "baa31fd2c47cb919ba2158cef5bcc3910c300c2066161b2d2c1bed866870c5df9ce7d121a905a908968b41885fbd1901", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644895870, "uuid": "175b7993-5f66-45d5-a4d1-a1c75d5b5f89", "value": "T10E354A0A7A44CE01D0AA1777C6EF441443A8AD41BA72E75ABE6F33BD25113A71E0D6CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644895870, "uuid": "a4f2a080-f051-4c96-9bbc-38fe308ea51a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644895870, "uuid": "9f2b395b-dd14-4a32-829d-6f58c1275cc1", "value": "12288:CT0SFr+1PFBg0/OotJEfmVUFIWZOiEEQZVmO6CNyyzz0jqaTDjvWkZXB/GgT1D:5Cr+xf/hJEfX5flO6reaLvz/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644895870, "uuid": "b289447b-ae47-491c-bcfd-2d8b4595b58b", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644895870, "uuid": "ce82ab72-c5b1-456f-a70c-c29a0991c668", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644895870, "uuid": "a0192130-70a9-4c90-aa4f-637d81ec15e9", "value": "affa90aed3528b47230bfc38628fc409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad74069-8e0a-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1644893539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893539, "uuid": "c8db0b4e-7184-4037-afa8-372b16cedb6a", "comment": "Malware payload (Amadey)", "value": "a82d160bbf5229ddf41b87d855df3c37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893539, "uuid": "3f0666a9-49ef-4c56-b7b1-ff1d44ee3c70", "comment": "Malware payload (Amadey)", "value": "be89dabca41d2f1aedb1cfb9db712e5f3f728bbc762e0a62d4b113fdbdc8618d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893539, "uuid": "ad396943-a9ee-4f55-9213-31cf416a9ce9", "comment": "Malware payload (Amadey)", "value": "909c5fe1e486a7fe40fdb7a51e229bf7512734ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893539, "uuid": "2469c874-71f4-4cde-8e77-8c9b9cadaf21", "comment": "Malware payload (Amadey)", "value": "feb22d00c063a2c58c97ba6e990372cc41b9dfc2267d3180beec7ad4c4764d432cc7789d93d4b26352b1e9a2d2612afa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893539, "uuid": "2d46871c-824e-434b-b58a-12b4334e8884", "value": "T100658D01F101A136F8B340BBDEFE5A2DDA58AA21130954E773D8594F8BA2EF27D32157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893539, "uuid": "53b9f39f-141c-4342-85e0-ea95f252be4b", "value": "1dbf371d6ff4bc67448eee944b182cc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893539, "uuid": "5c40f43a-02a9-4238-be28-8ba30f9f0a17", "value": "24576:mUBhkDNoybk84g1HD/o7fQDPfG2NGL7OhT+YcA:mUBhkDiyB4Y/ojgPfG24L7KT+Yl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644893539, "uuid": "9291e1c3-73df-4292-8d96-d192faacee12", "value": 1464768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644893539, "uuid": "e860f80f-390e-4704-a248-badc8218f82a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893539, "uuid": "bdd2f70d-f67b-4132-8934-53bb5b272b8e", "value": "a82d160bbf5229ddf41b87d855df3c37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb24fa3-8e41-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644917277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917277, "uuid": "77eee063-02d8-4861-9f1e-16df7bd6536a", "comment": "Malware payload (Formbook)", "value": "a5da56a201f38ffb86844a993a723650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917277, "uuid": "3b640207-7540-49c7-ae52-173d6cdfa38c", "comment": "Malware payload (Formbook)", "value": "be910ed7df930a3d74f01ac74e72f8c3ed89d791f29b731cb2076d632b6ce9cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917277, "uuid": "65b6256d-5517-4022-a00e-42e15dbe9b79", "comment": "Malware payload (Formbook)", "value": "c56dbd64dbfdc0b4997fc004efb9b3270c2c2696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917277, "uuid": "c9c62673-012d-43a7-a206-36ef4f61facc", "comment": "Malware payload (Formbook)", "value": "7e7f94867d59621ca70d2c6bc94cb5bbe13c41363b3bddf817bee4113a351d9fa033793d85f89c68a0309393fe94731f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917277, "uuid": "63596842-6839-4937-a0c4-8a4145227572", "value": "T183259E23B1508472D9321B799D1B57A46919FD215D28AA8B3BEB7F4D0FFE28034362D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917277, "uuid": "2f8ba8cc-3a5e-423e-8a30-3134ba7d287c", "value": "ed7200529d98ae266be09ddf8296ccc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917277, "uuid": "8c9c6208-f63b-47c9-b4ff-876ac1497887", "value": "24576:fxnYW9BukboCqOMlfczkYY/5wtAb81KzvT+SN6:fxnYWbWl5YYhH8Qzvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644917277, "uuid": "0275e48a-9d92-4bfe-85fe-df54000b7df7", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644917277, "uuid": "8d4627b4-3554-474a-af37-a334849c1255", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917277, "uuid": "dcf0830e-090c-47fd-a48d-b1d39146bdd2", "value": "Confirmarea comenzii.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6f7a9c-8e6a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644934747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934747, "uuid": "e23e8faf-9f63-4b3c-b68b-d1ad67ca0fbd", "comment": "Malware payload (AgentTesla)", "value": "3595883a8e6829c9d69e288729f33dce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934747, "uuid": "c9da0394-ac64-4c68-9837-c765e62e807c", "comment": "Malware payload (AgentTesla)", "value": "bff88d0b6e6d1e1940c8873dea86299649d5f6a601b33c075f2d1f3adef4ed5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934747, "uuid": "75b9adbc-9797-41ae-ba71-66cd96b320f2", "comment": "Malware payload (AgentTesla)", "value": "4c1c1b3184cb9dca6381ac7ee9980551fac27eeb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934747, "uuid": "ffba5ad6-1e72-4c16-9dbb-9ec67afea66c", "comment": "Malware payload (AgentTesla)", "value": "7e8ae65a1295d134bab8f0be067e399b265630d3c515026de514ab9154f58e3a694e05239f1e6918f0b5875a43f10984", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934747, "uuid": "22764f77-83a8-4b5b-a595-24b975306626", "value": "T1CD452300A33BB275D8B00BBAD8A2897A17F9EB1D1147DEBFE57731990AB73845930135", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934747, "uuid": "d2aa3380-59d6-410d-b26b-dd8340500fc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934747, "uuid": "eed494dc-d619-40e9-9041-ff8b6ec679b0", "value": "24576:ogo1siUz0ZjhF4nM+KMs1/gyLkk29F/MbelfXS7:ogo1sfKlF4MdV/gKkdF/MalfX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644934747, "uuid": "ee2b298f-bc90-409c-934f-ea7354c7bf75", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644934747, "uuid": "05b9194d-05ff-41b0-988e-0f92fed2dde8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934747, "uuid": "463b09fc-71c4-492e-8584-249dc8dae759", "value": "PO-DSK126202201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad393faf-8e7b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644942237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942237, "uuid": "ae1ef61c-678b-432e-9e26-dab5d6e438de", "comment": "Malware payload", "value": "0ed1c3e9e2b5e9476a5b3e62caf3af34", "object_relation": "md5", "Tag": [ { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942237, "uuid": "9ba53e21-7609-4c97-8177-70c1d6c36ce9", "comment": "Malware payload", "value": "c11fc3734396847d2ca1ff9daa69602c808636c8bec4e69f1bba3032d46a48d0", "object_relation": "sha256", "Tag": [ { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942237, "uuid": "89e78348-ef54-451d-a721-1db184143b6b", "comment": "Malware payload", "value": "1466bcf88d3968e66c74d797e47e08426e5bb8ef", "object_relation": "sha1", "Tag": [ { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942237, "uuid": "9910534d-d6ae-4f0e-9d39-78552070d194", "comment": "Malware payload", "value": "74c22a10f47edb83d1834b49ba25d9ed51312a94fb8db97bbb88a870e66542e24bee8855cd4fd54b93138e862fa3c224", "object_relation": "sha3-384", "Tag": [ { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942237, "uuid": "f9d34060-4e4e-4c85-bb65-7f37ecb5976b", "value": "T13844230D01AEA19B92747257A3BC1B37D3C985FDCB50CC1BBCA31AA8C721A2A44D1F74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942237, "uuid": "614f0856-4846-4a00-85fc-cdb0a91ef01c", "value": "6144:h9bLf4W1xwGF4muaUZ6X/UiaAmHtM8IKk2tWsvns4GM2Vb:/LTxGjaSTUjLfM2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644942237, "uuid": "4eaf3a51-4226-4f5f-98da-9081cfb47665", "value": 253905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644942237, "uuid": "5255780c-a1a7-4d40-81db-3789553b966a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942237, "uuid": "73754bd5-9a78-4f1b-9456-172408856447", "value": "Summary-398087742-Feb-15.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c356d657-8e47-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644919941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644919941, "uuid": "98d226d0-12cc-4b4e-8897-e0b906144912", "comment": "Malware payload (Formbook)", "value": "f24bb073090854be27d8e1ff07199c7f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644919941, "uuid": "165971b8-778a-4191-b183-cf538befe18e", "comment": "Malware payload (Formbook)", "value": "c1d4a67d6111975f4c6bfdb35ea223c1574fe880cb9a4de539887199d0dcdfb7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644919941, "uuid": "cd8a0513-1f73-4bdb-ae07-5defad25596e", "comment": "Malware payload (Formbook)", "value": "0b3f8f907c217e7648cef3e13dddef7d67406dfa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644919941, "uuid": "9af280e9-03ed-4dd8-921b-7a9ec78a651c", "comment": "Malware payload (Formbook)", "value": "7327693d64115063c89287a7b1dc0a580d800dc0da66c6a4c4c89dd04f7a7f230ddf440c5050a01b20961431ef2d0700", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644919941, "uuid": "55b14862-b8c5-4546-af69-8023e1a1a2e4", "value": "T15F54239075528EC6EC98E27025D9CBBD70667E268606FF8F0AD08C460E453E54CCEEE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644919941, "uuid": "286ef436-b417-4b2f-af16-f1740f84650a", "value": "6144:JJ4aZwWMUy/xkIIgDjgghZtt9gzTrPk7vZgTwCNIMLd59uV+E:fhZhM1IgXPZ39WYuuMJ599E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644919941, "uuid": "4182f1ea-dfdb-4fc5-b2a2-9dbd93f18866", "value": 287601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644919941, "uuid": "0079009f-831c-404e-8edf-8abecf10c4b2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644919941, "uuid": "8e9175ab-5213-415a-b500-a49d6fed865c", "value": "new-order-002.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0e5f0b-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644953166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953166, "uuid": "9df5b755-b3cd-4f1c-b355-7aa7bd05eefd", "comment": "Malware payload (Formbook)", "value": "a68ff2fc653a3c4fd29a2c810b0f9647", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953166, "uuid": "47198404-f97a-471c-a04a-4dae8658cf69", "comment": "Malware payload (Formbook)", "value": "c1e92f71f62f2622e3949d342668ebd5719901693a88a78c6788844f65edf7f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953166, "uuid": "e564019e-32a0-4849-8d28-82ce2d325b8b", "comment": "Malware payload (Formbook)", "value": "36f53fef00bbf51a47af2231f6c6ad68d471e733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953166, "uuid": "a8f79a1b-dc38-404c-9e2d-f84617a6b90b", "comment": "Malware payload (Formbook)", "value": "fdc4a8de3dafe23de025617016c0c21f2f014e240ece301bc8e055242d856cc651afafb4bc99d64955e1e478d36d3682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953166, "uuid": "8ee5ee70-99e8-4e0d-9d05-7d62bf56dcb4", "value": "T1B0542311B9D2D55BC95B2BB60CA3E939CBF8160013326353AB315FBE7456182AB73386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953166, "uuid": "b09b50e1-19b2-43cb-ad9c-270a16a8aeb6", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953166, "uuid": "4641416b-4216-48d1-886c-534e2e5a9644", "value": "6144:owYJHnBQLcDOonUGAq/fpDsp4wcItomtlu9i+AWHtKXr:E9NDZ7dnmpJtlu9iw0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953166, "uuid": "0e3402b9-d3fd-45f7-8584-596bc5c06df9", "value": 296733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953166, "uuid": "c8fe0fad-fcbd-4886-89cf-f446cd21f7b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953166, "uuid": "b1d83a2c-c812-4228-9079-7185328d9ca9", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a161120e-8e24-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644904851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904851, "uuid": "a795a6dd-fe64-4953-aa14-735563e27118", "comment": "Malware payload (Quakbot)", "value": "b569f4d9fdf086d4e8c613d932d8ea10", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "quak", "colour": "#A4F434", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904851, "uuid": "f5c2a4d1-184a-4986-8b66-cc0c8bca2790", "comment": "Malware payload (Quakbot)", "value": "c30141d6ee93bea5e69d45f4826a21edf8fc063e38d1b5eb493f1d9ef5aac213", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "quak", "colour": "#A4F434", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904851, "uuid": "2e37fa6d-0425-435d-ae5c-632118ec5b64", "comment": "Malware payload (Quakbot)", "value": "a59ed45af1dd8aaf86393585ab03ef7b9478399f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "quak", "colour": "#A4F434", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904851, "uuid": "ff8c41a5-fbdb-421e-99aa-c2056b1ae571", "comment": "Malware payload (Quakbot)", "value": "a4fd05038b66b45ebf2712f6137dfeebb78fa42bfdf38b25f2f75a92a1f8cfec8334c80689fb9ea4ac6f07c4f90dd95e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "quak", "colour": "#A4F434", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904851, "uuid": "7c7e8551-b0a2-4fb2-b593-74569d5664de", "value": "T1D7358E3271C1D5BFC4B23ABC9D6A71A588257D520D2CCC0DBBD84F4E0E7A691673229E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904851, "uuid": "450f65c5-1fba-458b-95fa-805a8190c833", "value": "220ea7972e993d1cdbf761cab8a71a9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904851, "uuid": "f9157ea3-778c-499a-a8c8-b0936fde4131", "value": "12288:mt1RcM1gmtlMFHvP/AT0qUyF1XPPzXTwnUV1cQ47gZckpPWUyQVurP6lbuiw1rPc:uuwgYKvPteX5lNEZYywP/411KQtg9FIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644904851, "uuid": "ad35d516-c242-4784-899a-04c866957062", "value": 1098736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644904851, "uuid": "5546a945-8d23-48d8-84c5-9cd622faf49c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904851, "uuid": "74812f37-a88a-41bc-a02d-1ca22f7dab92", "value": "1621832826316290.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639b88e3-8e3f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644916344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916344, "uuid": "1f494490-a68d-479d-b739-d429e5320e2f", "comment": "Malware payload (AgentTesla)", "value": "a6610bfb352d465544aea1418ddcf512", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916344, "uuid": "403d5eb3-387b-401b-9979-ef931a15ecaa", "comment": "Malware payload (AgentTesla)", "value": "c34e0ebf8d0736e05d8ee052c06d1c4b8b45d01669b7e74ea60d9930f3ecab73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916344, "uuid": "12a7bd18-78ea-41e3-b5ef-7b3e906b04cf", "comment": "Malware payload (AgentTesla)", "value": "69cc79cc8e2b06ebcf5cc52a105e7569e44f6152", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916344, "uuid": "aaa6a565-2988-435a-8783-1b51640d5572", "comment": "Malware payload (AgentTesla)", "value": "f10f2853a0d30c1433c73ec701f5c502a1a02256751a0afcef788af5eb8f403b1664653b95897dd12cb51433a2e26e69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916344, "uuid": "9ecf592a-0e3e-4480-aa9a-4b37cf265e39", "value": "T1891412913A7220A9E7DB26B778BF50B0F095ED09059D396E43F1705A7B303058C9AA7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916344, "uuid": "893d276e-37b5-4b53-8ca4-fdef550983b1", "value": "3072:yjFSINxQqHHdD7bPel/3lrT/+d+/+rrnRL6arN+zkjaLmrU+2H8E5jyYDiS51ZKP:uZNHgnyNrjQ+2H8EnDiSvZKTD8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644916344, "uuid": "5f3bb878-c63b-4be3-8bee-add952742804", "value": 191784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644916344, "uuid": "4446f02b-a610-4fc2-a7cb-12b47c5a464b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916344, "uuid": "83052580-4bce-4de4-bfaa-5246d557dd91", "value": "order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05cc9e0c-8e44-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644918334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918334, "uuid": "5fb1660c-bfe3-44b3-8e64-1e12e3b7faff", "comment": "Malware payload (AgentTesla)", "value": "758c5716fc808b4bdebe79b4facc5318", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918334, "uuid": "2839f8fd-4408-49c6-bf71-bc509169a6bb", "comment": "Malware payload (AgentTesla)", "value": "c37c0759ac0a7ebf897362e0bb0ed25e02bf13103fc00d682e0e99b3d9df465a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918334, "uuid": "94a128ba-e1ae-46e8-a086-dcb744956087", "comment": "Malware payload (AgentTesla)", "value": "1849b537bbd2b85e4c6082e3ec3c84afbf23f2a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918334, "uuid": "ab68daaa-0af2-4d63-a8da-16a1ff3cf39d", "comment": "Malware payload (AgentTesla)", "value": "fda22c04be560db0d0800956211b41530e6d434bffc1d8e31c51e36429c5a7f493be7b3c9761f805b721941a9cd6b4c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918334, "uuid": "72694d39-51c7-4d0f-a415-352e3a58cf3c", "value": "T16615CE2533F3C8B2CC5B46BAA451C78C6F64E92BB542EEFA8540D07DDC683D14A528E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918334, "uuid": "03178b68-0093-46b1-9aaf-d3baffa3d888", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918334, "uuid": "723ef58c-0640-4b3e-85fa-981673ac7f74", "value": "12288:LmasVGkPeGa3UXOJcozKP4sTXQPDb2/0WyZn3JR8W6szcQG67S+9Gf1NyK:PsfXOfKPZTa6XypL8W3z7G6G+4f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644918334, "uuid": "b380c78f-dee4-4065-ae64-31503c48cd56", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644918334, "uuid": "73ce18ab-fafc-45ac-bb53-7fde2729d573", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918334, "uuid": "1002e9c0-bf0c-409f-a4fd-439fd84e1c95", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d041f98-8e01-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1644889570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889570, "uuid": "46ea5ab4-4095-456d-81e3-97226cd50173", "comment": "Malware payload (DCRat)", "value": "ae7029af2ed984922ee92d2acf8495ea", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889570, "uuid": "251a78e8-b70b-4e5a-9843-d94d3bc2c502", "comment": "Malware payload (DCRat)", "value": "c45a624b560c7b5aed57c94ac89d90d5056a2b50ba813a8b152c5e7cebba6a7b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889570, "uuid": "afc9df9b-60e3-46c6-9088-821a5d0b4f09", "comment": "Malware payload (DCRat)", "value": "9c6b84d2fc6a8eee44901a75dd9a4efd4d0b4f1a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644889570, "uuid": "52f2fb0a-2615-4f64-9b3c-453dcc8a7cdd", "comment": "Malware payload (DCRat)", "value": "d842316d04f89b2e9e867c92a4a14f0a40b0cc3b93e842d5b58dd8753d71eaa7ca954a5795481ce732f074e8a83e83c7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889570, "uuid": "b8304121-bb14-4060-b11f-c7f1f7a12b59", "value": "T17C455A027A84CE21D06A1677C6FF451443BDBE012A22EB1B7EAE336D65213A35D1D6CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889570, "uuid": "1e2c43ed-11b6-4429-8735-24bca159c802", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889570, "uuid": "e7ab096a-6aba-455e-acfd-1b7acf6d20f2", "value": "24576:U2G/nvxW3Ww0twXIMckUwTLYNWJNdoGf8:UbA30SDLx3B0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644889570, "uuid": "8c2da45e-6151-456f-8459-f8ed8347fb0a", "value": 1211045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644889570, "uuid": "da186b04-725a-45ed-8eb8-669f879acbf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644889570, "uuid": "40dde5cc-766a-4e28-8fe7-5193e53a86ed", "value": "ae7029af2ed984922ee92d2acf8495ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d01fb8f-8eb7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644967846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644967846, "uuid": "a9ae5d07-a3d3-4da3-b3f9-216801c6009d", "comment": "Malware payload", "value": "a7dff4d49c22e8facdd392bdc3524971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644967846, "uuid": "718216c2-2966-4ffa-8489-1794898cfcf4", "comment": "Malware payload", "value": "c57ec94c7fed128887694b07d817af02c2d19aac98d8d1fbd4004a8accee4ee5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644967846, "uuid": "1e0945c8-8f2f-4181-b539-20f530c069a3", "comment": "Malware payload", "value": "8b1968df74250ca96393064e13ad7e0a074c815f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644967846, "uuid": "2b10bf5d-1e93-4493-8be8-94feeb366e1c", "comment": "Malware payload", "value": "0a9921fec8023c217c0def6949aef027f7adfef81396256a77a70d742dad56a8d6045f09624f58bcd85f287464896db8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644967846, "uuid": "69cca16f-a23b-4835-93f2-fe7fb0c60a0d", "value": "T15E36339177F18D6CC038D1B0E6B4C50F39A4B2F352C8A98761614D8A7A47A7EC61BF2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644967846, "uuid": "c03d328d-5496-4999-ba9c-5875c4869761", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644967846, "uuid": "57973afa-2759-416f-8ff8-db89ca16deec", "value": "98304:hxHMMRPeAELO5STBr7ZILjuPHE4WrguUbG7TjZqklKu8+kbSTJ0+p1KV:DFPDEL+SRZIXeHE4WrgVC7TjflKFwaEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644967846, "uuid": "5954af4d-901b-40bd-a792-1d460968883a", "value": 4879872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644967846, "uuid": "93737a45-e2e1-43a2-aeec-da554a41951f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644967846, "uuid": "da578bba-9528-4962-8a62-64a64d15f699", "value": "Cheat_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce759693-8e40-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644916953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916953, "uuid": "9fe28e0b-036d-4d34-8680-225dc3993130", "comment": "Malware payload (Formbook)", "value": "d648403ef05db48a59e15483616a0d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916953, "uuid": "a903ba60-c45e-4496-a31c-c661657a57fb", "comment": "Malware payload (Formbook)", "value": "c770def66ece0d6100ca50a3b54898be0c177e7d0baddd8803785571f83c1c1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916953, "uuid": "a9b42751-2d8b-44d2-a382-cf7daea3695e", "comment": "Malware payload (Formbook)", "value": "614c1d948e5eeb8adef73f6df3f7a7ed59e3f11b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916953, "uuid": "63aba87d-8af8-4b7d-8895-abe800686f26", "comment": "Malware payload (Formbook)", "value": "3eee51af36f6e1ae497ed784178ae2bd57ffaf94e9dff9dd9e609988629aff2293cf141e8f6131b271bf52284395025f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916953, "uuid": "8291097e-cf68-43ee-bcda-65317ddd9dc9", "value": "T1B854230538D2D893C9454A7108BAC77B93F5AA682717DB8BD7780FFF211A0E386095DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916953, "uuid": "1ef833cb-8ef5-484d-8c98-04ed39b85bf7", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916953, "uuid": "f7cb45e3-bd04-41de-84f7-710b8e802c63", "value": "6144:owl8xzVyV6+qW7j2oTbEsRwuxezBFEH0sJik3MiPzI7hUN:B8xzVyxqGTb1wuxezn6+iQhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644916953, "uuid": "da0bb534-49c1-4602-914b-a22b2b90f4a6", "value": 300029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644916953, "uuid": "7beab8a0-a5f8-408e-8456-76829b3c0846", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916953, "uuid": "b6c37628-74d8-41fa-a43f-25dd10540975", "value": "G302_220214023_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd10e01-8e8e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644950370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950370, "uuid": "dbf51b28-e6af-40d2-9015-29a06052cb5f", "comment": "Malware payload (AgentTesla)", "value": "cb0b1d504cde253d6d52920967f87345", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950370, "uuid": "09f84a97-d2d2-4ded-af23-02303ffa2089", "comment": "Malware payload (AgentTesla)", "value": "c77bf386f60cb72d3bee09df7e587cc0c96fc0a2ec1c6f3e255db5fc22246064", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950370, "uuid": "d6d9eee5-725b-4655-a5c1-916f04279741", "comment": "Malware payload (AgentTesla)", "value": "5a8911e64e472e9ff76ae7dd227b93026c36ac30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644950370, "uuid": "d7b3fad0-2361-4c09-9df4-6f07ce7e6b18", "comment": "Malware payload (AgentTesla)", "value": "28eece68d8f7188982680e029a265c7d68df73e3e4fcdc464cfd3810bdb5468af6f831432d5c004516dee414fd21a08e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644950370, "uuid": "2f98b495-434e-46a3-9edc-d22bb9637b37", "value": "T183E433C47A06ED311311A5C6BC31B68F174E091D92BEE8B14CAEE7725338EEA4247D97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644950370, "uuid": "c4cd55b7-40af-43c5-adc0-c39b14b6e82b", "value": "12288:50dRT9PVqmYdljpwNApOVd7HXtZTnY9SB0wms0oN68dNPH3VI4LC:YRT9PVmdLwNApOr73tZTYyKs5NlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644950370, "uuid": "09f4214c-aa04-4964-bb97-71dd7797537a", "value": 703646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644950370, "uuid": "c706bc7c-9466-4029-a914-31883f9fe0ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644950370, "uuid": "33037fae-fe7c-4f32-a449-14554c72ed24", "value": "RFQ 227KECExecution 2021-22Project M113B..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b327a94-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932141, "uuid": "50ab70e9-cf69-4c93-a1bd-3c243dcdc372", "comment": "Malware payload", "value": "906d7198276f67b073fb669fb97c723c", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932141, "uuid": "b62a4e7f-2883-435e-ba11-98c3289514b5", "comment": "Malware payload", "value": "c7f4995a1f8d6350db63b3507442dd3a8b11392019dc60149f0479a4e2e41e88", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932141, "uuid": "5e25b579-b8e1-414a-b5ab-f8da402176f7", "comment": "Malware payload", "value": "fef4bcf075918a36be2eb6ee9993681f5806f363", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932141, "uuid": "a0efa57e-c1b2-4c12-9ac6-42487f6b22b2", "comment": "Malware payload", "value": "8e5aa8a3c8f2a221ead4b0633ced470529d78eb59a9e2f10c40bc53af0de4fdb6feba4bd7e1029523afc4e73d5b39c53", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932141, "uuid": "81b7392d-d70c-4e7a-b400-be34bfccc42f", "value": "T14A0432FD9A1B1A5F41160E28E50D43146DECDD6BD3E691F2CF0F4DBAAA1981808F1E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932141, "uuid": "dbffc0b6-e6f5-4eb9-ba4d-419df26346b3", "value": "3072:w6B5kp1ddLJau5UVKeXeas/av6faXhcYXGYAX3yEO8NYT3bP6zBrBjJst9aBMV+A:pkzdZJ5as/av6faXhbc3a8g76zBrBjGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932141, "uuid": "13f4fa7a-b9b6-423b-b96b-76532d2d0e0f", "value": 189100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932141, "uuid": "d25ad8d7-cee6-4d1e-acc7-2e0a8ebd2d73", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932141, "uuid": "836ee40d-4e75-42ca-82fe-d4637ec20c7c", "value": "PANDORA GODO.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d873e4-8e08-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1644892878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644892878, "uuid": "79244d35-7ca5-44a8-a043-0e40a0a5abda", "comment": "Malware payload (NetWire)", "value": "b5449839f68fcc9885c85931d7aa85bc", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644892878, "uuid": "015819c9-8d65-4099-a46b-b47edbfdf487", "comment": "Malware payload (NetWire)", "value": "c851b26e5580c9815d4d1d945c6c302c13a907b056f3cec5d4f279627c411ccd", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644892878, "uuid": "15aa76c1-0a8d-4cd0-a9d0-88a0d6a8d043", "comment": "Malware payload (NetWire)", "value": "bca77e1d625a584312fd11d9acb79ac809513227", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644892878, "uuid": "48b723b5-099f-4c35-99a9-aac08280179c", "comment": "Malware payload (NetWire)", "value": "9e028bcbc8e0919e049d10147f0882d45ee48e869b817c898dc7c47da9490077da0f4287c6cce4f99608782920280f94", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644892878, "uuid": "c1cfb08b-130a-4f5e-9420-a3bbfc08be20", "value": "T17C04B47AA49EE744CB342E6D2C2C37C542DBF1A124C08217A5A19F4F3F1E4A4AB47D5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644892878, "uuid": "d6840aab-533d-4444-92e1-ef2bfb946005", "value": "1536:pTwFO2vywQt6S7LJ7eNrL/JL/A7Ckoldlh4aC1LFmdTCv2Tsp/Pu7QzlY696GMaj:BwFO56h0C3ph4XE8uTsPLlYeQAfs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644892878, "uuid": "300e7a2f-5111-447e-bca8-f2a1bf146262", "value": 180768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644892878, "uuid": "99cb5c56-77fe-4a6b-922d-01ea6dd64888", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644892878, "uuid": "844f382b-4787-40f8-943b-3cadc8fafee8", "value": "DHLUNPAIDINVOICE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea7946e-8e0d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644895076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644895076, "uuid": "d82e35be-d57b-4d7a-8f72-3213f27d650d", "comment": "Malware payload (AgentTesla)", "value": "874e9da5ff85777d25c0487091bb2787", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644895076, "uuid": "23d6c7d3-c4c2-467f-ba01-259c1717e1be", "comment": "Malware payload (AgentTesla)", "value": "c8c2169b23d66d41678b27a6f1a23a4165bd75d924d565b336280c5f67fcce3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644895076, "uuid": "d877e866-fcc1-45ea-978a-e845ef607d83", "comment": "Malware payload (AgentTesla)", "value": "4337afb132826bcf2296bbf492896a72e0263331", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644895076, "uuid": "444d1eac-6ed5-4eae-9d3b-69112b33b23d", "comment": "Malware payload (AgentTesla)", "value": "a8ce07b8b4fedd63bc6395fe76dd8ffe4aa30d10d4373ddbbe150a74efd350f87e2e4cde57770ed25277c26fd1eb9955", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644895076, "uuid": "3ac47575-94a2-4fb2-9782-8d5978e5f280", "value": "T1BC05021BB76FAB79C0740AB504FF903913B1AB4C5533CE7ABCAA71AC15523620E744B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644895076, "uuid": "a3097661-fa71-4d1c-b196-0fc3ea85b4a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644895076, "uuid": "fd4cfc6b-7316-4778-91fa-145cbd91ccbc", "value": "12288:L+pGijfNk9ZolxzbDmPzP94XFmyRkfmhlOk5js7qvWxev7khePLjNlrZh5ccwdNj:L+pGl9qDbaPu++15jsIWsSyLpsmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644895076, "uuid": "5487978e-0629-4d84-b790-8cc179f1fb2a", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644895076, "uuid": "c17cc79d-7fef-484e-ac40-2dd9b47b4d16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644895076, "uuid": "75978eee-b159-4383-9133-76dd5fab6a98", "value": "ZSJu6wZ2E3ZTx8y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6385c361-8e93-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644952422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952422, "uuid": "e6da0417-5cfa-4be1-ac6b-0a3910d486a1", "comment": "Malware payload (Formbook)", "value": "bfb2bb710820956c8f46c31109449345", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952422, "uuid": "901574e3-2e21-454f-ad9e-ca4f3cc5c2c8", "comment": "Malware payload (Formbook)", "value": "c9b753173bdd1461f93e415d400ccdcac75c991ab5f0f7ff52ac18ad518f49a8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952422, "uuid": "10fcfac3-9ef1-4eaa-96d7-b04ce66edc34", "comment": "Malware payload (Formbook)", "value": "16b932867b03092c5098a41fa77b1f3d41dabb8d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952422, "uuid": "8d802c02-ca09-42a9-bc4f-08e08d8844ab", "comment": "Malware payload (Formbook)", "value": "f04d3f441c235292ff9466653a9b6c5ae831bb604885b5003ebe396d6673dce306755217cae6555eeb9a8385654a0db4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952422, "uuid": "efd751f2-2d18-47fb-8c0c-2ec9b2fa5efe", "value": "T1C195BA21B1317A97C3161461166FBE8A430CBD47B2C65F8C905DFBF82CA6CE79306D9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952422, "uuid": "45659684-a0c5-4a14-8ebc-832829b8a846", "value": "1536:L34QJaKXF34QQPD3iOya7I45AiS9SCHAD4pAs8A4eSoHFJ6oUsbaJu7zc1YiW7RC:Jo9u0243", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952422, "uuid": "6690fd79-8172-4fd0-80f6-d4edd8110eba", "value": 2055453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952422, "uuid": "d9e5feaa-0e08-4821-b9c7-8f766c6202d8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952422, "uuid": "b09e859c-cc90-47d1-86de-b38c7e9b0ac8", "value": "RFQNJT5118F-150322.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8c6e9e-8e93-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644952415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952415, "uuid": "b64ada2a-427d-4da4-bbe6-cfc897aeca4f", "comment": "Malware payload (Formbook)", "value": "844bd0e7da39179fac9171a0e0491608", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952415, "uuid": "6628efaa-bb97-41d7-a6f7-7722d3a12976", "comment": "Malware payload (Formbook)", "value": "c9bd4a924f08dbae31a8f1ea813defa8b06f22be01238594a4d1c8be69330f54", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952415, "uuid": "c0b8fc46-97b3-4fb7-9cd6-88dbdc8ef7fd", "comment": "Malware payload (Formbook)", "value": "67a15afd1f6f11951b75003ee42fd9dc66fcfedc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952415, "uuid": "8ebf45d9-b1d7-4814-bada-55791387913d", "comment": "Malware payload (Formbook)", "value": "5a40cfa007ce6d222c623579ecd817e99f2ad57e82cc5f8d0e5fdbeeef4c86fd7ab197077eee72b401fed7318777e43c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952415, "uuid": "0e02e7ff-5a1b-4036-8ae0-715cbdfbaf9b", "value": "T1E195A832B1317A87C3161461665FBE86530CBD47B2C65F8C904DFBF92CE6CA69302E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952415, "uuid": "0b96298b-2606-41d0-82be-8170054df05d", "value": "1536:z34QJaKXF34QQPD3iOya7I45AiS9SCHAD4pAs8A4eSoHFJ6oUsbaJu7zc1YiW7RV:0K3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952415, "uuid": "e7633251-e2b6-4867-b22b-f3a9df4e5778", "value": 2055493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952415, "uuid": "7717afde-41cc-49a7-8e3f-8b6d741fd3d0", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952415, "uuid": "b5e6f61a-614b-40b2-a056-4136375aa380", "value": "RFQNDT5118F-150322.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c1c2ab-8e6c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644935642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935642, "uuid": "0e1ead3a-a295-43c6-8e4d-43a0d919a108", "comment": "Malware payload (Mirai)", "value": "29a6bc1179ede6f7a8ecb8c2ba5d3b44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935642, "uuid": "731b81c8-b12a-4b91-a034-5a9eb55f67c8", "comment": "Malware payload (Mirai)", "value": "ca4e1b2535dd3dae86675e1081a023087f6d97bb041212429fc3a7a45e24e1b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935642, "uuid": "b412c53e-7ac6-4b7a-888c-86339ae9b9f1", "comment": "Malware payload (Mirai)", "value": "7f6b8de1cb33fc61afb6a374a916959aaea82386", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935642, "uuid": "addadbec-47f1-4ad4-b444-69e43c49c5b7", "comment": "Malware payload (Mirai)", "value": "b2571a5fcaa757ce8bcdfd97864285d59e5920fdac0047e8e7eb97d71d63bc407d54cadc6ebd11b62c98078922cf12f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935642, "uuid": "c61804c1-043f-4240-bc7d-fa4dac82c349", "value": "T1F2331991BC929A26C5D013BBFA6E6A8D332163D8D2DF3113E8640B543AC611F5E67FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935642, "uuid": "8d614e13-c3db-47ce-a577-24f2b639e928", "value": "1536:PEnHN7AB3Op0GK/xj5m5lyf6kV3B5Ay0P0kK5FbAwPC:8nti4byfbVxeTckK5pC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644935642, "uuid": "a3e3a980-2835-4002-93f2-e47194d2634e", "value": 53180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644935642, "uuid": "5ba9a99c-7d46-4e9c-96a9-fe5d624aa8b1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935642, "uuid": "54ecbf5b-c96c-42d6-9910-39dc8c7adde1", "value": "29a6bc1179ede6f7a8ecb8c2ba5d3b44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea090b8f-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932032, "uuid": "66fff168-9045-4209-9c5b-7c87e6d51288", "comment": "Malware payload", "value": "24de6e57869b34bc137a2fe876f48bc5", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932032, "uuid": "dea9b6e4-a0e3-4d43-a623-4f3cca6fd8db", "comment": "Malware payload", "value": "cc17a84583472f0041caed67a2e3fe47b1b4c1ec45e4a94ea5f17bc5aa721c77", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932032, "uuid": "88d96679-4321-4eea-9c72-e2f4c2a1cefa", "comment": "Malware payload", "value": "b2d0a580f62e777e79caa13d80d8e5ba2aac1180", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932032, "uuid": "64787116-36f6-40b8-873e-92752157a158", "comment": "Malware payload", "value": "3c245d241fedca5a71eb7a0ffef1274ba5ab40cb43c2d9daf24d6f3f62afaa29bf1bbb9045afafb04f83b161ece9dc38", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932032, "uuid": "7787aa47-d4fb-40d1-8118-1eebb122d340", "value": "T1B7131BB30213FD8F56220E45D50C2210DC9CEDB772D89DACBF4898E99FE51189DA8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932032, "uuid": "58157e5e-c350-47a0-a083-1ba6a339896e", "value": "768:YGWLt7hQ+TwKa4Wabmmg2kfgnt/XpXc35:YGq7hTw3Zaymzkfgt/XK35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932032, "uuid": "c7f94e20-2e3a-4704-bbe4-e49a8bbef284", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932032, "uuid": "8f6fb6fd-d01a-4dee-ae6d-ffd29971cf35", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932032, "uuid": "5dd35efa-67ad-407d-b997-ad95d7ba142e", "value": "joc2.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d797c34-8e5d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644929085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929085, "uuid": "f91827d7-5a7f-41f1-9f28-ac0384f73083", "comment": "Malware payload (Formbook)", "value": "2e39197eefddf6c8d79a4775078872d1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929085, "uuid": "63a0cfb7-9e0c-4ca6-826f-686bd42fd668", "comment": "Malware payload (Formbook)", "value": "cc8d7caae86931fd55dbe76f6dce9cbbfedc3a9bd329c39a63e62c4b58ec39a4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929085, "uuid": "40b36142-3857-4b2d-b358-8f767d3e2a5d", "comment": "Malware payload (Formbook)", "value": "5a96005690d656881a03dde2974d8263b15def7e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929085, "uuid": "633dd58b-ada6-4cc6-ad5c-5bfbccb6ba2f", "comment": "Malware payload (Formbook)", "value": "7fcffb510268988ecbd30e7d509c391274b0a6d88b773b8110f42faee4e097da154567b5c00e7206549748869a1d6d76", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929085, "uuid": "e862d56f-1afd-4021-808d-e92bed4486cd", "value": "T17945CE45F690D172F969093205E7B265DEACAD8025140892B7BE3B5F7F330C58B0EADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929085, "uuid": "e12fdbf0-d7a3-4725-bb0a-89c12a1f1eff", "value": "12288:Tv/7+8zJeNKuQge/Om3qg2JrRMRMW2iNQmNNk:T37CNKuQD96g2XMGcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644929085, "uuid": "72605543-d0e8-47c5-a213-3df6d3fed954", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644929085, "uuid": "a684368a-1c87-451d-abfc-5389f59e93ba", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929085, "uuid": "85a28cd4-470b-45e8-9af7-3a9c5981f4f4", "value": "SC221420.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc29ad1-8e95-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644953436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953436, "uuid": "c65af51d-bd96-4a00-adee-e43fd03be453", "comment": "Malware payload (Loki)", "value": "88f534b894e66813de5fa710efbde16d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953436, "uuid": "d55a982b-33c9-4ce5-a08c-75e22ab7029f", "comment": "Malware payload (Loki)", "value": "ccd2967913b9a793688ec7e95f92b8a6e0d595126d45a4b3cb1ab8482bf8268a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953436, "uuid": "8e0abe7e-cbdd-4311-82f8-a8f86ea8bbcc", "comment": "Malware payload (Loki)", "value": "8977f1d742fc58a7b97eb7cbaea1af704932ffe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953436, "uuid": "ad5c7786-e469-4e9b-83ff-7383717280d0", "comment": "Malware payload (Loki)", "value": "e21a88ad9a2817186a8474f501173e5d0c5134d54762c85dfa50ca3adc84ef5dc04c716470394145668a54349f27b7e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953436, "uuid": "d9a6bb95-f6dc-4851-9752-87924e3cc619", "value": "T14A252201AB37B274D4B213F948E242BB26FCAA4D1147DF7BE6B371C911B53A0857853A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953436, "uuid": "2dd47277-60f6-4e0a-8927-b4ad94ebed85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953436, "uuid": "8af50172-8ce0-43b9-8cbb-7eda34183c3a", "value": "24576:3gmYkMQzhbhrHPQep1H7wyvf5WhVRNlOikgkGGU:3g5QzhtH3p1Jo7RNci3kGGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953436, "uuid": "5d98ae14-44d1-43fe-8d5c-f989f830de30", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953436, "uuid": "a68ca325-ad23-4df1-867a-5b66799ae5d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953436, "uuid": "1e0f6dab-745f-4c96-9896-fe3eb7a1445d", "value": "88f534b894e66813de5fa710efbde16d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1ce3ca-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932064, "uuid": "79247754-30b6-4cc1-824c-d3c27b2d5e47", "comment": "Malware payload", "value": "ffa9218eba072a42d51b31154da300d7", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932064, "uuid": "67f680ce-5648-4186-9fda-9e4bbe1b9bc0", "comment": "Malware payload", "value": "cd646be0214695df412186834830db1f743e132907490da1c5fef6e19590d66a", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932064, "uuid": "6479cb4e-0992-41ee-a6ba-e7906e5de2ef", "comment": "Malware payload", "value": "701b1827f20240648151fc17ef4de8760a5ae5d6", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932064, "uuid": "2987b517-14f2-461c-9c16-be6883f83cec", "comment": "Malware payload", "value": "0dbb312bae4c93dc45415bfa22fc7bf700dec9ca7ec4bb668f16967f63b95e7c25befa204b8dc1ccf90157a1719c61ba", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932064, "uuid": "84bf070f-3e8c-4b9c-a98e-eb1f097e043e", "value": "T19F130AB30653BECF57330E42E50C2121DC59EC63629C99ACBF4898E58BE51189EF4EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932064, "uuid": "1920ffb0-dc36-4bec-a391-cc1ad4e98989", "value": "768:B4RxzFdIKaeqDA0qj4fUakND3BxPVmnSt2kfgnt/XpXc3t:BSRFdIKxqDAC8akND3BxP8SEkfgt/XKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932064, "uuid": "15487d9e-8b50-4a81-a7a4-fada956e5a2f", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932064, "uuid": "9eb4375c-f0d3-440d-bca4-a4bd83d392a1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932064, "uuid": "b457c434-823e-4dde-841c-5476b7808c5a", "value": "localhostNJ.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7824acd1-8e86-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644946873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644946873, "uuid": "00098ac8-3c2f-41ab-b5d6-80afa8bb577c", "comment": "Malware payload (Quakbot)", "value": "e6f6a25393637f26ab87ea869bfad966", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644946873, "uuid": "5403743c-9e12-475c-b5b6-b99e8123937b", "comment": "Malware payload (Quakbot)", "value": "cd8a94e42e7119a3f1b5117151b7bb2fe4a777f221581b2dae0c2cf0e8ddedf2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644946873, "uuid": "12427908-9447-46ee-a0f2-9474e3cf827b", "comment": "Malware payload (Quakbot)", "value": "993d531d2620f108bf00065d8fe90af1ded4eebe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644946873, "uuid": "0331f8cd-8dd7-4062-a74b-60e588ef1ce4", "comment": "Malware payload (Quakbot)", "value": "21fe3dd8b767e1304481b9aafce48d6552be602d8cef3b8dc50b3010a8e73f95778db4d10757304e2eae8a28650fef32", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644946873, "uuid": "3f1c77cb-d7b4-4373-a004-b97f0ffe45a9", "value": "T1CC358D3271C1D5BFC4B236BCAD6A71A988257D521D2CCC0DBBD80F4E0D7A691673229E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644946873, "uuid": "84bab619-2b08-44ef-971e-2e21c6a7be7b", "value": "220ea7972e993d1cdbf761cab8a71a9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644946873, "uuid": "3c8b55f4-5bd9-444a-97fa-bac926ddc0f7", "value": "24576:juwgYKvPteX5lNEZYyTPKFYY22OlWc971Zkqtu2K0FCFc7:uzleiPa122S9k2KG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644946873, "uuid": "109a2c21-61d0-4350-977e-cc5757db9122", "value": 1097200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644946873, "uuid": "bad7f6e9-fb77-46af-b69a-a20f429e0e90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644946873, "uuid": "a11cffb7-a5e0-4722-a66b-a637c9283c01", "value": "822330420929752(2).dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b7eede-8e4f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644923161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923161, "uuid": "a30719c4-1a0e-4330-97ca-c98c8056d6b2", "comment": "Malware payload", "value": "de097c5ab5e31ac16b4466cd56e9bd2d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923161, "uuid": "5e55c441-146a-4e12-a36f-a1d955d54ba8", "comment": "Malware payload", "value": "cda63761c4305452ae097b31f01704d4bfd4fd9c88c5c44ff2ddb58c70485fe1", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923161, "uuid": "c0c63506-1e14-45bb-a2d2-b07970b893d4", "comment": "Malware payload", "value": "21d230bcc2f38fbd01ddfceb5315fc12e40b712d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923161, "uuid": "d835cbe0-7e0d-4dfd-9317-381fccc1bd87", "comment": "Malware payload", "value": "85a5912359afecd85cd45e49bfd06e4f07089854159df4869cebddaed655c0b1ed39970425f9f26333b2bddceb5a22ac", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644923161, "uuid": "ac78ba03-4a04-492d-bfa7-93dd4e5397d1", "value": "T1C94102062BEA1720D2B289335477E3018A11BD52AE138F5D54D4C64C6991A14FDB9F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644923161, "uuid": "db37b210-68eb-423e-b674-31cf9597b645", "value": "24:8+cJ/qsSL+aqAezBVzHo0fwjVkWAbMlfz+DO4I0c9CNOdCGkcfbf8XQaR3+9hswi:8+KmZKoZj1A4fcRIiOoUD8Xv33Ykr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644923161, "uuid": "8a4d1420-a0fb-4880-9d48-2046cc2acd2a", "value": 2421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644923161, "uuid": "b8783193-21a4-41a0-b6a6-42e2f77377e0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644923161, "uuid": "42b2d600-4f36-43eb-a554-5fdaedb35046", "value": "cda63761c4305452ae097b31f01704d4bfd4fd9c88c5c44ff2ddb58c70485fe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e7fe07-8e6e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644936615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936615, "uuid": "9c701c40-4686-4bc2-a0eb-211ae3d0d19c", "comment": "Malware payload (Mirai)", "value": "c8c7d31a5ddd5a3d656a9716c682a56a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936615, "uuid": "9e70194b-6a8b-4667-a6f6-2ae07b44a7e0", "comment": "Malware payload (Mirai)", "value": "cdf54b939b435a30e2348ade2f598a36ad21cff71cc120b4afb89ab627ecd186", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936615, "uuid": "3abac05a-5feb-460b-8a1b-3d1c8118980b", "comment": "Malware payload (Mirai)", "value": "d1ce4ac659afe69c26da84dfdd8233d0c3c917fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936615, "uuid": "cb49e793-cf8a-4f15-aff1-f008197f629c", "comment": "Malware payload (Mirai)", "value": "354543ba019f771e1c1b495a30709cc834536190ef95e54d7560168ff033e65ecf3fe83b153232053ef057db4aee3ef7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936615, "uuid": "31faff54-b91f-4e73-a0cc-42d5e3ec6414", "value": "T1C8731996B8818B01C5D512FAFA1E118E331257ECE3DF72139D205F247BCA92B0E3B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936615, "uuid": "ccde15f9-af6b-4390-b4ec-056236e0cfd3", "value": "1536:iNnAeH1Y6ZBqmdFcsc5h1QRt5Lm1JQxirhJc+7IMiwnnJow+ba5QAwD:KVY6zq2FRcX1QntmTQYVnnJow+ba6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644936615, "uuid": "3f3a4cc5-d5d9-4b75-add2-a000572717bb", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644936615, "uuid": "207cc17b-6867-466d-9e21-2c4cc2a8aeab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936615, "uuid": "69de65b4-7013-4a72-9e3e-d7caafd0e2dd", "value": "c8c7d31a5ddd5a3d656a9716c682a56a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb840faf-8e99-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644955254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644955254, "uuid": "cacb6aa2-cec8-4055-bc0d-303e5f10bc6e", "comment": "Malware payload (RedLineStealer)", "value": "94c52f798d5ffe673e93fbf7435c6fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644955254, "uuid": "368da9a9-916d-408b-a305-21e2e59440a3", "comment": "Malware payload (RedLineStealer)", "value": "cf73335d230dd473ae38b213370878e91d5562a6d7828ade5b9f56813a882b31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644955254, "uuid": "79a923c6-f0d4-42ae-b08a-aa4bb7cf2671", "comment": "Malware payload (RedLineStealer)", "value": "39ab6f6d94feb434c205389174fa9fe26fd233ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644955254, "uuid": "fdad9f57-6bcd-47e5-8ff5-dd431f1f4b97", "comment": "Malware payload (RedLineStealer)", "value": "904830b8f13f86510121a629acac845db92d5114c4f9c4219a3a0cce6af8faeee680e1bcabe959e45c5f08b7c71b3f1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644955254, "uuid": "127b1704-014d-447c-9574-2eadb6c29e09", "value": "T1D1A409386EE3DB6BC03866B863564EA41630BD35694EA332145C335D1C33F876B4AB76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644955254, "uuid": "0e1589b0-f4b6-4d9c-a9d2-3857b165c64d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644955254, "uuid": "2f790f4c-7536-47d4-b679-7ce60015e3aa", "value": "3072:nI9OMOnDjVs1yiqiY5L5gXoh6vkoe/qmeDbbB1zJ4dTfei4lpULy4k55gENfvEfD:nIa9iqic8gqmAJ49EP55rqFUwU5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644955254, "uuid": "ddbaafe7-7749-4214-9fe3-d7f7feca9fd9", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644955254, "uuid": "64c4c9fe-8488-492e-9ab3-d0c712e03679", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644955254, "uuid": "92d50022-c84d-41ab-a586-f8959efe1f45", "value": "cf73335d230dd473ae38b213370878e91d5562a6d7828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8a1117-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644931957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931957, "uuid": "89405f3e-c5b5-4dea-a903-e14a6959a0d9", "comment": "Malware payload", "value": "7f43320b71fa78e6b379c722f2d100f3", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931957, "uuid": "8d7724dd-f846-40b7-bbff-c16ab0398c64", "comment": "Malware payload", "value": "cfc56b536fa24698a1ebd49ec0f438cb61008bf1075d357a98bac6fd12ce4e3c", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931957, "uuid": "e0433b93-93d2-4609-843a-31a339e1fa6c", "comment": "Malware payload", "value": "9081df908fbdd9bfa284061c5de1e8b5f2c642ff", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931957, "uuid": "e059487d-f8b3-4b5e-a848-b91d3f3734c9", "comment": "Malware payload", "value": "5c16484b31bbe32bc4d6aca08f8d01718f87ebf7d0bcb2aea69b986f146d49deb958b12cd375adb37f151800a0c52bd2", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931957, "uuid": "f4781b05-440c-4af2-bd59-3af2f1e5c70f", "value": "T12813F9B30213BDDF16260E52E40C3115EC59ECB7329999ACFB4888F58BE5118DDB8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931957, "uuid": "68d3973c-9bf9-4c06-b684-070e2284d166", "value": "768:3JbxuFKYNf+++m8YTeTumpX2kfgnt/XpXc3ltp:3FsF3f/+m8YTeT1pGkfgt/XK3bp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931957, "uuid": "06fd82fa-f908-4177-b4b7-005c01e4bc91", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931957, "uuid": "fd9e1531-f220-4994-b738-2893ae198f7c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931957, "uuid": "c687c6ac-9fed-4a13-8dd6-22ea1489b0af", "value": "aliks 07-02.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9f0bab-8e3b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644914586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914586, "uuid": "79a34088-8044-4389-8a91-25e74737d906", "comment": "Malware payload (Formbook)", "value": "a3e9b00cd87f26cf2b5d645e50b38fbf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914586, "uuid": "f1cd9cb3-a6b0-4ff0-9236-89280398ebe5", "comment": "Malware payload (Formbook)", "value": "d07bb6a4861d8d57dd1375205c6eac8df5b89b8ea73b5298f0b860809c08df6b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914586, "uuid": "d6a3990c-447c-459e-aa84-41cfe82e4af4", "comment": "Malware payload (Formbook)", "value": "783e398209c7a1ddae585acd3440937636fc26b6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914586, "uuid": "dfe90560-78e1-4007-a208-ce62154384a6", "comment": "Malware payload (Formbook)", "value": "d4b458d1b8f95babd7d787b6dd54562073a0142824d83d7f2a706d165639d6b66da055b566dd30f4ace528f8c4713446", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914586, "uuid": "293dffb1-bead-4e60-bd8c-d6e7f4dfb5b3", "value": "T106542311D227BF048488D49E6C439A5478C2AD19FB636DC12152DADB2931CCE57F2EFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914586, "uuid": "cfce4854-11be-417b-ac3f-63814e8a2301", "value": "6144:+rcPrdm2hth2UqWnGvsoH1KrxWBxP/3zhmswXLMMABi60:+ujgFsoo1QPbha7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644914586, "uuid": "d92767e7-c07a-4086-9e61-0286e45f1f45", "value": 288965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644914586, "uuid": "15f02699-be48-4a82-8e26-af676c0d9d08", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914586, "uuid": "0da8bbbe-489d-4ae9-a4d5-d0bf8e7c90e0", "value": "1644909905.Vfc11Ib6c9c0M997392.dynamene_HSBC Remittance.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce6b5ce-8e0a-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1644893489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893489, "uuid": "6a09a028-b6e2-4827-8a2e-0a6a278a59cc", "comment": "Malware payload (Amadey)", "value": "7118a9c1f87b794b523f1210bd09f511", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893489, "uuid": "99188888-4bb5-46e6-bb3a-90e3e6bdda3c", "comment": "Malware payload (Amadey)", "value": "d08961828dcb23c08115949ac42da508fb38fde316ae37301490d040babb7ac2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893489, "uuid": "233605b2-e0b3-4a04-95d0-2c7bbd4650a7", "comment": "Malware payload (Amadey)", "value": "5c0bcbea7c3211c08214ffac43a640b3e8c1b287", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644893489, "uuid": "47a998d8-0080-47c2-b50f-d1c04695f586", "comment": "Malware payload (Amadey)", "value": "ddf23a517d0f5a793ef684f1a493c227fda5289cf342ce63a828cae31175fe94c42598ff3c66b31920a29a71a9a30b90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893489, "uuid": "d94891cd-81ee-47f6-97c2-0f07e747d931", "value": "T137659E01F101A136F8B340BBCEFE552DDA68AA61130954E773D85A5F8BA2EF23D32157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893489, "uuid": "4e257d1f-677d-4e4f-8754-ee00f8902bf6", "value": "5eee21c8a62fcd7829651951456ac9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893489, "uuid": "9ce6e6f0-dbc2-485a-b87f-edf69170a02e", "value": "24576:Rsd7ZYtZBbUsrJKbeHjr1HybeDtN2rok2j7QxDPZfe8Tbiw:Rsd7ZYLBouJmeHjtDtIr72j7yPde8TbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644893489, "uuid": "0bd63438-bc9f-4a4b-bdb0-b5c3f1dc7fa9", "value": 1464768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644893489, "uuid": "664565bf-6cf5-49d5-9587-cf47c189bff0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644893489, "uuid": "e1fc14b8-f8c2-4987-bc5e-e6bda5541ff5", "value": "7118a9c1f87b794b523f1210bd09f511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5600d1b-8e24-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644904858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904858, "uuid": "a14c24f8-d2d2-42db-8bae-ff9080a50532", "comment": "Malware payload (Quakbot)", "value": "d15cda202bf6701daf0d4407de0722a2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904858, "uuid": "fa5ad531-0782-45e4-a3bf-36bad9003377", "comment": "Malware payload (Quakbot)", "value": "d0e76eed0972833a1a977725a11aab763374f9f8b31bca82838731a8c3ecc1f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904858, "uuid": "e53aecb4-42ca-4707-8e4e-7031d66b09b8", "comment": "Malware payload (Quakbot)", "value": "249f80f1e43f8e629d7dc07c1cdb463251876108", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644904858, "uuid": "a045a172-4653-48ca-a7eb-79160f4fa905", "comment": "Malware payload (Quakbot)", "value": "1e35e8b9b38e3c9b832d51febb008818cc244684a989f71c5123281a3195ce678206f52fbc00a2a1254e00c251f35145", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904858, "uuid": "0fb52592-2bb0-495f-9c57-d4b679bdf662", "value": "T149358E3271C1D5BFC4B23ABC9D6A71A588257D520D2CCC0EBBD84F4E0E7A691673225E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904858, "uuid": "9487d4b5-670e-4637-a008-c006bd3d6d06", "value": "220ea7972e993d1cdbf761cab8a71a9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904858, "uuid": "e2785ca5-4516-4ff0-8db5-cd9eb8b4f16e", "value": "12288:ut1RcM1gmtlMFHvP/AT0qUyF1XPPzXTwnUV1cQ47gZckpPWUyQVurP6lbuiw1rPd:2uwgYKvPteX5lNEZYypP/411KQtg9Fz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644904858, "uuid": "59ce4844-b2e9-4699-af41-2a7792dfa077", "value": 1098736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644904858, "uuid": "97b14851-147c-4e9b-8b5c-a2f02832d149", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644904858, "uuid": "f488184b-d718-4574-bef3-aef66a39a15c", "value": "1621832826316290(1).dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4069e41-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644953040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953040, "uuid": "a00dd41d-7f56-44e1-870a-48b92137abd8", "comment": "Malware payload (Loki)", "value": "889383aac100c91282372af64f3aa18c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953040, "uuid": "8eda39d3-0ee7-40ce-80bd-00f03bd7705a", "comment": "Malware payload (Loki)", "value": "d189beb2b0b019678ac47f9f73da435456b6d95e2ac4cb83c71eb2915290835f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953040, "uuid": "b10c46e0-39ea-4775-96fb-cc19421db0c9", "comment": "Malware payload (Loki)", "value": "93effc73c5c95d4469722c3bc90d2ac84f899cb8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953040, "uuid": "104cd2f6-105b-4dcf-85db-033b43ac4071", "comment": "Malware payload (Loki)", "value": "56e07c0777c140c48d66f8035c2c29656c89102a49ce1254066caa26452754778e3bd0a8b600a1489076754ea2d18ee6", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953040, "uuid": "8f7ad1ab-eefe-4b80-8c8e-db00f5357370", "value": "T1A0141200BD35CBBEE45956F72664C00A9D5ACDC84BF984C3516FB7AB00B0C83DB93A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953040, "uuid": "e84674e1-23b3-4d62-ba26-2377a77e955f", "value": "3072:5fyzQLWeJXIocUETaNA6TTOI81+qQyUsLGhWd2+5TOpXksLQTB:5yCWjheBFeJxShWjO5NA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953040, "uuid": "aa4e8e6a-4f5f-4c89-b565-d323adfbafed", "value": 191784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953040, "uuid": "685a39c1-d46f-46c4-8268-e26c4289740e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953040, "uuid": "6382f903-e61d-4182-b86f-a48027299617", "value": "Scan_payment_advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f52238d-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644931692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931692, "uuid": "0ded872c-1a29-4108-8cd8-72df27e2dec2", "comment": "Malware payload (Quakbot)", "value": "61e98871e0d0baf51bfe486c5d3a9b8d", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931692, "uuid": "b2465697-82d2-4fad-a760-e25621a58d79", "comment": "Malware payload (Quakbot)", "value": "d2fd7095bea3fc7d5c862b4804baba451d01a494d23875028b12714c077955a2", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931692, "uuid": "e60f530e-7a56-4129-aca2-00fa3f705f36", "comment": "Malware payload (Quakbot)", "value": "0e469c034da3656e5d873ec7c78d4c5751eea633", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931692, "uuid": "4582fb5f-bc32-4e80-ad02-be6101f32773", "comment": "Malware payload (Quakbot)", "value": "a93677b055819a6726bbfbac4d981de6830e37983fc61581bf789268bff897db0311fd0819104746fbfe970667607298", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931692, "uuid": "966bed8f-d116-4c43-91fc-0d7fe2426382", "value": "T1824402564900D722FD09AE3DE89659CEBE34186F7011642F4C65AB83CBFF5431FE9226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931692, "uuid": "619c30c3-bb65-465d-9e75-f5f096da4df8", "value": "3072:FwGEpaPSSOtJOM8NpvCEbOQCkICXgNeyD7+ndIhZKF2UxTp+SZFM60EpPtuq0hG:FobO0e2k7Xg4yD7HZexUERpPt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931692, "uuid": "97b0a70a-24aa-449f-92b7-052dbf87549b", "value": 264749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931692, "uuid": "ad79898f-26da-451d-9cd9-a5059985c456", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931692, "uuid": "3faff163-5aab-44a0-8298-3ffb411e19cd", "value": "FH-2129429675.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e96705-8e5a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644928077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928077, "uuid": "81613d78-a9ff-4ad7-9e47-9512c73fe3af", "comment": "Malware payload (RedLineStealer)", "value": "e75d997ad58a9fce7ed53caba6d09d8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928077, "uuid": "44e28414-0725-46a0-b8ec-7137aaa35a92", "comment": "Malware payload (RedLineStealer)", "value": "d37f2546cea1ed8a8f85d1f6274f7a59869ded7f56ecc6af9c123dd76fd10d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928077, "uuid": "3171c772-a7de-4670-9a93-4c233b2f16fc", "comment": "Malware payload (RedLineStealer)", "value": "e38e2a5bd783567366397219224e1f1477929727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928077, "uuid": "8f9a4eb0-cb5d-4251-ba50-b5e19fe35875", "comment": "Malware payload (RedLineStealer)", "value": "3494c8fb65ef6caf4a0f2afe4ebda5caf84b8bbf370c86e461b35a8c5672b0d1af5364b588d5c001e188d6dac891f839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644928077, "uuid": "1bfb8cf4-c6f1-4534-b7b6-ce33c9342b24", "value": "T1103633DAF383F1D9C402623D9F099AA55D2E4C4E357DD28D2017839C0FEAE352AD7629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644928077, "uuid": "042b6194-7ffc-4484-ad08-59131536ee3d", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644928077, "uuid": "d2d59696-2f63-4edb-8fde-48606c76486c", "value": "98304:900MxTXjW448+yDpmO3SayeQCl4KVnkyw9dS9g:+vL+yDR3lysljVkywu9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644928077, "uuid": "14414f16-da90-47da-b822-d58ec547b6c2", "value": 4877312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644928077, "uuid": "1ffd7ab3-0f96-4d71-a303-1745bf7068b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644928077, "uuid": "e31b0068-a4ee-4795-a8ca-bc3a6a62f920", "value": "Zetche.at.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9549cabe-8ea2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644958948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958948, "uuid": "269c0c20-5e8a-4387-9112-facd11733e97", "comment": "Malware payload", "value": "936fc7375cd848074207ecc3f25a5e0a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958948, "uuid": "dc39e5c4-2325-4bb3-a7af-50513bf0e104", "comment": "Malware payload", "value": "d43246de1057bd4ce44d342271094273f8abbc7b0512ad5f4a829520040c0d60", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958948, "uuid": "9216a3ed-77b9-4de3-9533-a3b489af9989", "comment": "Malware payload", "value": "0019c1ce63632c3a91a791b047c4cb2a44ca303c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958948, "uuid": "b6d3200e-891a-43ce-ba7d-2abc30b48f14", "comment": "Malware payload", "value": "358c7fa263ec50597a00e49ec65afc66a1d59432e25c6aff2e505cd1f8fbe97e19c30f367be21f63674d32d2def1443c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958948, "uuid": "f3e8546f-4a26-40ed-8817-0b4cd59a2d54", "value": "T1BC13F856F9815B11D5C211BAFE0E128E73130B6CE3EE73226E25AF2477875B70E3A815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958948, "uuid": "9e24034d-f3d3-4ece-8c8f-85aa5f7a8f53", "value": "768:wan3OA0ZYUwhaXof3mWEnLVQX1ihACBB/f9xPjxh8VJn5gYUI:wanD0WaXouvQFihAqB/fjbmn5gYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644958948, "uuid": "0d852292-fd77-4fa6-b8a0-90f445db8286", "value": 44116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644958948, "uuid": "987e2759-77ed-41a1-82c5-50e129a92660", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958948, "uuid": "fd498065-2717-4b3a-9688-392d663a9932", "value": "beamer.arm6-20220215-2102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fd8f45-8e6c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644935654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935654, "uuid": "494546bc-bc26-4cbc-81d2-da98d2062a84", "comment": "Malware payload (Mirai)", "value": "7aaa8de6a9033c2e99b80d040351c81c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935654, "uuid": "0abbbea2-b660-475d-bc92-d3df7888d4ea", "comment": "Malware payload (Mirai)", "value": "d44971dad93978867c56e8f8207e88e5be9bff5537c996cdfe7b7c2ce430847e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935654, "uuid": "dd26ed9a-350c-46d7-8fe6-e69ad5b0a290", "comment": "Malware payload (Mirai)", "value": "6d4533c9f284386fc27aae6267468a22b01b2452", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935654, "uuid": "1845b3db-5f78-4462-9be2-e4b2ce03628f", "comment": "Malware payload (Mirai)", "value": "2398650b3467bd3c9358842ad7901155c08b5cd1ea2fcfc3ef1d5fa939b378d6891a3430b75759529b320586a64fe65e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935654, "uuid": "cf5931a5-78a0-4664-bffe-a8613d683dbe", "value": "T14B83B81D7E219FBCFBAD823447B78E216A5833D622D1D185E19CD9011E7024E782FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935654, "uuid": "2af76667-dddb-43d2-a961-5844981e7e45", "value": "1536:Qat8EmQaBYT1MEVUBLcLlMvF6mW9gu8z6EtJAUf1wPa:Qat8Em1cMEKLcLlMvLDu8z6Eb7sa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644935654, "uuid": "9e14ea45-7fb4-4497-a181-d81869f14bb7", "value": 85612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644935654, "uuid": "1f8f2c72-866c-42dc-909e-01846538d014", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935654, "uuid": "2e2cec3b-b8f7-4826-b69a-63f854accf4c", "value": "7aaa8de6a9033c2e99b80d040351c81c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4263d3-8e3c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644914966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914966, "uuid": "a1c644e4-b022-4e7e-842c-e786375036eb", "comment": "Malware payload (AgentTesla)", "value": "a4f132b398586be6dc7a3c06949cb42c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914966, "uuid": "c0487be2-6b82-4967-89f7-5ee36cddbc1f", "comment": "Malware payload (AgentTesla)", "value": "d4ac2f1250d555a2681739d862614fa1735e58f67ba94ec15e9fb4944d5a50d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914966, "uuid": "b72fcc4e-c2e9-4f64-8a02-c401a9e95685", "comment": "Malware payload (AgentTesla)", "value": "c46966c9ff6246d0b0b2b9e071d44a112bd9ed90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644914966, "uuid": "688326f4-3576-482b-a1dd-124909e1f042", "comment": "Malware payload (AgentTesla)", "value": "e4aa81d074bcc6e550b5e23a4a15103936c9591c2b3ca152d4e38a41687ce98701f0647f8c707bd90d3d345859f6528b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914966, "uuid": "53a81254-8f4e-4067-a941-4a50a68f75ed", "value": "T1A0F4010033B37680C4720BFA98E599551BB56A6D1137DA7DCCA374CE1C62BD08A7EA37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914966, "uuid": "b8d63706-5736-449b-8018-bef8e361e5f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914966, "uuid": "e10d61e1-6a27-4499-bc8e-71ad016e46d6", "value": "12288:0nA5k+BAAeB3wr1WPy9mMXE7VaVVOwEZ939BSP5PqVy5Gc:baQAQEP0mMXExaVC9NBWqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644914966, "uuid": "f1cd3641-a6c8-4974-b90f-b29551f8008e", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644914966, "uuid": "d624abc1-96c9-4a0e-98e9-53e3c58bba25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644914966, "uuid": "6916d53b-1fcf-4e48-a586-21405a82a60e", "value": "ohms.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299ad27f-8e40-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644916676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916676, "uuid": "e4fcd539-aa7f-4c0b-abb6-4d2a81119758", "comment": "Malware payload (AgentTesla)", "value": "3bb8636d9e47da15c58aef5a65cd722a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916676, "uuid": "55984e56-392b-4a2f-874f-bf59df6d4283", "comment": "Malware payload (AgentTesla)", "value": "d4d888b22400a9de2efdc87c66077c1a83407d86089818b3ccd6d8224d9c086d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916676, "uuid": "9244f48d-0ecd-42a7-ac5d-50952a7a265c", "comment": "Malware payload (AgentTesla)", "value": "12c3b161b7f8c8886e53bcc7e1776235eead1557", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916676, "uuid": "7f2aead2-ee32-473f-b93e-a88a35214b74", "comment": "Malware payload (AgentTesla)", "value": "1f28fcb62a4cb3da6f48aa0bbe8f0566dbeb1cf5ba506dc95c33b1ffea82ae91f2ffcff04f366f4b9c56bf3ee63cae5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916676, "uuid": "c155fb24-7097-4f19-a8be-ad4edc4bebfb", "value": "T116C34FF5E774B919F010C97CF99982703AF8EF609F325542B465763A197E2BC2D220E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916676, "uuid": "2c168079-6077-4097-a9cd-4724567b3e3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916676, "uuid": "38332cd1-fa3a-4605-981d-8d6f69540468", "value": "768:M1uOrPipIpYezx3maHiYmwN8Agw3nZPHbzYK+:8uOTipIx2vAVZDzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644916676, "uuid": "72c793a2-8531-4f9f-82f4-820daa8554e2", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644916676, "uuid": "9261974a-19c7-4d1a-8773-3365c969fc45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916676, "uuid": "8d897384-3928-4e80-99fd-df00d0c16053", "value": "DOC_XLSx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfd0139-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932172, "uuid": "7553d827-878c-4456-8751-fffe5b322091", "comment": "Malware payload", "value": "0b7a75ec7f5d9b0af6aaad0f5a3a5578", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932172, "uuid": "35b9b581-cfb8-465b-8835-d18f79555042", "comment": "Malware payload", "value": "d5c6bd3a7112eb81df6a5eba6ec46f546f51b98fd3ea523b1988efb1ce615171", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932172, "uuid": "5260b3e9-db82-44fa-8467-c2b1f48b9b05", "comment": "Malware payload", "value": "4fb7c20fac9e72fd6ed8ee28ecf008a7464a8097", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932172, "uuid": "9e793019-1bc3-4d04-8c67-0f26998fa9ba", "comment": "Malware payload", "value": "af822dfc032b86c2e9d4e6dd828aff3a78b22d62156ae979951a1336c339e1f620ee828edc1596a16ac3609bccba371b", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932172, "uuid": "07094490-da60-4ea2-a117-799927b16d05", "value": "T1ECD4AF765294AC8F0F580E91F4180A4A5C5D48D7E6ACD278BEC1B4F4D68A1A48FFCEF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932172, "uuid": "b6d513e3-3e31-417b-a2e5-c5c3b6c3b912", "value": "12288:0kz4FYLAw+AKHUEYsW/h65oYZr4uRxgLe/TZN2vSruRXP5lTe:0AlhjVs26iYZr4uRGLaNeS+XBlTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932172, "uuid": "5fd66fe4-3f3a-4138-8362-6721c20b7a48", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932172, "uuid": "3a4651bb-ceed-466b-a450-5aa841612a83", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932172, "uuid": "c7fe9bc7-adc9-4812-bedc-edc23540ef58", "value": "pruebaremcos.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60950e3f-8e03-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644890569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890569, "uuid": "fbfde9af-cd41-4c3b-be75-796edf1d7057", "comment": "Malware payload (SnakeKeylogger)", "value": "a82937839795a4ffe98029b8f8e3e314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890569, "uuid": "2930e20c-d16f-4e0d-b0bb-9e52504db622", "comment": "Malware payload (SnakeKeylogger)", "value": "d60f299f10954e10fa3dd2d37861b546d9b2d7513b1c810b69098f5510f965f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890569, "uuid": "1c7845b6-5781-45cb-bffa-e06abcdde261", "comment": "Malware payload (SnakeKeylogger)", "value": "59ff8a784e5e7b7863c497151470dfd17a3bed9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644890569, "uuid": "063574fc-4e2d-4618-b395-104e2cb84acc", "comment": "Malware payload (SnakeKeylogger)", "value": "b5c16d4b41c34d966ebdc80fce2a5c64d87e4c597c18505e7b9b3d25bcec575556b7a9c090ad37e04c79b9ecbe0f8981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890569, "uuid": "2942bf21-ae83-4016-badc-3ecc3d1419b0", "value": "T190252204B737BB3CC8B60BF146EB963613BC5E1D1066CEBEE9B321882831721597557A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890569, "uuid": "2faead86-e965-403c-ace8-736f98fa46fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890569, "uuid": "f6d35982-f5eb-4c78-8a98-bd2b52871f05", "value": "24576:igaYv4NRjmGTkBWDe5J1LmZoESwePTLGms:iglx1io94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644890569, "uuid": "7ee439da-0b94-478f-80c8-3e02bf588fa7", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644890569, "uuid": "ba7127b5-e101-42af-b04f-3a5384eb102a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644890569, "uuid": "ba42c39f-53c1-46e3-9357-d54a2e404dc9", "value": "fedex services.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da009f5-8e9c-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644956277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644956277, "uuid": "190cf252-6ac8-4768-8b56-13ae240984e0", "comment": "Malware payload (NanoCore)", "value": "ed59b6f08f871015bc404f299eb925e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644956277, "uuid": "ff8dda13-774d-4af3-b9cc-603fe7262af0", "comment": "Malware payload (NanoCore)", "value": "d653f9f65a7ca73e79b5385d1182d9d62fe34236402d23246f0483cc5e6acba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644956277, "uuid": "9243824c-747c-4095-87fe-be41cb3839ca", "comment": "Malware payload (NanoCore)", "value": "2a088bb7f68ba776dd99f10bbeead857836b52e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644956277, "uuid": "7b99e66b-6afa-4544-bb91-89d8d005d62b", "comment": "Malware payload (NanoCore)", "value": "b8e492e9a328fc3f07b2e6e826097ef4de32686474888663cca8fc2d31d4d60da7063d9b8df531992d0c5858f4bb4c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644956277, "uuid": "09467f17-6dc1-459f-9f52-a53ce6b94562", "value": "T15805021BB72FEA74C478227540EF903513F15B8D1533CE7A6CBA32D80A123A64DB95B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644956277, "uuid": "79182f72-1a48-4bfd-86c2-fa2352f55525", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644956277, "uuid": "355f3caf-087b-48c7-9302-4a4e2ee599c2", "value": "12288:x+oJbNk6K9WKmPbSUrQb1A/pnDVZB+CYJzAzdawPVAb3JYYNQ6rRNIpy4ZwMZb7:x+1L9WN9Q+RtVd1CZrNQ6rRNIpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644956277, "uuid": "91fa3c0a-ca6c-48a9-b045-578d942a0aac", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644956277, "uuid": "64d3b3f1-af81-490e-9dad-638faac4bcb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644956277, "uuid": "879bae4e-91de-4ddf-82a5-2de63fd3fbd7", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8ba824-8e2d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644908600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644908600, "uuid": "0a0dcfe5-36a0-4b17-8da4-bb2b45acd7c1", "comment": "Malware payload", "value": "10466803e68025a809dd86347964e990", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644908600, "uuid": "87b84ec4-3b08-4c12-a17c-5b26b517b90b", "comment": "Malware payload", "value": "d69c663fc5fcaa7ea5356e52b4374fab143059c295cd2c0c1b68e2159b70586b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644908600, "uuid": "3527255b-a838-4f92-9d04-9bb467af2024", "comment": "Malware payload", "value": "9629c637aace9666d5646e66c78421e4c8a55529", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644908600, "uuid": "595bfa20-f825-46bb-8e80-5f3dc14585ec", "comment": "Malware payload", "value": "d0c092c40b4c2dfc4c10294883e65e079aa77a6d340ca69fe17f9924de0f667c451459e67be107405bdcd4ab630a8f7c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644908600, "uuid": "73d1396e-63e5-465e-add3-b74dfa20e3d8", "value": "T134426A3CD0888AF9CF89A1F0662BB91651DD3C9503DAE0D337BCA7604B5232E7326860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644908600, "uuid": "ca307c49-8160-4bbf-bcdd-a5f1b6f53820", "value": "384:qT8SxsndfT7lcucYXOun6j4AMenrrfUDBV:k0ndfT7lLn68Unc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644908600, "uuid": "2e1d15ae-0d60-4c06-b07d-55bdea9dcbc8", "value": 13060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644908600, "uuid": "77b88afc-11aa-4227-b5e0-a1b9654d43f7", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644908600, "uuid": "e7e0a575-9ce3-4b26-995a-1134ffd3cce6", "value": "product.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387647cd-8e69-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644934311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934311, "uuid": "6a75a549-483a-4a52-a459-fa8e3a880081", "comment": "Malware payload", "value": "11da030169f16a341410975e12c17648", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934311, "uuid": "8e0a00bb-d914-4048-96df-682ad6980ccd", "comment": "Malware payload", "value": "d79311af7789046e402dfef5b1b9728056653d4aaf660df7834dc3c4ea53dc56", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934311, "uuid": "d1d331f0-ed83-411c-b423-686619fd0fbe", "comment": "Malware payload", "value": "226fd797a666ecbfe86313c1daa939646b40eef4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934311, "uuid": "822a78a2-ed22-4bcf-98a8-f9b59327d4a4", "comment": "Malware payload", "value": "71dbe0da72bf6c644f26b79cf0294b3f16af3a9b0b6a4eb19749f7f616d9dab5da4900de3acd88e09fd5c1d36a8548c4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934311, "uuid": "641c18f0-6777-4de4-93ae-07508cffc3c6", "value": "T13564AF40F2E980BAD6B72B74257347225A7AB9027F3CC28FA354898DDD31781DE3535A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934311, "uuid": "14ed364e-696a-404d-8a87-0f38315103ea", "value": "c0eaca862e71892f0b09074d92f8955f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934311, "uuid": "eb845ad9-59a0-4ef2-975a-85142142249d", "value": "6144:i2sMMlKdMeqnqKCPhU+86fBY13vxLwod373uHIOiX2J:5KCM1nqKoUaB8ZLpd3ruHIOiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644934311, "uuid": "e5cf99d3-71e4-4ed3-b2fb-5a6a41c7785c", "value": 307326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644934311, "uuid": "58db35c9-882d-4dd8-a3f7-373d0272958e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934311, "uuid": "17f32504-2bf8-4078-89df-f3001c554b6b", "value": "emotet_exe_e5_d79311af7789046e402dfef5b1b9728056653d4aaf660df7834dc3c4ea53dc56_2022-02-15__141145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f9bc34-8e67-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644933426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933426, "uuid": "d320baff-55f2-49cf-8d4c-81ac11229c3a", "comment": "Malware payload (Quakbot)", "value": "74dba1f6575d91c4ac601f9d117c13fe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933426, "uuid": "dcdd3050-9e93-4a37-9663-276c03481665", "comment": "Malware payload (Quakbot)", "value": "d8d7d4ffaefc24dae69840816ce840570744f16d54f43fdb73d28e8456483750", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933426, "uuid": "68d074c6-4867-4154-ab3e-8697cb4e8062", "comment": "Malware payload (Quakbot)", "value": "cf2fbab2301e84c0796c3df4339f02400bc89673", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644933426, "uuid": "a8a0065d-1e4c-4ac4-9744-712cf937a816", "comment": "Malware payload (Quakbot)", "value": "fdd9444d646cd95321da1b14596b92404e7d006789998ef2ab6fa7895c80b529aaad1def4bdb12b3b130b21927455906", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644933426, "uuid": "d159cdb0-0969-4763-b6c8-9c95efeeff57", "value": "T1C1358D3271C1D5BFC4B236BCAD6A71A988257D520D2CCC0DBBD84F4E0D7A691673229E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644933426, "uuid": "32e5b6bf-8b45-4540-8e56-c379b820006c", "value": "220ea7972e993d1cdbf761cab8a71a9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644933426, "uuid": "a192dc6b-dd74-4987-b108-c38fa35580c3", "value": "24576:RuwgYKvPteX5lNEZYygPKFYY22OlWc971Zkqtu2K0FCF:ozle5Pa122S9k2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644933426, "uuid": "a34c3997-1e51-474c-8eac-f770d232462c", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644933426, "uuid": "0988526d-9c99-4adf-9e8c-b8d3062a7022", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644933426, "uuid": "6c0d3e2f-a5bf-4359-aca0-ba84e70a5a1a", "value": "d8d7d4ffaefc24dae69840816ce840570744f16d54f43fdb73d28e8456483750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89896ad2-8e82-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644945184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945184, "uuid": "be479979-7a59-4419-9284-74e1c360ab04", "comment": "Malware payload (Quakbot)", "value": "8759fc7692ec7716642f6d871ab096a7", "object_relation": "md5", "Tag": [ { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945184, "uuid": "fc33cdea-4371-4cb3-9b26-4b6a1905fc55", "comment": "Malware payload (Quakbot)", "value": "d91a7c07bec1136e7117642acd349bdbc7e21cdb4abf1eda8914dac94d5eb0f9", "object_relation": "sha256", "Tag": [ { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945184, "uuid": "796f946a-dcf3-4116-acc0-faebbbd1eb06", "comment": "Malware payload (Quakbot)", "value": "929f1adad990aa9ea0f6f34f963a2fd69bd10a7b", "object_relation": "sha1", "Tag": [ { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945184, "uuid": "c35d2cec-7807-44be-bd2a-bfabdfaf0e0e", "comment": "Malware payload (Quakbot)", "value": "b7bd936cbe7f30549954efa646ab6bf03a20673020d35a809fb8f8aeb450211d3fc992207354e357a1066b16748cc47b", "object_relation": "sha3-384", "Tag": [ { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945184, "uuid": "099d1ea4-eed5-4077-9e9a-ad221ec11bca", "value": "T18C44121D915CB78ECB0D203AE7145EF6DD0F028E6A40E52B46C4FB9847B95C38B8D7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945184, "uuid": "e1c7d3c7-6769-4bec-afaa-d15a0786740d", "value": "6144:NVafQTxwGF4p24e6RoPmj6M7R6SFENKq4Wneb:zacxGgF62PFNJnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644945184, "uuid": "65aa5e07-11c0-4906-b0ae-43d1cd06da8b", "value": 270134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644945184, "uuid": "7b4462fd-7dac-497a-a5e0-f1a5bfe5685a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945184, "uuid": "788f436d-0916-41f4-913e-20539fa65e39", "value": "Summary-573686706-Feb-15.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a65aa7c-8e6e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644936622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936622, "uuid": "0c3d1939-4e39-4f26-9f43-d09986fbcda9", "comment": "Malware payload (Mirai)", "value": "5fb403be4b801c56174c02d3a238e5f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936622, "uuid": "7a840fbe-5c59-4ebc-a887-b27ed9a2a824", "comment": "Malware payload (Mirai)", "value": "da7886de4a82e6c8686511da8e4b720650459287ca9f063b5bf0c72e46054f44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936622, "uuid": "522def52-c523-42d1-aed5-2632dcedf5ec", "comment": "Malware payload (Mirai)", "value": "7db184aaaeea481fd2f342c5b6c7fa85b3efc017", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644936622, "uuid": "97e1806e-48f4-4d0b-b460-c8007b3b530f", "comment": "Malware payload (Mirai)", "value": "1defcdfaef5f46e25f4480da6e1446efc66a5c32cf6e4ea6c8de1b2848f96483d9e5cab6bdc1a8317ecb1d9309290a7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936622, "uuid": "3ed2af63-46b8-4d23-8f04-f192e0c24e0d", "value": "T17D635A31B9762A27C1C4A17A12F78725B6F157CE26B8C61E3DB20E8DFF506006617EE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936622, "uuid": "55ae8061-eed5-495c-b232-a23ff8f3466d", "value": "1536:7+lxwh4S52rb4etztuCpXpa4W3i8oM/Pftc5QD/:72OYomh2yJMXh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644936622, "uuid": "5d18f757-63f1-49d2-978e-8b4434624431", "value": 69088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644936622, "uuid": "b77398e3-e71e-4e5e-912b-ace08460a180", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644936622, "uuid": "3f6a1e97-0dbb-46a1-a233-f875a43bb5c5", "value": "5fb403be4b801c56174c02d3a238e5f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1315e3f-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644953008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953008, "uuid": "ee879eb3-ff1e-4d71-9042-1ea84fd3580b", "comment": "Malware payload (Formbook)", "value": "24d4f0bb710e7c89de6472f90a39498e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953008, "uuid": "12b1fc3d-181c-4012-952d-34f6d4f3084a", "comment": "Malware payload (Formbook)", "value": "da94610beef514cdfccb1a42b01c75820fa176107b3bc41233091305c44f3a3c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953008, "uuid": "fb1a5f72-3ab4-424a-82b6-ed66c26ca03d", "comment": "Malware payload (Formbook)", "value": "be932cade42ca4f703d0e8d3c8f0b12384801295", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953008, "uuid": "2ab9cd70-d8db-4658-b5a3-b811a372ee7c", "comment": "Malware payload (Formbook)", "value": "f19b4f00b502249b80ef3bea42c2c5dfd72984e2654496e41472792d69a42a33774ecdc9180f7f837ab8d454b587a003", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953008, "uuid": "c1a30cc9-31cb-41fa-816a-47e23a1fbd7d", "value": "T1971402327A94D17EC0E2BB39044D825F49F26C286FB3FE36701C73226978D097695B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953008, "uuid": "6727535e-651e-47b2-b0dc-1f43be20f5dc", "value": "3072:4zBOKxNO4JNUMBFddUgwsn/HL2mZWVlywPDJiX0WetCWHMywuyyflk2qTbhnT:WrnjUg7/pZU1PsreHRyytk22NnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953008, "uuid": "2c013a0a-4439-4e72-aa4c-575e41dc0f8b", "value": 191816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953008, "uuid": "3379b015-1586-4e31-ae15-c52b58c740c0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953008, "uuid": "4efba0c0-2d59-483a-be46-edba53e7e882", "value": "SARS AUTHORIZATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b3843d-8e6b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644935407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935407, "uuid": "1abab31a-8ef2-4ce7-983c-5ff997fb9576", "comment": "Malware payload (Loki)", "value": "9180fa96e950bd1932008fdfb8a87acd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935407, "uuid": "e54bebc3-45b0-45fa-bb91-8b9ef5883bc5", "comment": "Malware payload (Loki)", "value": "dad8c93bcc13fc14eaa524eb580ba849cc4070a3ac23e511e44b2fddd832c4b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935407, "uuid": "e5239f05-0946-4386-898c-f8772e6e2514", "comment": "Malware payload (Loki)", "value": "65868fdf6783edfcc6bfec97184c9a429899b56e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935407, "uuid": "c1c62a33-279a-49d8-aa1b-2526f157b002", "comment": "Malware payload (Loki)", "value": "516c90bd347b3a591d6d12116b1920692baeef6b9bfda5e0fa91cd886c8c3a9ac7f7ef90e5c6c582714f2e4b5cd146c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935407, "uuid": "745477a5-451e-41ad-8846-769fdc0b346a", "value": "T18E1402215B61C063E422DBB0A937563FAFB8D9292DA0851727D47F3DAC563C2890F35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935407, "uuid": "5dc45459-5fb6-42f4-b3cc-0a6f87ccecfb", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935407, "uuid": "49d2a8d6-cc80-4339-baab-9e96f4c4a71a", "value": "3072:XbG7N2kDTHUpoulOl5cbgm5uvUqa6Ehou+fW09gqfT1g95MA6ZqtIAtHjQFnVu/S:XbE/HU4sgJa6EhQJ9TTusAOhAdj4y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644935407, "uuid": "1239e637-b78e-4bdd-b56b-625a6814a861", "value": 200640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644935407, "uuid": "ea7acd13-5298-4270-8ae4-acd5f7a2855d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935407, "uuid": "1229c356-143b-484e-b80e-308a62522f64", "value": "?????? ?? ?????? 15-02-2022\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63b1ddf-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644953044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953044, "uuid": "0ef85984-d7cf-4e74-a881-bf8f6fc43040", "comment": "Malware payload (Formbook)", "value": "09332cdc7100fbc1b9ba21fa40834959", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953044, "uuid": "65dd5bb0-4d64-4d50-909b-ff845cc3d63b", "comment": "Malware payload (Formbook)", "value": "db1b0d213793533d5a98c2fa097c91df8b7f093cd63ec04895646f6d7a1e1829", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953044, "uuid": "595581d8-eb03-4f2a-b453-7452512fbe00", "comment": "Malware payload (Formbook)", "value": "26f187ece92d580aafb65279317bb96448319aca", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953044, "uuid": "0296686d-aa72-4cb5-a591-12832693313c", "comment": "Malware payload (Formbook)", "value": "1907bfd2ab8b769e2cbb824d5ccd70c0a14c731ac290e92b593aa85fc83bee4c9a7b0647cd42a3d6e6b48899a12a89a8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953044, "uuid": "170cf945-31c6-4f02-bbab-5ebaf447c9e7", "value": "T1091412513E10EC6DD3F22A73DEAE1A57A5B86D270F15C13AF492F0887335938782456B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953044, "uuid": "7fbf92e4-f979-490f-84ff-05b0661f7e1b", "value": "3072:0IdIRdVY9YPuil8KMea5oNSPioVGFHepXrqUUZVERIbDCjJHmT7:tIUWMxySPIF+ppULEiXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953044, "uuid": "e298bb24-1eb2-4043-b48b-27dfb563c411", "value": 191960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953044, "uuid": "b5749015-bc3a-4119-9a7a-3b3820b1fe11", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953044, "uuid": "a87ba6ba-bcdd-49d5-83e6-7cba14f1be7c", "value": "Scan0020221502.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d391e5-8e93-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644952323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952323, "uuid": "4c0a193f-e4bf-4a62-a55c-36004338f4bb", "comment": "Malware payload (SnakeKeylogger)", "value": "e1d89a1ac48d4e80e1897bd6a8e621f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952323, "uuid": "0a20e483-9e45-498f-9ea4-2badedf2e593", "comment": "Malware payload (SnakeKeylogger)", "value": "dbd907b09dd3b29a2482cfd460af698cb64465cd8526607939b05cdf96abfe6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952323, "uuid": "132a2f58-d014-4952-8eea-9d3b08822708", "comment": "Malware payload (SnakeKeylogger)", "value": "b595f51158fe9c85b6477b53db7588f5b338758d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952323, "uuid": "c1e9fbb3-0fea-4eb3-84bf-aaaf94ecb7ef", "comment": "Malware payload (SnakeKeylogger)", "value": "85d6c3f91924b7ea69f003a6332e7008328d9d018d40a51d808281ab42fb3cb1731996d14d0755ef47646b85523c0310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952323, "uuid": "1f2f0962-37fe-4e1c-9adc-220125a21cdb", "value": "T162B3FE50E94DACD9E7E8C1B3B93A9B100575BBDB92F8819F2265371452B37C320B7D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952323, "uuid": "107ca415-c429-4631-bd5c-3508c4e3c67d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952323, "uuid": "ad7510fc-746f-40bc-9cc0-e35aa00d6163", "value": "3072:ZdJry8o05lhUqrAMgTPA1p8Dja+auDOLQyDl9hF0O4ru6ZQY7j1lQ7wXVA0+sUOb:ZdgCvp4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952323, "uuid": "862035af-08e5-403b-a52d-be55292b04a4", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952323, "uuid": "38fd47b8-18b2-4521-8102-5ba8f4af816f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952323, "uuid": "e0e2ef4d-c2dc-41fe-8ff9-d926511ef9cf", "value": "Rllyszwhi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8ea446-8df2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644883338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883338, "uuid": "d1fd6ccc-26c5-4620-af0c-a5006aebbc37", "comment": "Malware payload", "value": "01d4c89ac11ded96f5f613244e644494", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883338, "uuid": "441658ba-1cc2-405b-b203-39203aac007f", "comment": "Malware payload", "value": "dc2e639742e6a161015a1170d9c09038aaa3b334764d0d738b1af07b470a864e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883338, "uuid": "760a27fb-cbaf-4390-9a53-f72223efdbd6", "comment": "Malware payload", "value": "e225eda6c95ca9c8010bd7f09b4864197a9ea34a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883338, "uuid": "843b9dab-7f3a-4fbb-a20b-cf9251e59b95", "comment": "Malware payload", "value": "dded46f3ca3b56699e0a1dede119565a528f7063e1086e274319848051a816d4eeddc22b2731e6c2c04a77a952b48f3b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883338, "uuid": "15f1bb87-cc31-43fd-af87-403b6be4d382", "value": "T1C305330952B77CC9F5AF6A3812130C98C7BEA2F2A096925912C84C8515777BDB34F3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883338, "uuid": "0688ce4e-82a1-4501-86ff-e13d2aed96e3", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekAd:IDSOgOhntWID2I0WkAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644883338, "uuid": "017c1e77-6205-49ec-a3cc-895ff375cd8d", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644883338, "uuid": "f579bd3f-7e96-42bd-8211-8fd59b953621", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883338, "uuid": "b8e58da4-9569-41d2-b7fa-851eae713e50", "value": "dc2e639742e6a161015a1170d9c09038aaa3b334764d0d738b1af07b470a864e.gzip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06cfc9f-8e97-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644954296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954296, "uuid": "c5d65b51-e4fb-458d-8412-64c98506375f", "comment": "Malware payload (Formbook)", "value": "d7e7604c80a29b3ece05e25a7d54d866", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954296, "uuid": "b77106dd-208b-4fd2-9158-36983e4f515c", "comment": "Malware payload (Formbook)", "value": "dc6b59f8711b0312ed522ef0eb3d4e115b03f1159ed462ba356036644b4f787b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954296, "uuid": "f25dd326-a26d-4c27-8030-040a66c258de", "comment": "Malware payload (Formbook)", "value": "dc154ec93c862c079977f2a30bc48d62a726bf31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954296, "uuid": "f21f2cab-dc27-4974-a104-d93f11f42f8c", "comment": "Malware payload (Formbook)", "value": "5d3b8081a711fb4afe8688922db8563aa9f1eede8e9dfcebce4a93605ae04972f7e51ab4ae0a2abd98bc75064cad3d22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954296, "uuid": "3e62b1b0-ec23-43ca-9df8-9bdcccd81866", "value": "T108352200BB33B37CC4B50BF581A2DA3A06F8AA5D2165DE7BB47730DA14233E659325B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954296, "uuid": "d8a188d6-f713-40b0-ab9e-6efeb2a5bad0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954296, "uuid": "9cfc73d5-1344-4f04-8e67-6b381d3431a0", "value": "12288:TakgV4VUIOQhOYVN83AV5RD6lz2DXRUKzBjt1CXdQsohHCdezxEX9Qv7OTaqwuTH:hgaWYr1XRUKVjLCXvJYSX9QaTa5LM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644954296, "uuid": "55387d0c-3a82-4c9b-9355-42bcc58d15fb", "value": 1094656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644954296, "uuid": "610999cc-00b7-4fa6-ac2f-88bad45adfda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954296, "uuid": "005348b7-4c9b-41ca-bedc-6df91c6ce8a3", "value": "d7e7604c80a29b3ece05e25a7d54d866.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b2be04-8e1a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644900564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644900564, "uuid": "d5ce9d40-88c4-497d-99ce-1145f2a0fea4", "comment": "Malware payload", "value": "4e26acbdb87c91b1e8fc30a55f75f6d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644900564, "uuid": "fca516b0-ee07-4f82-813b-5a8b9cebe022", "comment": "Malware payload", "value": "dcf24e84f3c29d3fa76558c074533a6e6e84967fa3325a29bad07d996464985e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644900564, "uuid": "fff51d35-8e2b-4187-b26b-8be0edfa33a8", "comment": "Malware payload", "value": "df4fe42134d56d1ef2b26cbd1d4108fdf4f4f0e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644900564, "uuid": "0d05dbeb-9fae-4385-897e-334b25e3a852", "comment": "Malware payload", "value": "713090310f49200e8c0b8b8ca53d3bd8841841196f49e9b144fd8713ab3f2bd680f595006565d2df7b80e6772ab547ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644900564, "uuid": "83111c78-6e12-4943-b95a-090cba0610d0", "value": "T1AB5733FD9245375CC86AC934D533AE06F2B1552D0EEA90BE7EDB36507BAF4108A02F85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644900564, "uuid": "99bd7073-8ad2-4525-bb94-15ed53dc78dc", "value": "ab6db24281996adddefd4e9c38cfdfbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644900564, "uuid": "921aae1f-ef5b-4dae-9d31-d531cb164017", "value": "786432:FSG7Bk4RNwLiOZSwmr8ZpzrrIdsKB/RFNOem+:FSwk4oiOZ+4rr/KBNOeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644900564, "uuid": "6f13a5c3-a76e-4908-a614-b797370e84fa", "value": 27340288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644900564, "uuid": "6add356a-735b-48b8-9685-100c207e28f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644900564, "uuid": "e666600c-4da7-4cd4-ac48-d8d005f58e01", "value": "mc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4747af35-8e50-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644923598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923598, "uuid": "ce4bedc0-4d65-4b9a-9cc3-5fe2ab5ebee9", "comment": "Malware payload", "value": "09f5518448b15776f6d95bb72354458a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923598, "uuid": "25eaec87-a27d-4323-a0aa-90dc6f072b7d", "comment": "Malware payload", "value": "e051dd4ec6578960559f6e9c2ddae8da7243ff282918e9d508658fd363a6d713", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923598, "uuid": "79ed5f44-337b-4ecc-9817-a5850e77495e", "comment": "Malware payload", "value": "af9755bb994d99cffa6d961baefe64291b3a69b1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644923598, "uuid": "c4733aab-83ce-48ea-8664-2dca60b4cf38", "comment": "Malware payload", "value": "e53b5d2de6bc9b3b7f03648580b97b79e9c911465079d8effb52edc283440b782e93c4aa0c116b86e2e9b39d30fba750", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644923598, "uuid": "0d3addd7-8ad5-42bc-88bc-6d4792c44988", "value": "T18051F74357E1074DB1F72A15C7722531073EBF45AA2EC64D11981D5D09F2A4898BBFE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644923598, "uuid": "0c3b0c75-2fde-4e9b-addd-4b7e237a432a", "value": "48:XuIKDi7r1nM+kec4JqmjSTOwR5gT/QHMhUjsueOHvv:XuIwWZtkRNZ5gT/QHMsemv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644923598, "uuid": "b386834e-0e30-4d2e-97a3-cca95cad59ca", "value": 2642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644923598, "uuid": "ea716f1f-6893-40a3-b5ab-34f64718f471", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644923598, "uuid": "c564c2f4-a9a9-4aa7-b9cb-f59284f8b8c8", "value": "vjjyc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc686a5-8e41-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1644917462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917462, "uuid": "a4231454-a343-43d3-a4ae-f5bd2786dfd1", "comment": "Malware payload (GuLoader)", "value": "60d5813214c8561bcd3bbb6d212ac510", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917462, "uuid": "1da0b75a-18f4-4d7f-bbbc-68899f619bdd", "comment": "Malware payload (GuLoader)", "value": "e05ab504ac650f4946bf9242fc528c25bc17a9654705cc51a6fb6a11ad8641bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917462, "uuid": "ec01bceb-08ad-48e4-a4e1-40dec07f9268", "comment": "Malware payload (GuLoader)", "value": "6097f09a00833b20c19678a3746f1dc06a37e4d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644917462, "uuid": "ce85bdf7-097c-4283-9842-c227f9de8a4b", "comment": "Malware payload (GuLoader)", "value": "735ece6f02caba3be7c78f612bca8d44559ff7869d296654abd7952ae81847e9e84e8cc41ba3bff252b5c34fd6823a5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917462, "uuid": "6fefe88d-c734-4465-b5ca-4a28cac163b7", "value": "T18A140212ABE0CE56E071033448269FBA8BB6A9345A61CF0753127F5D3EB7291BE1F135", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917462, "uuid": "665b6295-685e-4771-a623-394f0e0cebff", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917462, "uuid": "be00b85a-94c1-47cb-ae72-783d71ba0c40", "value": "3072:bbG7N2kDTHUpouuC2HXrBUPbdUdLaIszCgE230reswAvTUn7LnZGQiIqqb5bPpx:bbE/HUGfXradunsRES0re9AAnZMIqqZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644917462, "uuid": "63a6aeca-2c99-48ce-a5d5-3e3199b3a90d", "value": 192680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644917462, "uuid": "23d6d5d1-5e5b-489c-93f1-36a04a7b2f74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644917462, "uuid": "b667f42c-e2d4-49fa-ba70-10b2b70b960a", "value": "TRANS16085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fed9c25-8e44-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644918485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918485, "uuid": "165deee6-c898-47c6-ad06-9401ba4f6627", "comment": "Malware payload", "value": "3b848a3a275fd281382dbb2dda8f02b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918485, "uuid": "9b172555-89fe-4184-a08c-ef0f0398cbcf", "comment": "Malware payload", "value": "e0e4f4581764ecc5c601b8591362abf3bbfaa684cc059fd7fb71572a3621001b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918485, "uuid": "eb72559c-8ef1-486a-88ca-af8b8f7cb8cc", "comment": "Malware payload", "value": "9ade726f795f103ed9450cc20b92533565ba24b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918485, "uuid": "b2227be3-8a8e-4ecd-856c-188c6006339b", "comment": "Malware payload", "value": "4526bc8f404039763db8681314b519634e407597857ea373933c520f36af36c7df0dcd8c072f83c39806b4f0c664498a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918485, "uuid": "875ed5b2-1fc0-4c40-bcc6-49ce47bb692b", "value": "T104331A07265CC571D41204F0217BAB138FABAA7A549F74A7EB5188643E736C19C3EF8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918485, "uuid": "7f80d65f-5ebb-4366-9ae7-545cd2788efe", "value": "d450bcae35dd205865d1ae0b90837f42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918485, "uuid": "ac10cfa1-7a3f-488b-8d73-572d0326b06f", "value": "1536:COlCGjrZRlV1eCE6cWzPLvZh4hb0qfWT5M4:DLrV1eCjxjZ2ewWT5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644918485, "uuid": "22b08387-fe3d-40eb-9596-7864c344295c", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644918485, "uuid": "6a39ba29-9783-4604-a1e7-530c78aa4ab7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918485, "uuid": "d92d327a-7dcc-4477-b88a-f4ee562c95d5", "value": "3b848a3a275fd281382dbb2dda8f02b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ebaf53-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932100, "uuid": "876ccd1a-02a9-4b32-8d11-76998a2e3967", "comment": "Malware payload", "value": "b89fdb9c272f37eac37d975e4209f95a", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932100, "uuid": "33f65c18-d5a6-4aec-893a-b4fa4308bdc5", "comment": "Malware payload", "value": "e17040b32438cebafde2609e5ad4d0403e5a1d75e13b4117676abe200a026af1", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932100, "uuid": "63682667-e44c-462c-ab0a-4668a7d05beb", "comment": "Malware payload", "value": "c93406972d3b39c6ba30d269396bf69170e9d390", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932100, "uuid": "9c6cf345-a756-489a-abf7-994442609f6a", "comment": "Malware payload", "value": "845212df2393480654747a1aba39237639d2dddef5a4b2641cccc54cc496a9fde07c4f1472c274a471741082b4bb06b8", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932100, "uuid": "2eb46fd0-4511-4552-9b55-98bc045777a7", "value": "T137D343771773AB094E098FA598DE27D9BEB428771A20C191DD0333BA74961F18C24DEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932100, "uuid": "bec3b411-d949-406d-976a-e308ce41b73f", "value": "3072:a/crg0Q9CTC2EGiJc0Os8hFSi79+ahlALE9d:sc/Q9CTC2EGiJc0n8hD9+ahiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932100, "uuid": "5df96873-e9f5-4a1b-b64c-c163aa14fb60", "value": 134488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932100, "uuid": "45e63148-e6eb-4b60-9560-0c005ddfc5b4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932100, "uuid": "8c74ae29-e378-4060-8b0f-2e6afb96f4a4", "value": "multi-pandora.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ce2582-8e78-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644940911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940911, "uuid": "a725d250-23e3-4546-ae9b-f397c907d4cf", "comment": "Malware payload (AgentTesla)", "value": "3fd7d81b8ade7da96e2a7fb8d0021970", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940911, "uuid": "e2364b1c-dcba-43bb-981c-58bd557362d4", "comment": "Malware payload (AgentTesla)", "value": "e372c9ed1a1828724ae3034ec652bf9c60b3b0cf31f8f66fd809fb5bf70f6402", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940911, "uuid": "e69b1574-4a85-471b-a514-0cba1d02d28e", "comment": "Malware payload (AgentTesla)", "value": "3e8ffa8abf1aaa3762905960da5c86637ec12ad4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940911, "uuid": "d07c984a-4186-48a6-aec4-2e366e146baa", "comment": "Malware payload (AgentTesla)", "value": "c026f52a2dcceaf7732e43eff62f9a7695c483111b327ae297059b3f25022148aeba50adfc5cc0b556c02e930d55db20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940911, "uuid": "50104113-d7f4-4188-8844-c992746496d3", "value": "T12705F10073B76A85E43317F698AA854017B5BD8D9027DA3DA593768C0CB3782457BE3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940911, "uuid": "d7e34a2f-3485-45b0-a089-eabedb4e7144", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940911, "uuid": "fa665613-6444-41aa-9336-ec58c32f1743", "value": "12288:gO5k+ANlArnK79I8FkJjToAv23IAXKrxfaJF9KBdSSbZsQc1HZveJz3eu4z:VaFKrKx4JjToVJXKrxaSq1kzuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644940911, "uuid": "43cbd68c-8bc3-433f-b11b-3328e0f4ca25", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644940911, "uuid": "905f39e8-6469-4842-97f7-274f259a4d70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940911, "uuid": "946f967d-1dc7-47ca-a139-9d8ed95f1102", "value": "PAYU_SWI.SCR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e192b60-8e57-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644926643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926643, "uuid": "ac24d932-756f-42d9-a98b-c77375c26d53", "comment": "Malware payload (AgentTesla)", "value": "f0976ef38b2c6f34a117eb4873edfc4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926643, "uuid": "7f01f125-f04f-4405-8d2d-587e66b07258", "comment": "Malware payload (AgentTesla)", "value": "e4338860f3051f2051a139c0ab2e22bbc6201b7e74d54ad6bede7651a2675cb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926643, "uuid": "7bd192e9-0cad-4481-accd-5d1a2d8d9da7", "comment": "Malware payload (AgentTesla)", "value": "0131ffa15ac0c484124fe87a0696f3aa162b5910", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644926643, "uuid": "e76e2356-096a-426b-a4c4-f84ed4e10ed1", "comment": "Malware payload (AgentTesla)", "value": "80de5062fe525a7bee7dc3be48b55177cba350b7d1309952cdeee6ab4e7ae30e25ffe9c1d30205f5b71d9cc16358be9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926643, "uuid": "7ecd3947-88af-4d99-96d0-dd7cb689272f", "value": "T1EF15CFAC7662B9DEC817CE76C9942C64EA6061BA071BD237901325D89D0DADBCF341F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926643, "uuid": "05515926-67fe-49f3-a272-76eea08b996f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926643, "uuid": "37efcdd4-b48d-4dce-b8be-c791e503f9f0", "value": "24576:uy6CwG8X9SIK7tzQZLK0nFXsJ8zsrFh/ox5hua:r6CwstzQ5K0nFG8W+x5h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644926643, "uuid": "8cbb164d-fb61-4a36-a2c0-c53a9c9f7415", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644926643, "uuid": "51115e86-caa8-40a7-a3e2-6c75ae4c5642", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644926643, "uuid": "627ab289-7e19-4e69-b48e-1b735e0500e6", "value": "DHL Delivery Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f905c9d-8e25-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644905036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905036, "uuid": "3ab8a18e-fa25-4f3c-8ab2-04fc36e94a03", "comment": "Malware payload (Quakbot)", "value": "f0ed5abd066e73fbb0383ea70d1674d4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905036, "uuid": "022747ac-93a0-4b40-aff6-00dde99b23d3", "comment": "Malware payload (Quakbot)", "value": "e55a662e05fdc1e0c8570564bfcdb0d7cbec3bf5eca101ab12ac2997998c2aa9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905036, "uuid": "754a63d9-48de-427a-af83-003d4f9bb18d", "comment": "Malware payload (Quakbot)", "value": "9a60895c35e0b46c09ed778c697a3b8bae8b9680", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644905036, "uuid": "ec69c5f0-987e-4475-9601-15a793d62f9d", "comment": "Malware payload (Quakbot)", "value": "5a29ab7cb45634a7d8b8bbfcb7504029a9bdddd832a00c07233e761f1627cd961b8123102cf056bd56608908d9cd008f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905036, "uuid": "c952e898-1f30-4901-8b17-175b471e502f", "value": "T100358E3271C1D5BFC4B23ABC9D6A71A588257D520D2CCC0EBBD84F4E0E7A691673225E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905036, "uuid": "ea8d77b4-ac9d-49da-ab41-fd858adafbd0", "value": "220ea7972e993d1cdbf761cab8a71a9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905036, "uuid": "7f5850d1-5e05-43d5-8475-420869c7c6d1", "value": "12288:Nt1RcM1gmtlMFHvP/AT0qUyF1XPPzXTwnUV1cQ47gZckpPWUyQVurP6lbuiw1rPw:duwgYKvPteX5lNEZYytP/411KQtg9FFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644905036, "uuid": "5fc2302b-d40f-4db0-967c-ee0fadd5a332", "value": 1098736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644905036, "uuid": "9e9b1ea2-7c05-47cb-8056-cc5e51a95fd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644905036, "uuid": "4d025991-12f7-4d68-b18a-05fb9323bce4", "value": "e55a662e05fdc1e0c8570564bfcdb0d7cbec3bf5eca101ab12ac2997998c2aa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df87104-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932146, "uuid": "c7a0aff3-c2a8-4e5d-b6af-4da1c603758d", "comment": "Malware payload", "value": "86fdf81802c7046de68d1ba383df8e1c", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932146, "uuid": "351f2e47-390f-4b0d-8d17-43104fb82340", "comment": "Malware payload", "value": "e5794b92542af19bc35fb8dd8852a011f98622a72f6e3770db0aadeac2e70200", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932146, "uuid": "e116f104-5506-43b6-b79d-5917744cfbfc", "comment": "Malware payload", "value": "b16577522cb6da44a64ae4152fc8ee1a07bc9da8", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932146, "uuid": "ba733d3f-c634-4729-ad87-237cb19c1fc9", "comment": "Malware payload", "value": "4287c9fdd67e8063224f74408297c05241a94ca84adbc3a7328885bdf28f80534f28d347970626f04338a134d9b4df40", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932146, "uuid": "7c930836-5f00-444d-a6f1-d1c0ed8aa926", "value": "T1F3636CB71315FCBF1F0A1DA4E10817411C7CACCBE6EC91A83B4138FA95865589ABCEB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932146, "uuid": "84ff1857-7641-41ec-bbe2-b5d71262885f", "value": "1536:j4Nd3fjZ9Udv032Qm0yDzkfCgUC5hiOcEgCh+BlF2QN:jSvjoMmQVyPkf1LjTHh+BlM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932146, "uuid": "33871298-2956-4616-b9b1-5f70991ecbb8", "value": 70316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932146, "uuid": "51bbc2b9-5e84-40f7-a5eb-17da98409daf", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932146, "uuid": "2446ed39-9b10-42a4-bced-50e96685a594", "value": "PPP.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689488c2-8e98-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644954578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954578, "uuid": "b51bbfe4-cf2a-433b-b937-85b71144c464", "comment": "Malware payload", "value": "ee8091e8cab68a95553fe71675ee49b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954578, "uuid": "63c394db-692f-4eac-8207-f474f9e27ab6", "comment": "Malware payload", "value": "e5a77ea70030afc13a4b33dffd4eafb987dde3b2b7ec0a3525b844dc7fdc2d52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954578, "uuid": "7364c72b-f46e-4d68-9767-114c2ab01ddb", "comment": "Malware payload", "value": "9ab8c01555969ebd1f612b5da953187937bc2fff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644954578, "uuid": "56802b78-f51b-4bce-98fc-2430579250f1", "comment": "Malware payload", "value": "8a1407e57ea36c8d1686647bfde6fcfc0d86c09d6ea367035d9dde5efdab5aaf0fc63b25fa046e001586afda0047c722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954578, "uuid": "bf9e5a0d-8eb3-464a-ab9b-6d3a4d62a07a", "value": "T193B5331177D4E073C213513118098B72B63DF4756A26928A7FC65F3D3E36AA6CB3AB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954578, "uuid": "b5b184cc-2b78-40bc-820f-5e30e9b0525f", "value": "9d1f0da408c33eebb70b9bfa17b7fddc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954578, "uuid": "9dd1a3f2-3132-485d-bf53-c4c332d90cbe", "value": "49152:toX3yq8XDY2Td2l+xysLqmiuUyKFAMkq9xraNSNzHznV:toHyq6d2UlcAcTrIS1TnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644954578, "uuid": "1492be91-ecdc-4b63-9e69-be4c8b12d5df", "value": 2305162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644954578, "uuid": "b0c7e088-b60f-4a04-a3b1-85bc5f1c2395", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644954578, "uuid": "79dd68d2-c79e-4133-a77f-88567c484272", "value": "ee8091e8cab68a95553fe71675ee49b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160a0d3b-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932105, "uuid": "6f9fd5f4-129a-4db9-8c52-66e94ad5f12e", "comment": "Malware payload", "value": "1b2a18fe7ef65e1caee57c10259ad8e0", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932105, "uuid": "f7608c1f-e1f7-4b08-aecb-aa46f1194863", "comment": "Malware payload", "value": "e5e1fa2eeb76de8dcbb68cab519626949d68dc12229ab53ad078b03e4eef31b8", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932105, "uuid": "b2489a35-a570-463c-88b1-b7c5da160eb1", "comment": "Malware payload", "value": "17b7b6ba75dc48dc9ac8fbd972886d1c683365c7", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932105, "uuid": "825f45c9-39b5-48e5-bae2-a871879e4be8", "comment": "Malware payload", "value": "04e80855ed3ad68f433c251f0133d21c91a5ec82f9495b2c67653e628b732ede85833deab867824aad740a0d3b43862e", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932105, "uuid": "2c950b6a-9bdc-4822-9d20-f0ac772a91c4", "value": "T1ED1309B30653BD8F17270E41D50C2151DC59EC6362D999ECFF8898F58BE41189EB8EB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932105, "uuid": "5e09716f-f714-49f5-8fce-d5dc0d55e9d0", "value": "768:9WqH6xTut4KaeqDA0qjRfUa9z1wx2ByAmhG2kfgnt/XpXc36:9WqaI4KxqDAf8a9Zway/hJkfgt/XK36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932105, "uuid": "0fb4db86-5bea-4fe4-81c0-9561f4bb5492", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932105, "uuid": "8e46dffc-0fd4-4b53-a9b1-866a8709ec8f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932105, "uuid": "320ad481-aa34-40e2-a3d4-ed141da0a065", "value": "newyork1.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbd3141-8e8c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644949671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949671, "uuid": "712d18fa-218a-4c5a-a157-7d9d7ff1270d", "comment": "Malware payload (AgentTesla)", "value": "b394205056ba15f299c2a1834d2ee6d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949671, "uuid": "96bd085e-5c89-45fb-a542-9a69ec5824da", "comment": "Malware payload (AgentTesla)", "value": "e745631dddf862e3812d2986eb535c04be70735f0f83aafc1b040042acb9b555", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949671, "uuid": "275064d9-1ee9-4b9d-84b5-af73fda60343", "comment": "Malware payload (AgentTesla)", "value": "e3290858f035de9c9a3c9ca65a790fbf5f17b72c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644949671, "uuid": "198874c1-63a4-4960-9623-2aee2a160b0a", "comment": "Malware payload (AgentTesla)", "value": "7fb955242e73ee6c12c70f0099900c927e0526a2d2d4ad079b9b0a3494e42ff5225ab861c91a44fe07352ef2eb28d097", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949671, "uuid": "2a00d331-4cbf-4c3a-9c9c-2848e768494c", "value": "T1068423A2F64B5341C6198B703D31F67491B30CE995EFC9EED481075EBE9DA2C8A89780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949671, "uuid": "60ebce12-85aa-4beb-9782-c8b5b814cde4", "value": "6144:1XVw/djqRVdkGoJP3u+T9KJ+Oy67PxJWToLrUjAcsFCYl9/lBmQ:1X+l2RL/oJkp7PaToL4s/lIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644949671, "uuid": "409be1bd-c709-4ddf-b23f-3ca055f557cf", "value": 405787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644949671, "uuid": "6f949674-2ce7-4215-998b-501f28ae6acd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644949671, "uuid": "9261a3cb-19d1-41fb-8895-0abc032c63e1", "value": "Purchase Order-norico#.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb2e2ca-8df4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884258, "uuid": "de1304b8-e40f-4e42-8ba3-2ed1c4cbe643", "comment": "Malware payload (Mirai)", "value": "bb1f65e6b6ff80a26e5191bc31882338", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884258, "uuid": "a7034d19-a752-4c95-aad6-53686c7a8a5d", "comment": "Malware payload (Mirai)", "value": "e74c13cec8a05ecdda399307c4c5a1272340242ac876fe5d9287b66cc5f586b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884258, "uuid": "f434654f-0eeb-4359-bfab-d4b1062c8c63", "comment": "Malware payload (Mirai)", "value": "5af850821e30487d62db9f5b4f1541738d09eb40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884258, "uuid": "ad791f02-45d9-4a87-ae9c-5e7e2000590f", "comment": "Malware payload (Mirai)", "value": "246515beca268df0efa78b4ea42cda8a34fb581748045efb7f3fa5802b819a8fe187b1e44b70937b21968206fd7edd36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884258, "uuid": "7e7c4170-9581-42cd-83de-a6823c78e3a4", "value": "T155E27DA7C46A6ED8E6588638E8358E781F53F004D3531EFA1B8945A68047DBCF60D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884258, "uuid": "6bfb4d7d-ddee-4722-8739-68d7d8624188", "value": "384:5aAJN6V13EoT7wt1ltUvdCX3Xf3Xssr+kh4pevvEgfUdRECCg6RWFe8ho3/JOqB5:5amoT7wt1TeCXP1a1e0gf2yCRoP0BS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884258, "uuid": "85e3a784-8cfb-4693-9d3d-44674688b083", "value": 32704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884258, "uuid": "c987351c-15c4-4abe-a594-d78cce0cc18f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884258, "uuid": "3b1ebdce-b0bf-4a47-a631-5c35705dd298", "value": "mizakotropistah4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198fb6fd-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932111, "uuid": "8f37a0d2-1427-49af-90bb-85becbeeb7c2", "comment": "Malware payload", "value": "48de0106fee81ee216d112b3cb589241", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932111, "uuid": "ab8e7f43-3870-4f0c-86e5-d9093a20325f", "comment": "Malware payload", "value": "e7586556262e9bc9898e332bf5badd8b7fe35de4b951792a9be4747f1f863995", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932111, "uuid": "f6ebe6ce-a6d2-4ec5-bfd4-6b1a3fa77c16", "comment": "Malware payload", "value": "a34aaa7cbadd04834bbd22208f0cc3d561def96c", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932111, "uuid": "dc1963de-7681-4b72-86ed-6a26d1c24e4c", "comment": "Malware payload", "value": "0c54a6f97b111d35c564488ffd3e3bfbd37e863fe2f36276c67b0a4a3c7aadcf16410530d9b14369a83a7927f59d3848", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932111, "uuid": "f1e83af1-731c-44b4-8168-884799117933", "value": "T14F131AB30253FD8F56220E45D50C2210DC9DECB7329999ACFF4898E99FE51188DE8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932111, "uuid": "b33f7c1a-215e-4ad2-9082-0baae6d0da0e", "value": "384:YGWKDx6+x+P/1hwK6JqqNwplg8teobmvW+VP2kfYIDy9nom/L9dpGWcUKnM:YGW6x6o+TwKa4Wobm+I2kfgnt/XpXc3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932111, "uuid": "7e19f396-0e85-434a-a2c4-ded02d35e626", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932111, "uuid": "29202341-be39-43ed-8048-8432b158c753", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932111, "uuid": "798094e0-afc5-4349-b82f-42a260b3b413", "value": "njjgordd.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb441629-8df4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884279, "uuid": "28c54929-8b93-4bcf-b6e1-910105164a2d", "comment": "Malware payload (Mirai)", "value": "74d1debd08be8d5107b69940bd6c060e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884279, "uuid": "c99957f9-e6af-4c78-ba15-2ba6d654ec54", "comment": "Malware payload (Mirai)", "value": "e762e34fb86167d139a61ecbcc6dfb768ee4cfb7955469ff9fda6e444a60af75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884279, "uuid": "264360f0-9f5b-460d-b950-e403a7d60adc", "comment": "Malware payload (Mirai)", "value": "44536105975271bcf119b188301622d73bab554f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884279, "uuid": "d814573f-52f9-4641-8290-6404c14ae84f", "comment": "Malware payload (Mirai)", "value": "ba9a969cb2abeaafe221a46bf83f8ab2d655aa87930c5fc9c2eecc87f14c5e8a53734351a5f2f1bab9db6b1f692bb698", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884279, "uuid": "4ea97b0f-de97-460f-b9df-50ee01818535", "value": "T180F22B42322C0E5BC5666AB0253F17E083BFB9A520F4F685255F6B5A8635F771082FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884279, "uuid": "85eb6dfc-e0d5-44aa-b9aa-fbe3c8c0260c", "value": "768:ZLKYTnUsnOU16Zw67wlwRgDDCp8rIEIpe7k+y2Of:jnhOU16ZwAw+OCSZr7kIOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884279, "uuid": "f016194e-9085-43a9-8d48-ece2c0f2a80d", "value": 35012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884279, "uuid": "ce589112-aa51-4584-83cf-7293f3230c63", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884279, "uuid": "0e758ca1-24aa-4acb-bf8b-644c038ef204", "value": "mizakotropistapc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed62769-8dfb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644887157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644887157, "uuid": "145c50f6-63fe-47e4-8b0f-257c78623c64", "comment": "Malware payload (Mirai)", "value": "d9a40d4f35a0e7b5d5b2009b901ae74e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644887157, "uuid": "a4881412-d67e-4aa0-b493-027d727c2d7d", "comment": "Malware payload (Mirai)", "value": "e786fca58f99d2c85616a31db2579e7575bb819dac30b83627823b95ddf44864", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644887157, "uuid": "b8d8fb36-516f-42d0-8781-4b4f73fca733", "comment": "Malware payload (Mirai)", "value": "f1029be02d58c76e1078a698585f76dd0503b70f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644887157, "uuid": "add50ec7-13e4-492f-8e70-d1764f444e6b", "comment": "Malware payload (Mirai)", "value": "a59e878f2f1426474f19124f0b754a55ac6de5dff7203c23edb6798055d77e44053678dfbf9fb8cb32904c355e9946bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644887157, "uuid": "082944d6-74aa-4345-96a5-2bf90114b424", "value": "T19A935B21B83D2B17C0E1B07E21B78799B2E027DD36A4C61E7D720E5EFF2259065439B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644887157, "uuid": "4565e10d-be3d-450e-af6b-407576e40930", "value": "1536:WHiCjiw5FAE1ijSk6BgntQ0uS/WguRHoousEJ4I5UKkKTUHw:+PJk6aBt7KEa6kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644887157, "uuid": "e0014b18-8514-45d6-a9ef-43032bea7ae5", "value": 91144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644887157, "uuid": "1b60cba3-f383-46af-9cb2-cbec7797703c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644887157, "uuid": "a5bebba5-de00-4992-82ce-d8795bd3a2c8", "value": "d9a40d4f35a0e7b5d5b2009b901ae74e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e49bd1-8e63-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644931733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931733, "uuid": "de250bc9-ec24-4d0d-ba53-76cb3f9822e1", "comment": "Malware payload (AgentTesla)", "value": "9cc687355487891e17bb50b541f6c298", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931733, "uuid": "63a77120-7b03-4079-9731-f4d5f4745301", "comment": "Malware payload (AgentTesla)", "value": "e7cac2b948b2ebb032b15b025747eaf10cbec21d5adb365d878e100013e0cf1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931733, "uuid": "ab9abd5d-07b1-4a51-9a7e-2cc8ea8ef937", "comment": "Malware payload (AgentTesla)", "value": "84190e020925c5fdc1cc50f15b0f2b6cca38e4a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644931733, "uuid": "3365c59a-db4f-4c3e-8285-2957effecfcb", "comment": "Malware payload (AgentTesla)", "value": "096045afa2dfec9d105efd4aabbe3114b734a946c25a68cd2010699e4cea22c3d0d59b443af914a6cfdebbbdb302e896", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931733, "uuid": "d73a7f14-af32-4b32-84f2-467ebd2e39f9", "value": "T10E051201B7B76B40C0720BFA94E181850BB5A98D1527E73DC96370CD5D63B94CABBA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931733, "uuid": "1b46a8ba-3043-4690-9532-60d92c1aee70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931733, "uuid": "6bdeedd6-988d-46e2-82c9-a916d682a730", "value": "12288:In5k+a8y4d3QChGcmLqTzvUTlmsd6sJG2wPsRw69M7C7jggJjj7xXwG34vj:IaWvmoWlms8sNN9M78U2H7xXw+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644931733, "uuid": "8d0a93b2-cae6-4c7a-ad13-2a3bd612a011", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644931733, "uuid": "8202d8fd-c7df-489e-a090-00b4bdfbd5c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644931733, "uuid": "3ea0c4aa-052a-419d-b2ba-c5b3aeeafce8", "value": "Signed Contract.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fae74ec-8e7c-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644942403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942403, "uuid": "d4113d49-9d19-40b7-b4f7-b6d027f842bc", "comment": "Malware payload (Quakbot)", "value": "32e0d809c346c7e586cc728ef95ced4e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942403, "uuid": "ba03280b-62dc-48f3-8dc0-a3cf1a6ebdaf", "comment": "Malware payload (Quakbot)", "value": "e9553ac49999a213ddf6001564a5cb87225f2b5b91cb201c8a415f8dbb1eb623", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942403, "uuid": "89914682-6d96-4270-8fb3-e034d238186f", "comment": "Malware payload (Quakbot)", "value": "45c378524ef3afbd7cca29c3d5a84a5139b8ef0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942403, "uuid": "d6ebc501-1bb1-4b87-b01a-b236935759bf", "comment": "Malware payload (Quakbot)", "value": "001f337b8884014764ab4e840abbf7279fa696b09ea2e8c577aeacaa88bfa5de178a1bf72c80afe121146c86717ab6f6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942403, "uuid": "c708d0cc-ab4e-4f49-b780-e488b6bc9873", "value": "T1CB358D3271C1D5BFC4B236BCAD6A71A988257D521D2CCC0DBBD80F4E0D7A691673229E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942403, "uuid": "ab10a0ab-d1e5-453b-bb97-de8327303ed7", "value": "220ea7972e993d1cdbf761cab8a71a9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942403, "uuid": "fea026d0-cd7c-4a3c-a701-f4a469190ecb", "value": "24576:JuwgYKvPteX5lNEZYy7PKFYY22OlWc971Zkqtu2K0FCFFi:Azle6Pa122S9k2Kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644942403, "uuid": "4adabae6-d080-48ee-aff2-dcfb1149ec2f", "value": 1097200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644942403, "uuid": "1f1bcd88-a574-4c0b-977f-e6c5435fe1ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942403, "uuid": "599d9f97-a3df-406b-8e89-31a09fa24054", "value": "9080975043158770.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4a7d1b-8e45-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644918936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918936, "uuid": "e058a853-e3f5-43e4-9024-cf711f7e95b9", "comment": "Malware payload", "value": "473e1d83ab0029fa529ed8ab2380c7c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918936, "uuid": "4cbf92a0-86f8-4ef7-bcb9-a1abdfb23c71", "comment": "Malware payload", "value": "e97be24e82801153d94235deb22cd51357b0a14cbfc6ec4bde4bae287b07efb2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918936, "uuid": "c9b2501f-8600-466d-b8b9-7684b212dcb9", "comment": "Malware payload", "value": "5aae6d49dba5bbd3ef0014940f48875556bb321f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644918936, "uuid": "b31f3da5-a680-400f-8b88-9be50bc5a97e", "comment": "Malware payload", "value": "f9db1b7467b5614cb81b3f5c5420e07900ebaad007c08eb57added8b9dd1990996a6d0daa6068d25df299e8442a0479f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918936, "uuid": "f5cdf8d6-b1c5-4cca-a0ba-8b112558d559", "value": "T1C344F19E57A48D56D4DD863F50E282508BF5D1038622DB0A1CEC72A2CE7B7A133DF1E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918936, "uuid": "4183682d-b0dd-4b18-a3f7-d8a2150e3427", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918936, "uuid": "9b60c61b-99e9-465f-9dc6-110fa998e732", "value": "6144:J7RnrbnNb3G/geBctpULbs2ULegLizTn3qgStWN:Rxtb2/PBct24eTTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644918936, "uuid": "37fa1aba-adbe-4c65-bad8-309a9c15aded", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644918936, "uuid": "db26a3c5-f18f-45bf-8444-8548fb1887fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644918936, "uuid": "1aa675fb-12ae-4ac9-b670-ed434560fcc0", "value": "Piojdndp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59588c04-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932218, "uuid": "2defdfa0-b13f-4cc1-b7a7-ec9c2f18cdd1", "comment": "Malware payload", "value": "6c082a712daab4f9c38633c449a4162b", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932218, "uuid": "869632a5-2391-4ba1-afe0-9e3128c486ca", "comment": "Malware payload", "value": "e98be588e725db020eadd0ca5112c5aeb5a47165b1d7f25b399f6e929d73b778", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932218, "uuid": "e186c5db-1d64-44dd-a106-18ef9c1baffb", "comment": "Malware payload", "value": "f7b8c2e3869f698d9f90cac3c22cecd852cdca51", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932218, "uuid": "83f29a87-8149-4bfa-aca6-002d650cb92f", "comment": "Malware payload", "value": "4820734548173f621175c322d18732c164e2112189d78f28aae684b825c1782fc0defe971190e92af9ebed64d98b92f6", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932218, "uuid": "36868c4b-7505-4244-a93b-28b003159837", "value": "T13C131AB30213BECF1B260E41D50C2115EC99ECB771D8A9ACFB4848E58BD5114EDB8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932218, "uuid": "ca1465e6-0bd9-41a6-bc25-8e191aa7ea01", "value": "768:YGJpxoAYNfY++m8Y6sjoYISbme12kfgnt/XpXc3U:YGIfx+m8Y6UISyeckfgt/XK3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932218, "uuid": "ec295684-7b40-46a4-8620-9788a42fcec0", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932218, "uuid": "7fe3120f-a34c-40e3-a657-0b061dccbcca", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932218, "uuid": "84f9fe6f-8e45-4fb1-8008-3fc35e07ddbb", "value": "trest.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b429cb-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932160, "uuid": "54a5d031-56a3-417a-974a-fb6219b23cdb", "comment": "Malware payload", "value": "8520c8fb8a371fcc8b0bbafab27f5f35", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932160, "uuid": "48daa8de-eb41-475e-a9b9-9647b93cf442", "comment": "Malware payload", "value": "e9d08215a536fa1789245369b46e98da47796bb90eccf01a77c8d430ab932c7a", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932160, "uuid": "e9f4be30-b324-4ef9-905a-5e8ebe0ca568", "comment": "Malware payload", "value": "cb61294944189628cac2c22c54f7f86a0c24bb6d", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932160, "uuid": "a06ee661-ca85-4ae9-9e9a-6f13b0f10a57", "comment": "Malware payload", "value": "ad0b68cd935cee41120ba147f598954fefa8bcf5d09df8c607792a43aadf63e023a3d7a0c4b92ebf459614f42b31a8f5", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932160, "uuid": "d364d665-b457-414b-aa42-a713ca2b40d4", "value": "T124636CB71315FC7F1F0A1DA4E10817411C7CACCBE6EC91A83B4139FA95865589ABCDB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932160, "uuid": "1647b6ab-0665-41e7-8ab5-ee3fe5e46b05", "value": "1536:j4vd3fjZ9Udv032Qm0yDzkfCgUC5hiOcEgCh+BlF2QN:jMvjoMmQVyPkf1LjTHh+BlM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932160, "uuid": "70cd38be-5587-4964-a392-28bc0442b442", "value": 70316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932160, "uuid": "1a1cf414-2969-40d2-816a-193b0b970d78", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932160, "uuid": "883deee2-992d-4417-8e19-b8838317cebb", "value": "PROXYGORD.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541fc2d7-8e7b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644942088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942088, "uuid": "84431095-869c-456f-80c4-b03309125951", "comment": "Malware payload", "value": "41d9e5babaf8ebeebcd3c4edfc539852", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942088, "uuid": "b5b45f2e-23e3-44f1-a1ba-3df65991694f", "comment": "Malware payload", "value": "eb3b0ec5cb29ff88cffdd9190fdccfbd6bbc9009dbd05b5eff4e39bcde96342b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942088, "uuid": "f1b464f9-3e5e-455f-b20e-9dc603e456f6", "comment": "Malware payload", "value": "acb945fffdab244ffff018c5423c78a7ee025a6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644942088, "uuid": "03d2e0d8-5933-4617-af18-6ef3fbf7071e", "comment": "Malware payload", "value": "9df57c2770114e88d7c39ef5c6186e6ee0803739bc90e749ea460a09e9ec6021b41a348d48c95b11c09f28ee0bb0095c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942088, "uuid": "7e7d0e74-aef9-440a-8bd0-d8b9ce663deb", "value": "T130925C187395C677E4BA8F3218E70F80A6B4E2585937471EC8C62B3FCA13745496BB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942088, "uuid": "1bec052b-2237-4717-9601-142e683cde3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942088, "uuid": "50bea87f-fa82-4cb1-84b7-d5e4c14f972f", "value": "384:L+FlgIoZMzeUIeNNSSUaepk0OOyd3zhzY5R1Z:CFOaIeNoSUaq1LyJdza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644942088, "uuid": "bb6f5a17-10c4-4f66-a8cd-71cb4b29bcd0", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644942088, "uuid": "e5da77a7-eaea-4e26-b1e2-26916f86efe9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644942088, "uuid": "adb76846-9290-4f38-9022-a3c5a3bce739", "value": "41d9e5babaf8ebeebcd3c4edfc539852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2bf59a-8e69-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644934453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934453, "uuid": "430c7ed4-367f-4954-ae77-24aeb4347baf", "comment": "Malware payload (Formbook)", "value": "8fa3a85a3769c69eab9dd7e30de090b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934453, "uuid": "711385b7-510a-4538-b9b7-8b6ea001b74e", "comment": "Malware payload (Formbook)", "value": "eb6878c79c116a74a2a2cc20a9875ccd7c0e58d04037fc1af99006dd93b07617", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934453, "uuid": "3a355c11-a2d9-449f-906c-32a111a8b21a", "comment": "Malware payload (Formbook)", "value": "bee1801fff5cf4dbfa45fbb1400c28d415646f87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644934453, "uuid": "d3de0df5-2538-49d2-9321-8b98811ca3c2", "comment": "Malware payload (Formbook)", "value": "7ee1f25e80ecfc0f9a9f1b2c5a64618eec1cf4f04bafc539a81c4e3bce02f76e3427cd8315ed02ed7345abf16654e7bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934453, "uuid": "ca6c9851-7609-4ec3-8014-abe0b555e3b1", "value": "T1E415E007B65FE72CC96406B130BE813043A59F4F1523DE76B8EAFEAD056225E0A741F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934453, "uuid": "3e089b49-cc5a-43f5-a233-72b6805de0e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934453, "uuid": "65be337e-2702-4660-880a-66817caa2b9f", "value": "24576:9tr8vA1IPImCa91PpkdfjV8zjaFgAdHHL:3r8vA1InCa9r0rV8zjdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644934453, "uuid": "7f0de73c-d3f7-40ea-9676-ec6102b66dc0", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644934453, "uuid": "a2a30344-31bf-4d13-b2bf-17dd93ed3359", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644934453, "uuid": "5d7395d7-a231-4c8b-b439-6ead9f4640af", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55be7647-8e93-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644952399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952399, "uuid": "7819f237-9099-4664-ae6c-a0cb244b7f2d", "comment": "Malware payload", "value": "07a7cea5eab70c8af278afcf54ddd7b4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952399, "uuid": "a320d2b8-fb72-45f0-b0d7-c17c5353ba17", "comment": "Malware payload", "value": "ebc2d0630778b66881b1dbc0c87601b5fd166826a201ccd060911ea9af17815b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952399, "uuid": "31e73842-b4a2-4eb0-9d99-2d8b97388442", "comment": "Malware payload", "value": "2f94539993d4cb0f7f2b27a14de40f9105fb9244", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952399, "uuid": "fa92c92b-e348-4e33-b253-629155b6af5a", "comment": "Malware payload", "value": "3ae5e087f955ccfc94220ac848d594eb5c535bb5cb6c16ec71e9d0e0897f17556b8263c843cc79467394b19416cf9804", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952399, "uuid": "559a64d4-6f3a-40b6-9535-2783ed488776", "value": "T16795B831B131BA87C3160461265FBE8A530CBD47B2C65F8C905DFBF92CA6CA79306D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952399, "uuid": "18c8e1c7-c498-422d-995f-0700327feb15", "value": "1536:b34QJaKXF34QQPD3iOya7I45AiS9SCHAD4pAs8A4eSoHFJ6oUsbaJu7zc1YiW7Rw:XO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952399, "uuid": "74b11bb3-1ff6-40ea-935c-e5bbe7e211b6", "value": 2055519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952399, "uuid": "e0ec234a-299a-4811-840d-2e75bce6b783", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952399, "uuid": "27cc2aab-af24-4dd8-a07d-e327d3099998", "value": "Inq150222.doc.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea363e3-8e96-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644953783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953783, "uuid": "527c6bda-bde9-4cc3-9997-2690af4d9430", "comment": "Malware payload (AgentTesla)", "value": "4029534a496fc91b8f0f5ef296e3049a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953783, "uuid": "d1631ebb-925b-49c0-8f83-36935fec96d3", "comment": "Malware payload (AgentTesla)", "value": "ecf0e7200d400b9e0d002725941d1e47c3e29bf31fa3a136067adb50d849dacc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953783, "uuid": "ba99eb9c-2281-407d-8b82-037620d9a62a", "comment": "Malware payload (AgentTesla)", "value": "9f2b84dcdd9e8b5453edfda7076d260201b47e23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953783, "uuid": "5c1c5ad1-9cd1-4ffb-ab7c-da2428b064cf", "comment": "Malware payload (AgentTesla)", "value": "0f09a11fb34d7a0ade98698d857cc62ecc23301994b34ade85cb6bdeae56414b15e7802e5d93c30178775c0b4cd849c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953783, "uuid": "daca2902-5595-4a7d-ac21-115c28ebc383", "value": "T1FD15021A776BE731C06517B200EBA13A47B59ECC1873DE7A3C7A32D8180235B1EB55B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953783, "uuid": "00b2097e-0329-47fb-9287-092072835bea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953783, "uuid": "d4d3e43b-7af2-4070-ab38-da46498c7df0", "value": "24576:cuGdM6oCebvq3U99OKmhJRdsn0MOPsgnSYaSVHnEPLGG:zcM6xmSo98jAOxSFSpnEDGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953783, "uuid": "2477be3d-27f5-44e9-bb70-bd4a70af8d5d", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953783, "uuid": "844bac1f-1a33-4dee-b507-f79f5a1bdc40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953783, "uuid": "13b4eee7-cae4-42b1-8ead-6166d6857cab", "value": "4029534a496fc91b8f0f5ef296e3049a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cae084-8e5d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644929333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929333, "uuid": "15f66e22-6dd5-4712-8bf6-d57f600a3c46", "comment": "Malware payload (AgentTesla)", "value": "7d494865be6a5a69e206b935379af1d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929333, "uuid": "4c149e44-1c3f-41d1-90d2-6debd15c610a", "comment": "Malware payload (AgentTesla)", "value": "ed817c297bb2d98e89f3534b4936cc40d5829d7812c6ae0768a774f16685ae08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929333, "uuid": "ce0f8d97-ee38-4248-ade8-35a9b57a5097", "comment": "Malware payload (AgentTesla)", "value": "44011598c5279c746351451f43af333a67479c61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929333, "uuid": "2a7c4e1a-c86c-4416-b9e8-2dee3f7eda5c", "comment": "Malware payload (AgentTesla)", "value": "e161b11fa2132d6358ab3d74a199da13383cf9ef505129e5182b384425d4b35cd08feff4f9c26ff0dc4b1477b428b50a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929333, "uuid": "b76cccd5-0476-4c42-a603-41c6de4d1c19", "value": "T15CF4010073B73B90C47707FA84A5919A1BB9A2AD5136E77DCD9274C94C527C0CA3BA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929333, "uuid": "a55c469a-6cd4-4832-8caf-0d2401ba16cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929333, "uuid": "03634b2c-7889-420b-af27-55cd4551afb7", "value": "12288:F55k+YEUes9eMJqXHPXdt3O6Mj7gKEDszLyGhUAwW7l59B4b3W5rV:nai+bsXP333Mj7gBsLytAwEhvJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644929333, "uuid": "d77c3d45-6af6-42f8-881f-19a0a17f2efe", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644929333, "uuid": "3b8eea94-ba5d-45fd-b3e5-7877ad4a2ba9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929333, "uuid": "f9c0ab6b-b0c0-43b5-b81c-dd694c708efc", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51052152-8e61-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644930916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930916, "uuid": "dcd8ca02-e9c7-468d-b55f-a1ba70842098", "comment": "Malware payload (Formbook)", "value": "bcc32aa0cb21d67d81d9ddbd39c3e2d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930916, "uuid": "55406d58-da8a-4629-b7b7-fa17ae06192a", "comment": "Malware payload (Formbook)", "value": "ed99b5652455f1287171fd7d49a5ac69add7ed72a08712d4c66f6474fd094615", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930916, "uuid": "f1df86f6-4293-480c-9ad7-f8994e689ef4", "comment": "Malware payload (Formbook)", "value": "2f0dfdf0a29ab5c1177c1245bebbdb2ee0513686", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930916, "uuid": "6c1bc1dd-fcd8-46fb-96f6-8d783b95c3aa", "comment": "Malware payload (Formbook)", "value": "d61154049cfa40eca44cdbdc3318b86e46dbcfc00a60a956d3f15c908913696c6a54805f5d4ca514bfadf0f5f06ead53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930916, "uuid": "902b2518-cd71-4f22-a1a0-d5e73f9b87ba", "value": "T185F48C6596F7CCB9DC2704BEA42085882E61EE9FB102FFF99449F83DD8387815686437", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930916, "uuid": "4595b193-733b-40cb-9162-6916e8cf1ff4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930916, "uuid": "b5ab2582-006d-4790-9070-fa2247339368", "value": "12288:WvasV/Mw1ssoniKpPB+rtSnJzefJmEhKS:7s31PMPBaQzQThKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644930916, "uuid": "df61ddb5-2eff-4ed0-bf30-58cc06a63068", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644930916, "uuid": "ccf41c5d-89ca-4f13-bce7-1869800303b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930916, "uuid": "e874c5da-1c9f-40ac-b0e4-1b46b9109934", "value": "Purchase Order FEB22_76543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8babfddd-8e79-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644941322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941322, "uuid": "13a20450-b849-4bac-9a6b-8bde9ecb7066", "comment": "Malware payload (Quakbot)", "value": "4dd9f83b4a268cb97289c4cbc130719b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941322, "uuid": "46acfdbb-24ae-4874-948b-394403db28e3", "comment": "Malware payload (Quakbot)", "value": "ee44ca0c691190a878ec0ab55096eeb9855590d9398c95c837c6add9fac2ee32", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941322, "uuid": "d44b6880-cabe-4d0a-ab43-ab495a7917b6", "comment": "Malware payload (Quakbot)", "value": "bb6961c51a0c41b0f521c98e06712a017a7619f6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644941322, "uuid": "b60f0f09-cab6-430a-adca-d46392e2b3cf", "comment": "Malware payload (Quakbot)", "value": "ef7add4472b5125c1efcd8dc4d6e6d787f64480c39ed6b01f9eddc323839373d83b530ac2fdf37d0b202a7992878b979", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644941322, "uuid": "63449eca-e2e9-4a47-bedf-bceff74abcf4", "value": "T102358D3271C1D5BFC4B236BCAD6A71A988257D521D2CCC0DBBD80F4E0D7A691673229E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644941322, "uuid": "fe83c29a-4862-4cd7-ad6e-10ca5d2539e1", "value": "220ea7972e993d1cdbf761cab8a71a9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644941322, "uuid": "56d78790-04b2-4b47-9831-debfe9d9d2b1", "value": "24576:zuwgYKvPteX5lNEZYyiPKFYY22OlWc971Zkqtu2K0FCFYQ:ezleHPa122S9k2KB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644941322, "uuid": "1f70c052-c500-4ea2-a538-13edaa363336", "value": 1097200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644941322, "uuid": "406ff080-3747-483d-a90b-65ba8bc08045", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644941322, "uuid": "7f6292e2-1c62-43cf-b78b-58bdd5df67d2", "value": "ee44ca0c691190a878ec0ab55096eeb9855590d9398c95c837c6add9fac2ee32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d9899b-8e61-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644930810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930810, "uuid": "ef8642f5-6a37-4e5d-aac3-64570a7bb4b8", "comment": "Malware payload (Quakbot)", "value": "070d9a3ff54f12d073251d39fc04fea7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930810, "uuid": "2ed777f4-0d1b-49ea-84e4-3440c20dfb07", "comment": "Malware payload (Quakbot)", "value": "eea21591ee32015987607e5a47b39f123e5bbf163d2f7b08bf66a3fa99a741a6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930810, "uuid": "986044bd-9794-492a-bcb9-53c439138815", "comment": "Malware payload (Quakbot)", "value": "7ff1bfeabf1ff3887223600b4a605263cbdad316", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644930810, "uuid": "8e1354af-9bbc-4729-84b9-8d95b4695841", "comment": "Malware payload (Quakbot)", "value": "a41467e421c5d352244eb603e5e230a98f9d1410c2fdfa50955646627cf7a8eeb11ab487fcf871504c21f43e95a41c03", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930810, "uuid": "d515676c-e70c-426e-b9d0-7ca81e992eb2", "value": "T19B050A9DA3D01ACEF1DA28BC761823D90F960FF10A7EA073E1132C8516B51F94E66B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930810, "uuid": "799a8872-e85e-4a77-b643-193675359bde", "value": "d8b6fe98d2b0a8d6f73ca1ea92363dc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930810, "uuid": "ce706217-2727-42f4-9a0b-77f05139d9f6", "value": "24576:g74I8i4ZOpi+cQcFRnb9lgo+1TAaKBsXg:5i4ZYi+cQcFRb4o+1TAaKBsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644930810, "uuid": "d7795292-2f39-442a-b661-2868fb6dae51", "value": 820661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644930810, "uuid": "12c9630c-b564-42ea-81c9-637ac22b62f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644930810, "uuid": "c1dca43c-9809-4746-8266-2210bed35acd", "value": "eea21591ee32015987607e5a47b39f123e5bbf163d2f7b08bf66a3fa99a741a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f8cb6b-8e99-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644955087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644955087, "uuid": "6ce5ad48-0bd6-4ace-b80f-b5e4f33cd4fe", "comment": "Malware payload", "value": "1680fdbcf83225475e3437dbfed88039", "object_relation": "md5", "Tag": [ { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644955087, "uuid": "ab0e44ca-2c1b-4830-bb67-81b6fc5d0963", "comment": "Malware payload", "value": "ef130f1941077ffe383fe90e241620dde771cd0dd496dad29d2048d5fc478faf", "object_relation": "sha256", "Tag": [ { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644955087, "uuid": "06b58a28-b173-410e-bd44-61abdcf4ed24", "comment": "Malware payload", "value": "3f617411977fd6a14a91c3fa9d4ff821c012e212", "object_relation": "sha1", "Tag": [ { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644955087, "uuid": "39153c10-c09d-47b0-b7fc-0fe0ca2cd518", "comment": "Malware payload", "value": "a115f3cba2aac48d51c5af1e2c2b034758ecf1aae84d78ceb14b8e81445c9b52cd434bdac8590eaa146d52d1e2d283d4", "object_relation": "sha3-384", "Tag": [ { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644955087, "uuid": "44019ad4-de95-4ecb-aedf-0f9b7dac6bda", "value": "T146265B06BCC244A2C1BEE231899253A17771BC6543217BD71F94FAB92E76BE42E3D305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644955087, "uuid": "ef4c9ff3-24ad-40fc-84ff-228771e6b0b4", "value": "98304:kB4UjH15s+hUs5Fn+fMJ7L/4GyS3hgiqvEsvZ:kB4U7w+es5EfMriiqvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644955087, "uuid": "3b501bd6-2145-43b8-823f-3d97b257960e", "value": 4592592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644955087, "uuid": "0a4602d7-5ded-4f60-9365-a7fe0a533e76", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644955087, "uuid": "63f2bb69-a9b1-4a61-9883-859d778ed394", "value": "exploit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e187559-8df6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644885089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644885089, "uuid": "7113fc93-0214-4f3d-aaf3-77f129ab78b9", "comment": "Malware payload (RedLineStealer)", "value": "a40fc394d31d88ee4c8ddfccb9700693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644885089, "uuid": "66e1fee4-c7f0-4e91-ab3d-0ae7fff87b45", "comment": "Malware payload (RedLineStealer)", "value": "f171414a07b968fde0474e2f9d7898221c62fb63ce5ec555efa6391e5ab3e840", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644885089, "uuid": "ca001991-3efb-4ae8-b8a6-d50411fb91cd", "comment": "Malware payload (RedLineStealer)", "value": "8e54e1a51563fe367e1c0ee7907c26e2c4ba6226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644885089, "uuid": "f14b40a7-eeef-464e-8518-fb5d42b96b4b", "comment": "Malware payload (RedLineStealer)", "value": "7012d2c0252a37fcf8dfff295db744cae4fdb107678baac872bbfcc002e8c47be3919aeef864415c180f29d2b75b4d5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644885089, "uuid": "5df107d3-d447-4f14-b499-92d0ff9e4b6a", "value": "T148547CA037C89925E2BE4FB05875D6B803B1BD462822D74B6DD67CEB3F733815D026A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644885089, "uuid": "d1fb7adf-dd7c-453c-b5b5-b3067ceceddb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644885089, "uuid": "dc401211-61c7-4984-98be-eae7a74ffc76", "value": "3072:VGUUJZbC6YR0+DOzfyrSlsT0JL6Xhibv4D+nxUxzqldT01fj:VGUMMWsT0J2XDK6xeldT01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644885089, "uuid": "338d4007-4246-4bbe-88ff-b6c2a2fea34a", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644885089, "uuid": "1df96f9c-4093-4f5b-b4fb-7c26890b7004", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644885089, "uuid": "fe5730a8-49c4-4a2b-8e4f-5105f409fe38", "value": "a40fc394d31d88ee4c8ddfccb9700693.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f20ac10-8e82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644945113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945113, "uuid": "4c6e3777-3ecc-4c6e-a4d7-b5c37328b961", "comment": "Malware payload", "value": "6a2a3e8d4be4ed6c0c8597d2e1893b36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945113, "uuid": "450cf060-9db2-40af-8b68-6728af3eec78", "comment": "Malware payload", "value": "f196a84a2e92c771c49bc02886d6bdc377d09996c19fc4e21f11f1e57d29ee7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945113, "uuid": "f1630840-83de-47ef-81de-8c3a9775a790", "comment": "Malware payload", "value": "1052a7040fee2557dbb4b209b19aaa246d2179e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945113, "uuid": "fb341639-c7fb-44e9-8ece-682a0af10d57", "comment": "Malware payload", "value": "3610eb348f373a7bcbabdc0c6d8fd6dcd8b31de1ca7824fc09793fb8ce610cdee15a2030f2f498f5a0fd323a8fddf4fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945113, "uuid": "ebbd1068-803f-486e-9411-e25d41747aef", "value": "T185E55B55F8809F66C6D06AB9FB9D828D73234BB9C3DF7107D914463037EAD960E3A242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945113, "uuid": "f3906eff-9153-4f79-a4b8-d42a25724bb1", "value": "49152:rscGEcVy8Tzjb0z58lR+4yOEWRiPEgBMDgTrhN:rscdcPjb0z5sR+4ymgBMDerhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644945113, "uuid": "f1d88de6-fb81-495e-b220-588ba52bd836", "value": 3117508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644945113, "uuid": "c24ab228-a712-4da3-b48e-b521ec4fc187", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945113, "uuid": "e57b9715-786e-4364-becc-144b458fd81c", "value": "tsmv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df4d444-8df2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644883344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883344, "uuid": "b25afec1-e7d2-48f3-a5c0-b64967dabf49", "comment": "Malware payload", "value": "79a895e85a90b5c2c3b1fdd924fbbc6b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883344, "uuid": "6a11780c-4b9d-4e2e-8f29-167ea101b0b9", "comment": "Malware payload", "value": "f26f3bd7e4577adb51061a3a558ab34af67a25353bf34506fe3aed17769526ad", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883344, "uuid": "1d49bb02-209e-4581-bd93-b1bd3942d5c1", "comment": "Malware payload", "value": "090b7868bddf17484e621d5ddefe17356204a51f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644883344, "uuid": "dd472d63-0b24-4bfb-b54e-bc3a7f7545ed", "comment": "Malware payload", "value": "3c89446211e946d936f0ede3643bd55f7fd231040bd9a258786d90388605ceb211561bb18c1feb95e7ad36510d5f9c44", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883344, "uuid": "30b448d4-312c-47c6-bb7c-bdda2c8e55fb", "value": "T104B1F768F6C887E004EDF169797FC85DB398A2C2206F1D9CD9EB2CBFD405588E6059C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883344, "uuid": "566d6899-8e6c-40d8-bb1d-d12b11936ec6", "value": "48:ja/byUKDQPWaCSNhKbUfTKhqIDgwD9q9z:ja/byUKDQ+aCSNhXL98gwD9q9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644883344, "uuid": "fdf617cf-a15e-40d3-a79a-2241bad16eba", "value": 5437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644883344, "uuid": "5ac419f5-39d9-4a5f-9cc0-21513c29c519", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644883344, "uuid": "cbe9f2e1-0d07-4779-a8d0-17082846b25d", "value": "f26f3bd7e4577adb51061a3a558ab34af67a25353bf34506fe3aed17769526ad.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b7d239-8e37-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644913074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644913074, "uuid": "973de924-6c62-40ef-97df-c37a4fe6c3db", "comment": "Malware payload (Formbook)", "value": "6e1fbcc9b8a012c6564b94a8b4c242fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644913074, "uuid": "753262ed-e866-4d17-bf4a-437c5cba27c8", "comment": "Malware payload (Formbook)", "value": "f37548aa52109fbdf38ab248aadb6809eb3a677a15f6916883d9612cec4ffa86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644913074, "uuid": "5565a0d8-ec87-41c1-8284-5d6376834f40", "comment": "Malware payload (Formbook)", "value": "d49e48696b22d76eb2071be8d1e27d0471c8b76c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644913074, "uuid": "bc939144-7274-454f-97b8-026a4c79db48", "comment": "Malware payload (Formbook)", "value": "6118fa3cf0b5c5374e26920c41f8648fb620511b4c9f0ca3bb1824a731c95445e429b56b00eaf00c30f4f2df5d6db9ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644913074, "uuid": "c0a4031a-0be5-4dc2-85cc-587e54d8ebbc", "value": "T1D254125E7DD49BF7CA1503315DB3CF2793B6B70802630B9BA3904E4FAD6A1A29125582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644913074, "uuid": "c3c8ec8d-159d-48ef-b5de-ce0d41e7a3f7", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644913074, "uuid": "54a7237a-5e61-4388-9453-0437c70d716d", "value": "6144:owvRVTvYIyB4lrGiXarrRzbFguquTzXox2rf4It3dPHVfljJ8:V4WqV+tu/ox2rfRt3dP1f1J8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644913074, "uuid": "cd2fc799-b15b-4e7e-b6f1-a6f1cf00f5be", "value": 301203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644913074, "uuid": "703df081-fcfe-4fb1-907d-f4728d04a7df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644913074, "uuid": "d256e878-997e-4929-b409-217c99dd0093", "value": "bunker inquiry_02022015.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc07e76-8e5d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644929323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929323, "uuid": "644ab943-9ba6-4c11-8c3d-4115d7493fec", "comment": "Malware payload (AgentTesla)", "value": "2997ea9b25150b59e39fd7a800364f9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929323, "uuid": "1ef5bc1a-8b23-43e6-aae6-389d0312f0cc", "comment": "Malware payload (AgentTesla)", "value": "f3c1fcd51e7c19668dd1d407d55e600cfe09ded3cac37b2906be6a8f6ca729b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929323, "uuid": "3bb7825d-0c69-4f5b-a561-0114dc5f1066", "comment": "Malware payload (AgentTesla)", "value": "2fb6f553e5bcd69d5162e541d5c5ccce9bd39ff1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929323, "uuid": "3730034f-fceb-4339-a148-db70a4787d8c", "comment": "Malware payload (AgentTesla)", "value": "dace006d243bb4cec5453918f9a15efc2cdc2276e714ba7ceaa5ac40d007a65fcecbeb66a0313d7f9f148ec720abc638", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929323, "uuid": "2b1ce045-ca59-470d-8fa2-41a0036c0c03", "value": "T105E433AEB2BF1FB45E9B90A1D127D27E657C91F0E0F893E20464FF124648384D727889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929323, "uuid": "0c664500-cc19-4641-a08b-559117ca1bcd", "value": "12288:PZ0WrWCKEUW29eMPYDHZXvt38OOj7ACE7szJyIh6QsArl5lBUbv85NVH:x0eMbQbZV3fOj7AtsJy9Qs89ZnVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644929323, "uuid": "226d79c1-e080-4898-81fe-a5c9d436def5", "value": 709795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644929323, "uuid": "a970de44-c1bb-401b-8c2c-47e676aeb936", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929323, "uuid": "bcbd128e-613f-4415-9d9d-e590da9a3c2d", "value": "Swift copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0354db1-8e82-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644945356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945356, "uuid": "f1121b4c-f9f1-46f7-a884-2dc33109603c", "comment": "Malware payload (RedLineStealer)", "value": "19533b7955e73932189ec0e80e465a58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945356, "uuid": "aa82cd78-bb76-4570-8ada-307ce1267a90", "comment": "Malware payload (RedLineStealer)", "value": "f4036a8affaa6f227d3fce3a98b5b9bb752cd434f04587ea4105c58fc96404e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945356, "uuid": "2752a9d2-2c17-4284-a46e-3a2dd816b12c", "comment": "Malware payload (RedLineStealer)", "value": "088347c8a95c35c42f167f01e958fba74ab08f78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945356, "uuid": "76829e36-0ea0-4806-a400-ba8a58bcc9a2", "comment": "Malware payload (RedLineStealer)", "value": "8e582927271cdeb96beae05da5c8106ad527513301818fd5f9c2cc23495735bfa1317a54322f38545013809799de825f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945356, "uuid": "5cd3e402-9e78-40c9-8beb-6f55cb38852e", "value": "T17B3633C8C64C3A6DE6B669BC4B89E52D17DCC7F7E6DF9300C66C158FC6A4342E06124A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945356, "uuid": "535e76f7-5ee2-4586-b39a-177d803169d2", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945356, "uuid": "f8fd889b-73c2-4a15-b821-534a00fdfdbb", "value": "98304:dA8M2RpQwt8FFwwJoxDVeHsZTbx73LM7e4us9h2ZHuo2iQZMlJMN9zP:5Ms+Fi5JVeHsZTbJ3gusixuoU6aNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644945356, "uuid": "1b8fc65e-2a26-4d20-bd50-d3aef02bd2b7", "value": 4874752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644945356, "uuid": "e6448b21-39d9-41fc-a886-771aa710af87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945356, "uuid": "1caeb32f-521f-45f8-a047-fc8a8e29221f", "value": "19533b7955e73932189ec0e80e465a58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb3f776-8e93-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1644952441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952441, "uuid": "d0914f22-003b-46b8-9e73-58faed3c692c", "comment": "Malware payload (RemcosRAT)", "value": "eac3106e5d277c876f66b4966f55252c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952441, "uuid": "5468b0b8-7b26-4e32-9121-d994e68a258a", "comment": "Malware payload (RemcosRAT)", "value": "f40b0b7ba6036c4d53d9572c1aa00d4014ba40a66eb16abab0d75f48ab8057bd", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952441, "uuid": "89b816b7-e898-4a8d-bd35-f75e72c46565", "comment": "Malware payload (RemcosRAT)", "value": "a1e51a5397f866fab00181ec87a69ba06d667aa5", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644952441, "uuid": "0088fed5-71fc-4f65-8d30-738558f3e181", "comment": "Malware payload (RemcosRAT)", "value": "11866b229be0c2cb9ba3e54db43b1b3f1f4f5b8ec64eb4d1bb88656661359cc2218aa28ae0bd833b42c0f00463604080", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952441, "uuid": "2bb53459-508c-41c6-a9c2-21e2c4bb7ef5", "value": "T16FF272A2B7D2D90ACA95077A4CE7C7D66726FC616F53834B3285F70E1F71A808903617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952441, "uuid": "4d9ba6f1-2fa4-49bd-bb9d-b87afde8e2fb", "value": "768:BNmk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJuhEyLQNs+Zb2US+/6O:2k3hOdsylKlgxopeiBNhZFGzE+cL2kdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644952441, "uuid": "fca2af1c-11b9-4ab1-9106-9db7c068182b", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644952441, "uuid": "913d9553-9d95-4c04-bbf1-e65dff1e234b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644952441, "uuid": "63fc4f2b-8026-4b96-bfa1-e43f169f9a05", "value": "ACH Payment advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f452d0-8e40-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644916962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916962, "uuid": "81756640-ba64-4063-aa88-30e1da79c2d7", "comment": "Malware payload (AgentTesla)", "value": "06f9eedd7f65e8c8d0fa96464cf57495", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916962, "uuid": "6c9bfc2f-57a2-42d0-87e8-f68412b2ac97", "comment": "Malware payload (AgentTesla)", "value": "f504b68ce3a0682f855509afeed998dc04f9f53dc82d45189dfa7b8af406b1a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916962, "uuid": "2e307241-8741-490b-b5f1-678360b2b20e", "comment": "Malware payload (AgentTesla)", "value": "fa66aa38e95cae0310b8473b3b7e317d7e9ec1fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644916962, "uuid": "a1a5fc94-93ee-4df1-aa7c-06d9a6540789", "comment": "Malware payload (AgentTesla)", "value": "158344c1fc4c16c96aeb4ffb717d5c0d2568b0447f9aac22968004bfe23380a2ad29e8dc2f2c8ec409a899c5678eec09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916962, "uuid": "d75d867d-bea0-4ce7-9206-1af173de598f", "value": "T19F05010076B33A80C0770BFA58B495911BF6755E5627DA3DCC9374CC6D22BC09A7AA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916962, "uuid": "cf2d8e2e-b043-4a68-bf03-41152cc7cee2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916962, "uuid": "86972d73-e32b-4937-8079-6da400482cfb", "value": "12288:ut5k+kyfQqfGdOShC2/8K3UpQB+qAiYeWHiZBtPNpPDr+c6EaZ2tZj64aoGyh:oa1yfNfcFCgexqAOWCZBtPbac5ZGpoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644916962, "uuid": "fcbfb5f6-0751-4cb1-b74c-6c3012210658", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644916962, "uuid": "ad10da74-6842-4e2a-9f30-9d251181fb19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644916962, "uuid": "32d13d35-8418-4779-b5bf-2ecdc4364267", "value": "INQUIRY DATA SHEET #2022353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b81a3fc-8e5b-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1644928276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928276, "uuid": "d8038c74-29cd-41aa-bc7b-910011a3d62d", "comment": "Malware payload (CoinMiner)", "value": "1ab81b2cb16504fc5354e17462ddfe85", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928276, "uuid": "766c8d39-2c44-460e-af83-d973c5f9ac23", "comment": "Malware payload (CoinMiner)", "value": "f590358a98eb71fdb747c8c567eb81d17d4208a65445815b7a9f519447ed5308", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928276, "uuid": "a42ae3e8-e3b4-450b-abe0-31d8e010b789", "comment": "Malware payload (CoinMiner)", "value": "15ab001db258ae0f77b3dfa97b7abd82e95e50fe", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644928276, "uuid": "9d8a55f1-ab3b-4bc5-82a1-5290ae716fae", "comment": "Malware payload (CoinMiner)", "value": "5ccc3a2611e2df15797b0284563e8e85d95a0f829bbeb188b98cc066c5dfedfd0be54c41a6562853dd9361eaefb06de5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644928276, "uuid": "d602989b-01ab-4d26-a0af-08856b5fdfb1", "value": "T186C3BE4C6290E811DC19CDB1B809C6F06A6D9D1E1E8142BE2BBB7E3E3A63713971D177", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644928276, "uuid": "6e35a2b9-74f6-4c40-9204-0b9efa806240", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644928276, "uuid": "19318716-7421-4587-816b-a16efc3c62db", "value": "768:ciydHmhFg+tnTtHJ90MmdNf9iZLQJYcV63izhth55Yif4V:2Ghi+HrkgZLQj63izR7f4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644928276, "uuid": "f6d00f36-2471-4e52-9684-2486f75a2dc6", "value": 128424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644928276, "uuid": "725fff90-1e2b-46ef-9a78-a4fe8676160c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644928276, "uuid": "f16bf977-c5ef-4c1a-9e88-6639bfee2ea9", "value": "Jaravoi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b19d7a2-8e83-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644945536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945536, "uuid": "b8dfbfe6-9a2a-42c7-9f8b-d07fcf8143f5", "comment": "Malware payload (Quakbot)", "value": "e62a1fb895ad2be48c1221a561b249f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945536, "uuid": "9a500d0a-01de-4c3a-a500-a620b01a740c", "comment": "Malware payload (Quakbot)", "value": "f7664b0c71230005f8e2390a1bd128b6bae71e4c697d80ddcfe8fa34de8d62a6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945536, "uuid": "1010eecf-1377-4bbf-aa3a-1afced1bf129", "comment": "Malware payload (Quakbot)", "value": "dd99613355ad02eb3ceb7d79129068b272264d22", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945536, "uuid": "f7898092-5ca4-4cae-9272-3c148cca58c5", "comment": "Malware payload (Quakbot)", "value": "0b43f9e7ab46f2b7aa9b320ce710b0220d92c47282d6f6e08dc6ae91e85a6b89414fe3d0b9640d6a92f748fd84c1321e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HOUSE 9A s.r.o", "colour": "#5D1322", "exportable": true, "hide_tag": false }, { "name": "obama155", "colour": "#86BC64", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945536, "uuid": "ccd60d0e-5631-4885-9b43-e4ae5ee303e0", "value": "T1CA358D3271C1D5BFC4B236BCAD6A71A988257D521D2CCC0DBBD80F4E0D7A691673229E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945536, "uuid": "028051fb-04f3-49a2-8d2d-1fb808a28beb", "value": "220ea7972e993d1cdbf761cab8a71a9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945536, "uuid": "ddfe02a5-9d28-4df7-9f3a-e2a5dd13f926", "value": "24576:4uwgYKvPteX5lNEZYyvPKFYY22OlWc971Zkqtu2K0FCFq6:vzleOPa122S9k2Kx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644945536, "uuid": "88bdc0c9-8d9e-4de1-8b8d-d9b16945378e", "value": 1097200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644945536, "uuid": "bd42a354-6e26-4f3b-a126-67f7f83fe7b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945536, "uuid": "0533113e-8ee7-4a93-836a-dcdc6564e35d", "value": "822330420929752.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471f06fe-8ebb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644969554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969554, "uuid": "aa5fb791-fcf6-43e3-a885-50ef6605181c", "comment": "Malware payload", "value": "2982ff0fef24030a073aaa20c7e91ae1", "object_relation": "md5", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969554, "uuid": "bb5aa4f6-0945-452a-81ae-59e1d8fcb20a", "comment": "Malware payload", "value": "f76c4cbfd0f66af33781adf386474e1d00a76d98d822a41fb6092d27c5726cb6", "object_relation": "sha256", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969554, "uuid": "82c2296d-0a9e-4794-9425-1305d2b1f5bd", "comment": "Malware payload", "value": "5b7136632414ea4e605fd353518367eb855f476e", "object_relation": "sha1", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644969554, "uuid": "9bb8fe86-c00c-494a-a363-b06a2e398203", "comment": "Malware payload", "value": "aa576b95863934de7366991075f24c0490f6a536f634bf9baf79e6d40860a0a63daacb57622de23d4ca1398fe352ccdd", "object_relation": "sha3-384", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969554, "uuid": "f9e65f1e-38df-4a55-a7f3-1995d244c689", "value": "T13F4523E2AE450EC6D34BC3F090F7C7A1E5A21EC177044D6B57E1B9A319BC8EA9D9801D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969554, "uuid": "f8ec67cc-3b8f-4a7f-9028-b88bc574a7bd", "value": "05b52ed39c6c35deb93da7d639404837", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969554, "uuid": "bbae1042-373b-4ea8-a1a8-b57f7f1660c1", "value": "12288:gr0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:gIgXe4i7ojhsP5Lgrk1TWb4AN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644969554, "uuid": "58908172-fa3b-4a1c-8285-2decc4ef0037", "value": 1255424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644969554, "uuid": "d1f63dba-a2a0-4684-a09d-4fc173f0ef87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644969554, "uuid": "2848df8c-313e-433a-afe8-23b5207231d8", "value": "f76c4cbfd0f66af33781adf386474e1d00a76d98d822a41fb6092d27c5726cb6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3dab9c-8e6b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644935364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935364, "uuid": "47976d62-4aa1-49c6-93eb-6a640d4ffd9c", "comment": "Malware payload (AgentTesla)", "value": "a80f85339afe0dd931e135fbe4958690", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935364, "uuid": "bd2ef6af-1304-44a0-ae99-918b16c1fe30", "comment": "Malware payload (AgentTesla)", "value": "f779ac7255de70de168e1e493c82eba2dd5b459826d2840591b09b32593f1dca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935364, "uuid": "fd0dff09-86dc-44ca-a77c-866643d40087", "comment": "Malware payload (AgentTesla)", "value": "6ae1c2190a5f98aee0d5b53ae1d8b86efd994fde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644935364, "uuid": "056fc65e-4762-43a7-9e58-77a089d0d0cb", "comment": "Malware payload (AgentTesla)", "value": "9cd1878213b043455d8d6ef228a73dd8e31c9012efb297e449171501c5f7f07f0aba5807d6346452c69dea6536911602", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935364, "uuid": "4996f78a-1a2c-4edd-8af2-388bf8e2e23a", "value": "T1BD0501043AF77B81C4760BFA88A585851FB56A4D4127E77DCD9334CC1C62BC09A7AA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935364, "uuid": "491bf49c-5345-4c9e-836c-83ec84ac5e22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935364, "uuid": "647ebc8c-069b-4ba9-b81a-e21be99d60ac", "value": "12288:tP5k+nkt3OKzWtJau9M5jddNO+16B0/E9hutFKaBk8UVVzdFJMXivj4MXL3:talQK8Au2bOZutFF/UdEir4MX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644935364, "uuid": "1909b4fb-0558-4112-a810-e94f99dcc699", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644935364, "uuid": "f0e12237-88c5-4e54-b52e-51eea28f0716", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644935364, "uuid": "d3516227-c49e-4895-9196-2ce2d753bd83", "value": "paymentcopy343112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2f551f-8e94-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644953052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953052, "uuid": "8abbca43-835f-48c1-8b40-de281cc849a8", "comment": "Malware payload (Formbook)", "value": "2d8d45aefb85adae213972d7a707046d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953052, "uuid": "062d521b-4dfc-4634-940d-53ad1c693ba0", "comment": "Malware payload (Formbook)", "value": "f84d320e99744ded94e8c90a80a9583b969a33c24428904094354979e73e1885", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953052, "uuid": "a43331e3-1798-4135-8cc1-d767af0e9d83", "comment": "Malware payload (Formbook)", "value": "8130505f31297c9710fc073dee4e4c97ebb14a8d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644953052, "uuid": "5fb7bac4-bf2e-4b94-a69d-210055977873", "comment": "Malware payload (Formbook)", "value": "c304824e1ef9762a6212e236206c1152007a03e76cce39b4e1ef1583122eac6d9f00c6f585f50cfe0e58349670ce9113", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953052, "uuid": "9c933151-5d54-4543-b425-1436dffd93e6", "value": "T164140215BF2E99D0F7928AB4BA6BA7843E559C3249CA8BF52D24330D31B64444F3077E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953052, "uuid": "ea53d780-7ff6-4185-9f45-33c06636ed6a", "value": "3072:QK75VkzhHO6o9d+KdfoaBNoRDkaFEk91OsSgzJxeMsP+JgksiX8uIK9n:UVH0poaHQgoEk94sSgzJxueDBX86n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644953052, "uuid": "2b480a7b-f9a3-440f-a159-8dc7f9bc1737", "value": 191736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644953052, "uuid": "6cac7f56-791d-4da4-996d-6cfd7ee8b073", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644953052, "uuid": "3cf71f49-f702-4b13-b506-6dbf60900a7e", "value": "Payment Advice - Advice RefBIBB20807962.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8905744-8df4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644884274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884274, "uuid": "86ea60f8-11c0-4382-8b78-c5baf0127c05", "comment": "Malware payload (Mirai)", "value": "6e8a6db785de892ed0bec4c089e5f204", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884274, "uuid": "ede5eaba-d274-4bb7-86c0-f541dadd604d", "comment": "Malware payload (Mirai)", "value": "f89bb5668bb6b8c46e837e8219e07303b94305bae6faa298ea21feea2b02cd3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884274, "uuid": "bbd5a2c4-a43c-4cda-9c39-7ecbbbafdaba", "comment": "Malware payload (Mirai)", "value": "b7f6db6879943f17dbde150dfc1ed1b541fc1172", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644884274, "uuid": "4d505a61-1e81-487e-8a9b-5a22ea747e3c", "comment": "Malware payload (Mirai)", "value": "5668597a125cc577c2738de4b69ad588f2c1269a6a16a3b4753b67030500e7a2f22d2d936d40f7d6d1f038ac0f30e565", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884274, "uuid": "7418ae76-5838-4ae8-8a05-94498919890d", "value": "T119B33B46EB418B13C4E5177ABADF42453323E75493DB330689186FB43F86B6E0E67A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884274, "uuid": "4af21360-49ff-4528-821e-3373f617c41f", "value": "1536:YlnZx2ZVoeMRe1nsxqgFTYW2m85llQDib1y22T/aG62wLzEzw/90l7LY3zCy0J+d:UaVrYecqgFTYW2Ue1y28h6tLAM/90qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644884274, "uuid": "eaaaa186-2758-48d6-ae0c-415534019302", "value": 108079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644884274, "uuid": "69a4391d-0b9b-4dad-ba5d-8dacfbdc50d6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644884274, "uuid": "a8f40c55-4a93-471a-8810-cf10d5f22ab2", "value": "mizakotropistam7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3377a7-8e82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644945133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945133, "uuid": "ced1e272-37db-426f-9c3f-4c7188e84f9d", "comment": "Malware payload", "value": "1b5ff7b2e2c2d7751ba6a38b4aa3f69e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945133, "uuid": "5bdcca0b-bcad-4d42-89c0-446c76685d22", "comment": "Malware payload", "value": "f95c1c076b2d78834cc62edd2f4c4f2f6bfa21d07d07853274805859e20261ba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945133, "uuid": "95aeb52e-8798-4700-b10c-7d8e9cef5205", "comment": "Malware payload", "value": "914611b5a42d0db65ac9867cac18efde840ffcaf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644945133, "uuid": "a65811b1-8361-41d2-b65e-71a5a280ab9e", "comment": "Malware payload", "value": "447c10d131ce047502a9fd9536a08866781d50bc5540a14783e08092e038d04a8e6c029cfec4dfd51f37d703ab9432d9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945133, "uuid": "33d8bf3a-cedf-402f-9db6-c6b2aa705dd7", "value": "T13AF052A8E0E14F67380A63A8B14ED094498ED87E8AFF3C08912CAAE1102E50AB03025D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945133, "uuid": "92687251-d325-49cc-8332-6d20e3b48a28", "value": "12:jfM2pnSImWRYOS6yEucC8BqEGXFkKY7WR8GCMn:jfM2dSIhk4BuXF0SqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644945133, "uuid": "d115f4c2-1a55-46a5-8743-1a58e5318e8e", "value": 487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644945133, "uuid": "08cfabae-c5e8-44e8-ad88-71c10964e1c8", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644945133, "uuid": "8ba1a24f-f2b6-4098-a2c3-dcf44ba5b87a", "value": "watchdog", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cecbbdb-8e5e-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644929647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929647, "uuid": "880a4d60-c78d-4876-b615-4225c3c86af2", "comment": "Malware payload (Formbook)", "value": "6f2d6a22de3e3148d4835c96d2445089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929647, "uuid": "de095b86-02f0-4cde-a06b-6499e64cdf2c", "comment": "Malware payload (Formbook)", "value": "f9a27387b9b3b02475f1223f3061ff567327432a9a9dc83f91c665fd604ae87c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929647, "uuid": "73ccd57c-cbdd-4ba0-a904-2ce99f54b8b4", "comment": "Malware payload (Formbook)", "value": "7039935229c243df96860308dd131566f80e0361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644929647, "uuid": "58c2b65c-a39c-4300-9f88-f04af45009bf", "comment": "Malware payload (Formbook)", "value": "25b34b9b0163e934cef4a93e0e77b69c3a9fdb11303e030061c8cfe167d0521ab5030b45a47118e4e3d56b7cf2acfb74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929647, "uuid": "28c8cdf1-5944-4813-afd1-c2f0b10efc46", "value": "T1F0F4020076F73B80D4770BFE94A191911BB4A15E0523EA7ECDA364CD5C52BD48A3BA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929647, "uuid": "8fbcfc0b-a437-4c82-8c91-85ae2e77460c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929647, "uuid": "c3654e33-0158-45d0-92b4-e6e88203e609", "value": "12288:OC5k+2U6x6K0HC2vFsqSWSyaXn6dVNz1K42jy3Btaj2tLp2EdHNDy1pBbL:3aLU6KCEzS65hBUm2iGvBbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644929647, "uuid": "39bbbe84-a87a-44a8-8ade-13fcccc6d00d", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644929647, "uuid": "40679772-333f-45a2-a4eb-0efcd3f8af08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644929647, "uuid": "6021e72e-7825-41ee-b596-79a8b9afe393", "value": "itens que precis\u00e1vamos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac31f84-8e77-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644940354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940354, "uuid": "c35757e0-067e-4023-a541-53862346f91b", "comment": "Malware payload (AgentTesla)", "value": "1c80b7043af325a490cc893e946cbb36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940354, "uuid": "c21ec796-69c6-4e09-8102-95e576ebed1e", "comment": "Malware payload (AgentTesla)", "value": "facc9cff71f58c871d6506623d05e29604557826c1fc7486f1a61b1884af5b33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940354, "uuid": "230656d6-8ec4-44f7-96bd-f3d2cfa0f95a", "comment": "Malware payload (AgentTesla)", "value": "a0b6ebc3a76611774668514b65867a2ab6e91054", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644940354, "uuid": "654f2112-c53d-4ed4-9e6d-7f8109b962c0", "comment": "Malware payload (AgentTesla)", "value": "7ffddbaa6915824dbba442f92ce1953b3db1581032999c18cdaad2093280d98fddae350e8ef331a588d501ec74ae0081", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940354, "uuid": "196798b0-a559-47a4-aeb1-281005ea5fb2", "value": "T169F40201B3B37795D0721BFA58A096450BF5A66E5537D23ECA9330CC0C62BD58A3EA37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940354, "uuid": "1a73803e-0552-4f94-b276-f00379f077d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940354, "uuid": "19e11d06-4df7-442d-97da-d77a5c0194d7", "value": "12288:4S5k+YyRVEPQKK7GLx/Lh6FyyQZgitm4ELFEjUURMpS+3rMN+/zKfaHF:ZafZPQKKOx/Lh6TYgi0PLWjzahbME/+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644940354, "uuid": "3574ce9b-de63-45b6-84aa-5a8d30789586", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644940354, "uuid": "6cfbfd17-4fd4-40a3-ab2e-4c1e7b4bf3fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644940354, "uuid": "ccea52eb-2978-4be9-89da-213499e3ee4d", "value": "VfB5XsNBBUSkcDC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53283ca6-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932208, "uuid": "405ec179-d647-4678-bf23-8e5b14677a3e", "comment": "Malware payload", "value": "9c0b333ff99231001e99e083e530a2be", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932208, "uuid": "98387c58-6f98-4d9c-be16-9663346a2823", "comment": "Malware payload", "value": "fad74e0e288057f8c38f8480c293ff00bc6423ff9bc4f3b2596189b665b4ef1d", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932208, "uuid": "937caaf7-196c-4114-adc1-672bc066f223", "comment": "Malware payload", "value": "27a0187f2ab00342517b238f0f78806d2ed616b8", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932208, "uuid": "cdb04c23-fac0-44e0-a897-556b1df428f5", "comment": "Malware payload", "value": "68a872063c096415bf81d66a620a6cf05da86a37b7e11346b3a73e30b698d3cc04333c4cafea83793ba7207a4b715cda", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932208, "uuid": "0984bc33-a417-44b4-b5ca-3c66d7aaac87", "value": "T19E7249B20703DFCA8B2B0CC5E85D0316ECA879D7319D9899BB4994B649E0630DDB8DF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932208, "uuid": "df291388-d3ac-44a9-aec1-b6ae6529fc7d", "value": "192:Bm1EKuiGWXP5+puuBFd00Ya9DaEd+ZOcyAx8OycXeouVXcFavDgsYXo4:BeEFWfUnQ0YuDd+nyAlXeouVnEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932208, "uuid": "2260ecf1-f676-4239-bdfe-782be98b6cb1", "value": 17068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932208, "uuid": "ed40db60-47ca-4727-b37a-8940fc7c1fcd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932208, "uuid": "8756ea62-af5b-490c-a037-fb9ceb69a627", "value": "testeok.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928da252-8ea2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644958943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958943, "uuid": "88d41f5b-6b94-49b2-8a65-da685dd10c93", "comment": "Malware payload", "value": "0dec610847d304227d7d01a682d5d62f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958943, "uuid": "d2a0921e-651e-460f-96b7-51f5d0eec954", "comment": "Malware payload", "value": "fc9c8bcf82eadf7502d6c8646712ce55c2bf805e2e2cf60bc30596082f402f4e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958943, "uuid": "1521bd05-eaa9-45a4-9898-dee48473b561", "comment": "Malware payload", "value": "6362f43cb1e29c36f626703a5aab47436c28badc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644958943, "uuid": "0e07830b-6ca3-42ed-974b-d5ae69415bba", "comment": "Malware payload", "value": "f59991dca866b0916cfce7c184ed973813a330646da2c87220249c081aee0c6dd18abef7403e7a9bc74dbdb51e0554e1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958943, "uuid": "880c88ad-05ed-4b3d-a6a9-a74c47303d20", "value": "T12D03E70AEF914EABCC6FCD3306AD075135CC958722B53B2A3534D52CF55A54B8AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958943, "uuid": "a8f107de-8796-4f78-93c0-63395c2c1109", "value": "768:aDP5/JmxecSHxWHwQ4k25SL5YfZPbEJIXiZRlxeayxmxghqxen8AICNxYIDz:as+uQZPbOYox08gY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644958943, "uuid": "051974f6-7c36-42cd-a181-f4e8b4fe23ad", "value": 39420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644958943, "uuid": "e42b35a1-4f56-4758-a854-3effca1adaeb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644958943, "uuid": "54717de5-f96b-4e58-97ed-030ae8386d29", "value": "beamer.mpsl-20220215-2102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c54a5e-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932128, "uuid": "86d8f27e-7e7e-4be4-8b58-030561cfe853", "comment": "Malware payload", "value": "3628b4e84c28827f3f5a7a5d1bfc722d", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932128, "uuid": "e71bac6b-09df-440c-a93a-c8ff69fcacc9", "comment": "Malware payload", "value": "fce2ba3cbe400eede0059523c237fbe62dc2dc71a9cdd59d8ce79b9deb4b5e03", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932128, "uuid": "454355f9-db9e-4955-8df9-82866d0e6532", "comment": "Malware payload", "value": "04655a8eb28250b18ae09bde1f70db7044240609", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932128, "uuid": "c11117d8-fc26-4177-a961-2f768a5f0c5e", "comment": "Malware payload", "value": "d4cc09a3993619b0791e58186992acd6f17224f1c040917f7b6138eb536cb74ca1bc93aacdf167ea637ebe45645913e8", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932128, "uuid": "4633422e-cdb9-4016-8fab-ddbc89ee7dbf", "value": "T1961319B30213BDCF16260E52E50C3115EC58ECB7719999ACFE8888F58BE5114DDA8EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932128, "uuid": "43614dbc-0fe1-4951-97e0-993bca64b35a", "value": "768:hXRghkKYNfc++m8YUetumnx62kfgnt/XpXc3I:hS23f9+m8YUet1x9kfgt/XK3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932128, "uuid": "161c47fd-7047-4338-939b-d0b04e33fea5", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932128, "uuid": "f67ccd3c-ae31-476d-b95d-87905a05b892", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932128, "uuid": "7d6b4156-7404-45a5-bb6a-f815398d1625", "value": "nyno.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a583950-8e64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644932166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932166, "uuid": "bb9772d0-c25f-49fb-8bce-84c2b201de32", "comment": "Malware payload", "value": "63f4a699d3b5d663d0c672be61315f53", "object_relation": "md5", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932166, "uuid": "87b05929-b723-4660-9cb0-6b8a7c0b8b73", "comment": "Malware payload", "value": "ff31fae0b5451287cc308140e88b856347db42ef98423c441d2df616851878ee", "object_relation": "sha256", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932166, "uuid": "39146c29-f6eb-4d4e-94e9-e0369b6f8b0b", "comment": "Malware payload", "value": "96abe124ae7f46dbea19036289582f1fda9c1ebf", "object_relation": "sha1", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644932166, "uuid": "221d9c30-4537-4f4f-9750-48fde89a99d1", "comment": "Malware payload", "value": "95a8f03ef647fb4a7a669967cffa7424ed5375eae6016f7d51c80ae9582d05a7f086878d795fbe0a39c67a84ff674922", "object_relation": "sha3-384", "Tag": [ { "name": "185-136-171-110", "colour": "#F98C7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932166, "uuid": "bcc8eda9-2709-46c3-970a-a6877d1b23f6", "value": "T16B636CB71315FCBF1F0A1DA4E10817411C7CACCBE6EC91A83B4139FA95865589ABCEB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932166, "uuid": "9c78ee54-d853-4b68-868e-1b2ceb536e70", "value": "1536:j4Kd3fjZ9Udv032Qm0yDzkfCgUC5hiOcEgCh+BlF2QN:jXvjoMmQVyPkf1LjTHh+BlM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644932166, "uuid": "bf9deba1-c616-4803-b54b-bc7e5bcffb66", "value": 70316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644932166, "uuid": "89624006-6713-4d2f-9d07-92fda4f623af", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644932166, "uuid": "8d784c32-01da-4d6c-adeb-80393ce49a19", "value": "proxynew.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }